fix(deps): vuln minor upgrades — 7 packages (minor: 5 · patch: 2) [test/e2e/go.mod]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 7 packages upgraded (MINOR changes included)

Manifests changed:

• test/e2e/go.mod (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
github.com/go-git/go-git/v5	v5.19.1	v5.19.2	patch	Transitive	3 HIGH, 3 MEDIUM
google.golang.org/grpc	v1.81.0	v1.83.1	minor	Transitive	2 HIGH
go.opentelemetry.io/otel	v1.43.0	v1.45.0	minor	Transitive	3 MEDIUM
github.com/gorilla/websocket	v1.5.1	v1.5.3	patch	Transitive	1 MEDIUM
golang.org/x/crypto	v0.53.0	v0.55.0	minor	Transitive	1 UNKNOWN
golang.org/x/mod	v0.36.0	v0.40.0	minor	Transitive	2 UNKNOWN
golang.org/x/text	v0.38.0	v0.41.0	minor	Transitive	1 UNKNOWN

---

Security Details

🚨 Critical & High Severity (5 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/go-git/go-git/v5	GHSA-hc8v-wwc9-vgxm	HIGH	go-git: Worktree operations may follow symlinks	v5.19.1	5.19.2	-
github.com/go-git/go-git/v5	CVE-2026-71556	high	go-git: Worktree operations may follow symlinks	v5.19.1	-	-
github.com/go-git/go-git/v5	GO-2026-6213	high	Worktree operations may follow symlinks in github.com/go-git/go-git	v5.19.1	5.19.2	-
google.golang.org/grpc	GHSA-hrxh-6v49-42gf	HIGH	gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities	v1.81.0	1.82.1	-
google.golang.org/grpc	GO-2026-6061	HIGH	Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc	v1.81.0	1.82.1	-

ℹ️ Other Vulnerabilities (11)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/go-git/go-git/v5	CVE-2026-71557	medium	go-git: Malicious reference names may modify files outside the reference storage	v5.19.1	-	-
github.com/go-git/go-git/v5	GO-2026-6214	medium	Path traversal via crafted reference names in github.com/go-git/go-git	v5.19.1	5.19.2	-
go.opentelemetry.io/otel	GO-2026-5158	medium	Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel	v1.43.0	1.42.0	-
go.opentelemetry.io/otel	CVE-2026-41178	medium	OpenTelemetry-Go's baggage parsing no longer caps raw header length	v1.43.0	-	-
github.com/go-git/go-git/v5	GHSA-qgq7-7hm3-q39j	MODERATE	go-git: Malicious reference names may modify files outside the reference storage	v5.19.1	5.19.2	-
github.com/gorilla/websocket	GHSA-w67g-5rqw-f597	MODERATE	Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key	v1.5.1	1.5.3	-
go.opentelemetry.io/otel	GHSA-5wrp-cwcj-q835	MODERATE	opentelemetry-go's baggage parsing no longer caps raw header length	v1.43.0	-	-
golang.org/x/crypto	GO-2026-5932	unknown	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues	v0.53.0	-	-
golang.org/x/mod	GO-2026-6180	unknown	Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb	v0.36.0	0.40.0	-
golang.org/x/mod	GO-2026-6179	unknown	Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog	v0.36.0	0.40.0	-
golang.org/x/text	GO-2026-5970	unknown	Infinite loop on invalid input in golang.org/x/text	v0.38.0	0.39.0	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[datadog-prod-us1-4]

⚠️ Warnings

🚦 1 Pipeline job failed

DataDog/agent-linux-install-script | go_e2e_deps

View more details · View in GitLab

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 4832dc7 | Docs | View more details | Give us feedback!}