security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-9h8m-3fm2-qjrq	go.opentelemetry.io/otel/sdk	None	v1.38.0	1.43.0		confirmed

Not Included

• Deferred by batch limit: 25 advisories. They will be considered by future runs.
• Other deferred scanner findings: 3.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	github.com/getkin/kin-openapi	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	golang.org/x/crypto	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	google.golang.org/grpc	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Low Risk
Dependency-only security bumps with no logic changes; OTel is used for observability but the version step stays within the same major line.

Overview
Bumps OpenTelemetry core packages (otel, metric, sdk, sdk/metric, trace) from v1.38.0 to v1.40.0, and golang.org/x/sys from v0.38.0 to v0.40.0, with matching go.sum checksum updates. There are no application code changes—only manifest lockfile updates intended to address GHSA-9h8m-3fm2-qjrq on go.opentelemetry.io/otel/sdk.

^{Reviewed by Cursor Bugbot for commit 80a46ad. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	go.opentelemetry.io/​otel@​v1.38.0 ⏵ v1.40.0	+1
	golang.org/​x/​sys@​v0.38.0 ⏵ v0.40.0	+1
	go.opentelemetry.io/​otel/​sdk@​v1.38.0 ⏵ v1.40.0	+1	+6
	go.opentelemetry.io/​otel/​sdk/​metric@​v1.38.0 ⏵ v1.40.0	+1
	go.opentelemetry.io/​otel/​trace@​v1.38.0 ⏵ v1.40.0	+1
	go.opentelemetry.io/​otel/​metric@​v1.38.0 ⏵ v1.40.0	+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9787bed. Configure here.}

[ulziibay-kernel]

Bumped to otel 1.44.0 so this also covers CVE-2026-29181, which needs 1.41.0 and was not addressed by the original 1.40.0 bump. Realigned the semconv import to v1.41.0 to fix the conflicting schema URL that was breaking every lib/otel test. test and test-darwin now pass.