security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-5cv4-jp36-h3mw	golang.org/x/net	None	v0.46.1-0.20251013234738-63d1a5100f82	0.55.0		confirmed

Not Included

• Deferred by batch limit: 25 advisories. They will be considered by future runs.
• Other deferred scanner findings: 135.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	al.essio.dev/pkg/shellescape	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/AdaLogics/go-fuzz-headers	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Azure/go-ansiterm	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Code-Hex/go-infinity-channel	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Code-Hex/vz/v3	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	go.yaml.in/yaml/v3	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	gotest.tools/v3	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Microsoft/go-winio	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/apapsch/go-jsonmerge/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/cespare/xxhash/v2	Non-CVE alert is not handled by dependency remediation.
...	...	125 additional items omitted from PR body. See workflow artifacts for full details.

---

Note

Medium Risk
Dependency-only bump of security-sensitive packages (golang.org/x/crypto, net, sys) with no app code changes, but version jumps can still surface behavioral regressions.

Overview
Bumps core golang.org/x dependencies for vulnerability remediation: net, sync, and sys as direct deps, plus indirect crypto, mod, text, and tools.

Also refreshes go.sum with the resolved transitive checksums. No application code changes.

Note: the PR description claims an otel/sdk bump for GHSA-9h8m-3fm2-qjrq, but that package remains at v1.38.0 in this diff.

^{Reviewed by Cursor Bugbot for commit 085a672. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​net@​v0.46.1-0.20251013234738-63d1a5100f82 ⏵ v0.55.0		+2
	golang.org/​x/​sys@​v0.38.0 ⏵ v0.45.0
	golang.org/​x/​sync@​v0.17.0 ⏵ v0.20.0

View full report

[ulziibay-kernel]

Bumped to otel 1.44.0 so this also covers CVE-2026-29181, which needs 1.41.0 and was not addressed by the original 1.40.0 bump. Realigned the semconv import to v1.41.0 to fix the conflicting schema URL that was breaking every lib/otel test. test and test-darwin now pass.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 085a672. Configure here.}

[cursor]

Failed OTel CVE remediation

High Severity

This PR claims a confirmed fix for GHSA-9h8m-3fm2-qjrq by moving go.opentelemetry.io/otel/sdk to 1.43.0, but go.mod and go.sum still pin v1.38.0 with no 1.40+ checksums. otel.Init still calls resource.Default(), so Darwin builds remain exposed to the ioreg PATH-hijack ACE. Unrelated golang.org/x/* bumps landed instead.

Additional Locations (1)

• go.mod#L58-L61

 

^{Reviewed by Cursor Bugbot for commit 085a672. Configure here.}