security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-hrxh-6v49-42gf	GHSA-hrxh-6v49-42gf	None	None	see lockfile		confirmed

Not Included

• Deferred by batch limit: 3 advisories. They will be considered by future runs.
• Other deferred scanner findings: 82.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	github.com/Microsoft/go-winio	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/aymanbagabas/go-osc52/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/cpuguy83/go-md2man/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/go-viper/mapstructure/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/grpc-ecosystem/grpc-gateway/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/knadh/koanf/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/russross/blackfriday/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/c2h5oh/datasize	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/charmbracelet/bubbles	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/charmbracelet/bubbletea	Non-CVE alert is not handled by dependency remediation.
...	...	72 additional items omitted from PR body. See workflow artifacts for full details.

---

Note

Medium Risk
Large transitive upgrades (gRPC, OpenTelemetry, Docker replace pins) can affect Docker/API client behavior even without code edits; validate builds and any Docker-related CLI flows.

Overview
This PR only updates go.mod and go.sum to address GHSA-hrxh-6v49-42gf through dependency resolution—there are no application source changes.

Direct bumps include golang.org/x/sys (v0.38.0 → v0.43.0) and golang.org/x/term (v0.37.0 → v0.42.0), plus the module go directive is normalized to 1.25.0.

Transitive updates pull in newer gRPC (v1.75.1 → v1.82.1), protobuf (v1.36.10 → v1.36.11), refreshed google.golang.org/genproto stubs, and a coordinated OpenTelemetry stack (v1.38.0 → v1.43.0, including newly listed otel/sdk modules). Lockfile checksums also reflect minor bumps such as golang.org/x/net, golang.org/x/sync, golang.org/x/text, github.com/cespare/xxhash/v2, and github.com/rogpeppe/go-internal.

Existing replace pins for github.com/docker/cli and github.com/docker/docker are moved to newer patch/pre-release revisions as part of the same refresh.

^{Reviewed by Cursor Bugbot for commit f4bead8. Bugbot is set up for automated code reviews on this repo. Configure here.}