[release-4.16] OCPBUGS-79934: Bump google.golang.org/grpc to v1.79.3

[ocp-sustaining-admins]

This is an automated PR from the ARC system.

Go version used: go1.21.13

Patch applied: github.com/openshift-sustaining/grpc-go@v1.67.3-sec.1

Modules affected: .

The commands used to generate this PR were:

go mod edit -replace google.golang.org/grpc=github.com/openshift-sustaining/grpc-go@v1.67.3-sec.1
go mod tidy
go mod vendor

A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.

Summary by CodeRabbit

• Chores
  • Updated OpenTelemetry stack and related dependencies to latest stable versions for improved system stability.
  • Applied security-focused update to core networking library through an updated override directive.

[openshift-ci-robot]

@ocp-sustaining-admins: This pull request references Jira Issue OCPBUGS-79934, which is invalid:

• release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
• expected Jira Issue OCPBUGS-79934 to depend on a bug targeting a version in 4.17.0, 4.17.z and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This is an automated PR from the ARC system.

Go version used: go1.21.13

Patch applied: github.com/openshift-sustaining/grpc-go@v1.67.3-sec.1

Modules affected: .

The commands used to generate this PR were:

go mod edit -replace google.golang.org/grpc=github.com/openshift-sustaining/grpc-go@v1.67.3-sec.1
go mod tidy
go mod vendor

A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The pull request updates go.mod with indirect dependency version bumps and a major OpenTelemetry ecosystem upgrade from v1.19.0 to v1.28.0. Related dependencies including gRPC, protobuf, and genproto are also updated. A gRPC replace directive is added to pin the module to a fork.

Changes

Go module dependency updates

Layer / File(s)	Summary
Minor utility version bumps go.mod	xxhash, logr, and uuid are independently bumped to newer patch or minor versions.
OpenTelemetry ecosystem and gRPC upgrade go.mod	OpenTelemetry stack and coordinated ecosystem dependencies (golang.org/x/, google.golang.org/genproto/, grpc, protobuf) are upgraded to newer major/minor versions. A replace directive overrides gRPC with the openshift-sustaining fork at v1.67.3-sec.1.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 11 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title mentions bumping google.golang.org/grpc to v1.79.3, but the actual change applies a replace directive to github.com/openshift-sustaining/grpc-go@v1.67.3-sec.1, making the title misleading about the actual version.	Update the title to accurately reflect the replace directive being applied (e.g., 'Use openshift-sustaining/grpc-go v1.67.3-sec.1 security patch') or clarify what v1.79.3 refers to in context.

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Repository uses standard Go testing (not Ginkgo); no Ginkgo test names to check. The custom check requirement is not applicable to this codebase.
Test Structure And Quality	✅ Passed	PR contains no Ginkgo tests; custom check for "Ginkgo test code" is not applicable. Only standard Go unit tests using the testing package are present.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests are added in this PR; it only updates go.mod dependencies and vendor directory, so MicroShift test compatibility check does not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR adds standard Go unit tests (testing.T), not Ginkgo e2e tests. Custom check only applies to Ginkgo patterns (It(), Describe(), Context(), When()), which are not present.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only updates go.mod with dependency versions and a replace directive; no deployment manifests, operator code, or scheduling constraints were added or modified.
Ote Binary Stdout Contract	✅ Passed	No OTE Stdout Contract violations found. Main code uses k8s.io/component-base/cli.Run(), init() registers metrics, and klog is only in controller code, not process-level.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only modifies go.mod and contains no Ginkgo e2e tests (It(), Describe(), etc.); check is not applicable to this dependency-only PR.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

Hi @ocp-sustaining-admins. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[kunalmemane]

/ok-to-test

[kunalmemane]

/test e2e-aws-ovn

[openshift-ci]

@ocp-sustaining-admins: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[prabhapa]

/lgtm
/label approved
/label backport-risk-assessed
Approving as the tests are green . Though there is a use of depricated apis of go-grpc it wont affect the behaviour . There can be some behavioural changes for good due to the bump indirectly via etcd.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ocp-sustaining-admins, prabhapa
Once this PR has been reviewed and has the lgtm label, please assign miheer for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[MrSanketkumar]

/verified by CI

[openshift-ci-robot]

@MrSanketkumar: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[kunalmemane]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[openshift-ci-robot]

@ocp-sustaining-admins: This pull request references Jira Issue OCPBUGS-79934, which is invalid:

• expected dependent Jira Issue OCPBUGS-80022 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

This is an automated PR from the ARC system.

Go version used: go1.21.13

Patch applied: github.com/openshift-sustaining/grpc-go@v1.67.3-sec.1

Modules affected: .

The commands used to generate this PR were:

go mod edit -replace google.golang.org/grpc=github.com/openshift-sustaining/grpc-go@v1.67.3-sec.1
go mod tidy
go mod vendor

A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.

