fix(deps): bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158

[bomly-guy]

Summary

Triage of two OSV advisories detected 2026-07-31 by scanning a bomly-generated SBOM of this repo.

GO-2026-5158 / CVE-2026-41178 / GHSA-5wrp-cwcj-q835 — otel baggage parsing (fixed here)

• We resolved go.opentelemetry.io/otel v1.43.0, which sits in the affected range ([1.41.0, 1.42.0) and [1.43.0, 1.44.0)). It is an indirect dependency, pulled in by anchore/syft v1.49.0, anchore/grype v0.116.0, containerd/v2, and the GCP/OTel contrib chain.
• The vulnerable packages (otel/baggage, otel/propagation) are in our build graph, but govulncheck ./... symbol analysis reports no vulnerable symbols reachable (baggage.New/Parse, Baggage.Extract are never called from our code paths).
• Bumped to the fixed v1.44.0 anyway (otel, otel/metric, otel/trace); otel/sdk is not named in the advisory and stays at v1.43.0. After the bump govulncheck reports zero package-level findings.

GO-2026-5932 — golang.org/x/crypto/openpgp (documented as unreachable; no code change)

• golang.org/x/crypto/openpgp is not imported anywhere in our dependency closure — go list -deps ./... shows only ProtonMail's maintained fork github.com/ProtonMail/go-crypto/openpgp (used by syft). govulncheck reports this advisory at module level only ("vulnerability in modules you require, but your code doesn't appear to call these").
• The advisory has no fixed version (the package is deprecated in place), so no bump can clear it; the x/crypto module itself is legitimately required by syft/stereoscope and by us for other packages.
• Guard gates at fail-on: high and this advisory carries no severity, so it does not block CI. Disposition: accepted / unreachable at package level; re-evaluate only if a future dependency starts importing x/crypto/openpgp.

Verification

• make test — full suite green.
• govulncheck ./... after the bump: "Your code is affected by 0 vulnerabilities … 0 vulnerabilities in packages you import"; only the unfixable module-level GO-2026-5932 notice remains.
• go build ./... clean.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated OpenTelemetry components to version 1.44.0.
  • No user-visible features or behavior changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 93c40d09-d679-4081-980e-6816ea55a1eb

📥 Commits

Reviewing files that changed from the base of the PR and between 55b347a and ec06d15.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

---

📝 Walkthrough

Walkthrough

The pull request updates three indirect OpenTelemetry modules in go.mod from v1.43.0 to v1.44.0. OpenTelemetry SDK modules remain at v1.43.0.

Changes

OpenTelemetry dependency update

Layer / File(s)	Summary
Update OpenTelemetry modules go.mod	The indirect otel, otel/metric, and otel/trace modules now use v1.44.0. SDK modules remain at v1.43.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the OpenTelemetry dependency upgrade and its security purpose.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/otel-1.44-go-2026-5158

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Bomly Diff Summary

Compared 55b347a31046ebb7ead483f6180a505fc46bb13d to ec06d15fca6ffa35c2909b8d3d264cd00c304f90.

Overview

Status	Manifests	Dependencies	Findings	Duration
✅ Pass	+0 / ~1 / -0	0 added / 3 version changed / 0 detail changes / 0 removed	0 introduced / 0 persisted / 0 resolved	1m 18s

Dependency Changes

Summary: 0 added, 3 version changed, 0 detail changes, 0 removed.

Changed Dependencies

Change	Package	Version	Direct?	Scope	Licenses
changed	go.opentelemetry.io/otel/metric	v1.43.0 → v1.44.0	No	runtime	Apache-2.0, BSD-3-Clause
changed	go.opentelemetry.io/otel/trace	v1.43.0 → v1.44.0	No	runtime	Apache-2.0, BSD-3-Clause
changed	go.opentelemetry.io/otel	v1.43.0 → v1.44.0	No	runtime	Apache-2.0, BSD-3-Clause

Vulnerabilities

Summary: 0 introduced, 0 persisted, 1 resolved.

Resolved Vulnerabilities

Change	Severity	ID	Package	Fixed In	Source	Title
resolved	MEDIUM	GO-2026-5158	go.opentelemetry.io/otel@v1.43.0	1.42.0	grype	Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

License Changes

✅ No license changes.

Project Posture

✅ No project posture changes (--matchers +scorecard was not selected).

Policy Findings

✅ No policy differences were identified.