Review two OSV advisories in the Go dependency tree (otel baggage, x/crypto/openpgp)

[bomly-guy]

Independent scanning of a Bomly-generated SBOM of this repo (v0.21.1-era main, 2026-07-31) matched two OSV advisories against our module graph. Both verified against api.osv.dev.

Advisories

1. GO-2026-5158 (CVE-2026-41178 / GHSA-5wrp-cwcj-q835) — go.opentelemetry.io/otel: baggage parsing no longer caps raw header length. Determine our resolved version and the dependency path (bomly explain / go mod graph), check reachability with govulncheck, and bump if a fixed version exists.
2. GO-2026-5932 — golang.org/x/crypto/openpgp is unmaintained and unsafe by design. Almost certainly transitive; confirm whether any code path imports it (govulncheck symbol-level should report unreachable) and whether a parent bump drops it from the tree.

Suggested approach

• govulncheck ./... for symbol-level confirmation on both.
• If unreachable: document the assessment here and close (or track for the next routine bump).
• If reachable or trivially fixable: bump via PR (make test; smoke unaffected unless go.mod graph shape changes fixture goldens).

Also a nice dogfooding check: bomly scan --path . --enrich --matchers osv should surface both — if it doesn't, that's a separate detection issue worth filing.

🤖 Generated with Claude Code