Summary by CodeRabbit

• Chores
• Updated OpenTelemetry stack and related dependencies to latest stable versions for improved system stability.
• Applied security-focused update to core networking library through an updated override directive.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 79: go.mod currently pins vulnerable indirect modules; update
go.opentelemetry.io/otel/sdk and golang.org/x/oauth2 to the OSV-fixed (patched)
releases reported by the OSV/GHSA advisories by bumping their versions in go.mod
(e.g., run go get go.opentelemetry.io/otel/sdk@<patched-version> and go get
golang.org/x/oauth2@<patched-version> and then go mod tidy), or if you cannot
update in this change, add a documented follow-up to the PR that lists the exact
target patched versions for go.opentelemetry.io/otel/sdk and golang.org/x/oauth2
and a plan to bump and verify them.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fb25a571-c6ff-4127-89c5-6927b1e93e31

📥 Commits

Reviewing files that changed from the base of the PR and between 5da234d and bd1721c.

⛔ Files ignored due to path filters (299)

• go.sum is excluded by !**/*.sum
• vendor/github.com/cespare/xxhash/v2/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/cespare/xxhash/v2/xxhash.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/cespare/xxhash/v2/xxhash_asm.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/cespare/xxhash/v2/xxhash_other.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/cespare/xxhash/v2/xxhash_safe.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/cespare/xxhash/v2/xxhash_unsafe.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/go-logr/logr/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/go-logr/logr/context.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/go-logr/logr/context_noslog.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/go-logr/logr/context_slog.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/go-logr/logr/funcr/funcr.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/go-logr/logr/funcr/slogsink.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/go-logr/logr/logr.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/go-logr/logr/sloghandler.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/go-logr/logr/slogr.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/go-logr/logr/slogr/slogr.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/go-logr/logr/slogsink.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/golang/protobuf/jsonpb/decode.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/golang/protobuf/jsonpb/encode.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/golang/protobuf/jsonpb/json.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/google/uuid/.travis.yml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/google/uuid/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/google/uuid/CONTRIBUTING.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/google/uuid/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/google/uuid/hash.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/google/uuid/node_js.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/google/uuid/time.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/google/uuid/uuid.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/google/uuid/version6.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/google/uuid/version7.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/.codespellignore is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/.codespellrc is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/.gitignore is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/.gitmodules is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/.golangci.yml is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/CHANGELOG.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/CODEOWNERS is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/CONTRIBUTING.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/Makefile is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/RELEASING.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/encoder.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/filter.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/iterator.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/key.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/kv.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/set.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/attribute/value.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/baggage/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/baggage/baggage.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/baggage/context.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/baggage/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/codes/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/codes/codes.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/codes/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/error_handler.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/get_main_pkgs.sh is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/handler.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/attribute/attribute.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/baggage/baggage.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/baggage/context.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/gen.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/global/handler.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/global/instruments.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/global/internal_logging.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/global/meter.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/global/propagator.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/global/state.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/global/trace.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal/rawhelpers.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/internal_logging.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/asyncfloat64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/asyncint64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/config.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/embedded/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/embedded/embedded.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/instrument.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/meter.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/syncfloat64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/metric/syncint64.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/propagation.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/propagation/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/propagation/baggage.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/propagation/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/propagation/propagation.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/propagation/trace_context.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/renovate.json is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/requirements.txt is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/instrumentation/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/instrumentation/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/instrumentation/library.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/instrumentation/scope.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/internal/env/env.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/internal/gen.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/internal/x/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/internal/x/x.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/auto.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/builtin.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/config.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/container.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/env.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id_bsd.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id_darwin.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id_exec.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id_readfile.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id_unsupported.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/host_id_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/os.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/os_release_darwin.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/os_release_unix.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/os_unix.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/os_unsupported.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/os_windows.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/process.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/resource/resource.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/event.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/evictedqueue.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/id_generator.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/link.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/provider.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/sampler_env.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/sampling.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/simple_span_processor.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/snapshot.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/span.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/span_exporter.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/span_limits.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/span_processor.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/tracer.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/trace/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/sdk/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/internal/http.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.12.0/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.12.0/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.12.0/exception.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.12.0/http.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.12.0/resource.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.12.0/schema.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.12.0/trace.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.17.0/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.17.0/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.17.0/event.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.17.0/exception.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.17.0/http.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.17.0/resource.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.17.0/schema.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.17.0/trace.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.21.0/attribute_group.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.21.0/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.21.0/event.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.21.0/exception.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.21.0/resource.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.21.0/schema.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.21.0/trace.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.26.0/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.26.0/attribute_group.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.26.0/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.26.0/exception.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.26.0/metric.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.26.0/schema.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/config.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/context.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/doc.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/embedded/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/embedded/embedded.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/nonrecording.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/noop.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/noop/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/noop/noop.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/trace.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/trace/tracestate.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/verify_examples.sh is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/verify_readmes.sh is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/version.go is excluded by !**/vendor/**, !vendor/**
• vendor/go.opentelemetry.io/otel/versions.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/LICENSE is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/cryptobyte/asn1/asn1.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/cryptobyte/string.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/hkdf/hkdf.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/internal/poly1305/bits_compat.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/internal/poly1305/bits_go1.13.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/internal/poly1305/sum_generic.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64le.s is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/nacl/secretbox/secretbox.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/crypto/salsa20/salsa/hsalsa20.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/LICENSE is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http/httpguts/httplex.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/frame.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/http2.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/pipe.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/server.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/timer.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/transport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/http2/writesched_priority.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/websocket/client.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/websocket/dial.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/websocket/hybi.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/net/websocket/websocket.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/LICENSE is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/deviceauth.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/internal/client_appengine.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/internal/token.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/internal/transport.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/oauth2.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/pkce.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/oauth2/token.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sync/LICENSE is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/LICENSE is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/asm_darwin_x86_gc.s is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu_arm64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu_arm64.s is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu_darwin_x86.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu_gc_arm64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu_gc_x86.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu_gc_x86.s is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu_gccgo_x86.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu_linux_arm64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu_linux_noinit.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu_linux_riscv64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu_other_x86.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu_riscv64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/cpu_x86.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/cpu/syscall_darwin_x86_gc.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/README.md is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/aliases.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/asm_zos_s390x.s is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/bpxsvc_zos.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/bpxsvc_zos.s is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/epoll_zos.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/fstatfs_zos.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/ioctl_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/mkerrors.sh is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/mmap_nomremap.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/mremap.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/pagesize_unix.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/readdirent_getdirentries.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/sockcmsg_zos.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/symaddr_zos_s390x.s is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_aix.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_darwin.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_darwin_libSystem.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_freebsd.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_hurd.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_arm64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_loong64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_openbsd.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_unix.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/syscall_zos_s390x.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/sysvshm_unix.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/sysvshm_unix_other.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/vgetrandom_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/vgetrandom_unsupported.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_386.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_arm.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_mips.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zerrors_zos_s390x.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zsymaddr_zos_s390x.s is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zsyscall_linux.go is excluded by !**/vendor/**, !vendor/**
• vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (1)

