fix: upgrade extras/dagger OpenTelemetry dependencies to v1.41.0
Summary
Upgraded the extras/dagger module from OpenTelemetry v1.38.0 to the first fixed release line, v1.41.0, to remove the vulnerable baggage header parsing implementation. The change is limited to that helper module and its required transitive dependency updates.
Vulnerability Fixed
GHSA-mh2q-q3fh-2475 (HIGH): OpenTelemetry-Go multi-value baggage header extraction can trigger excessive allocations and enable remote denial-of-service amplification before v1.41.0.
Changes Made
- Bumped
go.opentelemetry.io/otel,go.opentelemetry.io/otel/sdk,go.opentelemetry.io/otel/trace, and related OTLP exporter/metric modules inextras/dagger/go.modfromv1.38.0tov1.41.0. - Accepted the minimal transitive dependency updates that the
v1.41.0OpenTelemetry release line requires in the same module. - Refreshed
extras/dagger/go.sumto match the patched dependency graph.
Verification
Classification: resolved.
Attempted SBOM-first verification with syft dir:. -o cyclonedx-json | grype sbom:/dev/stdin --only-fixed -o json, but this grype build requires a seekable SBOM input and could not read stdin. As a best-effort fallback, I ran grype dir:. --only-fixed -o json against repo/, and it reported 0 matches for GHSA-mh2q-q3fh-2475.