fix(deps): vuln minor upgrades — 6 packages (minor: 5 · patch: 1) [test/e2e]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 6 packages upgraded (MINOR changes included)

Manifests changed:

• test/e2e (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
github.com/go-git/go-git/v5	v5.19.1	v5.19.2	patch	Transitive	2 HIGH, 2 MEDIUM
google.golang.org/grpc	v1.81.0	v1.83.0	minor	Transitive	2 HIGH
go.opentelemetry.io/otel	v1.43.0	v1.45.0	minor	Transitive	3 MEDIUM
golang.org/x/crypto	v0.53.0	v0.55.0	minor	Transitive	1 UNKNOWN
golang.org/x/mod	v0.36.0	v0.40.0	minor	Transitive	2 UNKNOWN
golang.org/x/text	v0.38.0	v0.41.0	minor	Transitive	1 UNKNOWN

---

Security Details

🚨 Critical & High Severity (4 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/go-git/go-git/v5	GHSA-hc8v-wwc9-vgxm	HIGH	go-git: Worktree operations may follow symlinks	v5.19.1	5.19.2	-
github.com/go-git/go-git/v5	CVE-2026-71556	HIGH	go-git: Worktree operations may follow symlinks	v5.19.1	-	-
google.golang.org/grpc	GHSA-hrxh-6v49-42gf	HIGH	gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities	v1.81.0	1.82.1	-
google.golang.org/grpc	GO-2026-6061	HIGH	Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc	v1.81.0	1.82.1	-

ℹ️ Other Vulnerabilities (9)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
go.opentelemetry.io/otel	CVE-2026-41178	medium	OpenTelemetry-Go's baggage parsing no longer caps raw header length	v1.43.0	-	-
go.opentelemetry.io/otel	GO-2026-5158	medium	Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel	v1.43.0	1.42.0	-
github.com/go-git/go-git/v5	CVE-2026-71557	MODERATE	go-git: Malicious reference names may modify files outside the reference storage	v5.19.1	-	-
github.com/go-git/go-git/v5	GHSA-qgq7-7hm3-q39j	MODERATE	go-git: Malicious reference names may modify files outside the reference storage	v5.19.1	5.19.2	-
go.opentelemetry.io/otel	GHSA-5wrp-cwcj-q835	MODERATE	opentelemetry-go's baggage parsing no longer caps raw header length	v1.43.0	-	-
golang.org/x/crypto	GO-2026-5932	unknown	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues	v0.53.0	-	-
golang.org/x/mod	GO-2026-6179	unknown	Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog	v0.36.0	0.40.0	-
golang.org/x/mod	GO-2026-6180	unknown	Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb	v0.36.0	0.40.0	-
golang.org/x/text	GO-2026-5970	unknown	Infinite loop on invalid input in golang.org/x/text	v0.38.0	0.39.0	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[datadog-datadog-us1-prod]

⚠️ Warnings

🚦 1 Pipeline job failed

DataDog/agent-linux-install-script | go_e2e_deps     

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c7be462 | Docs | Datadog PR Page | Give us feedback!}