• go.mod

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify current go.mod entries and OSV vulnerability presence.
set -euo pipefail

echo "Current go.mod entries:"
rg -n '^\s*go\.opentelemetry\.io/otel/sdk\s+v|^\s*golang\.org/x/oauth2\s+v' go.mod

echo
echo "OSV advisories for go.opentelemetry.io/otel/sdk@v1.28.0:"
curl -s "https://api.osv.dev/v1/query" \
  -H "Content-Type: application/json" \
  -d '{"package":{"ecosystem":"Go","name":"go.opentelemetry.io/otel/sdk"},"version":"v1.28.0"}' \
  | jq '{count:(.vulns|length), ids:[.vulns[].id]}'

echo
echo "OSV advisories for golang.org/x/oauth2@v0.22.0:"
curl -s "https://api.osv.dev/v1/query" \
  -H "Content-Type: application/json" \
  -d '{"package":{"ecosystem":"Go","name":"golang.org/x/oauth2"},"version":"v0.22.0"}' \
  | jq '{count:(.vulns|length), ids:[.vulns[].id]}'

Repository: openshift/route-controller-manager

Length of output: 491

---

Update vulnerable Go dependencies in go.mod (OSV reports issues)

OSV shows HIGH vulnerabilities in:

• go.opentelemetry.io/otel/sdk v1.28.0 // indirect (GHSA-9h8m-3fm2-qjrq, GHSA-hfvc-g4fc-pqhx, GO-2026-4394) — go.mod line 79
• golang.org/x/oauth2 v0.22.0 // indirect (GHSA-6v2p-p543-phr9, GO-2025-3488) — go.mod line 88

Update these modules to OSV-fixed (patched) versions in the same PR, or add a documented follow-up with concrete target versions.

🧰 Tools

🪛 OSV Scanner (2.3.8)

[HIGH] 79-79: go.opentelemetry.io/otel/sdk 1.28.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk

(GO-2026-4394)

---

[HIGH] 79-79: go.opentelemetry.io/otel/sdk 1.28.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

(GHSA-9h8m-3fm2-qjrq)

---

[HIGH] 79-79: go.opentelemetry.io/otel/sdk 1.28.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

(GHSA-hfvc-g4fc-pqhx)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 79, go.mod currently pins vulnerable indirect modules; update
go.opentelemetry.io/otel/sdk and golang.org/x/oauth2 to the OSV-fixed (patched)
releases reported by the OSV/GHSA advisories by bumping their versions in go.mod
(e.g., run go get go.opentelemetry.io/otel/sdk@<patched-version> and go get
golang.org/x/oauth2@<patched-version> and then go mod tidy), or if you cannot
update in this change, add a documented follow-up to the PR that lists the exact
target patched versions for go.opentelemetry.io/otel/sdk and golang.org/x/oauth2
and a plan to bump and verify them.