security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-8wmf-6v46-5gfg	GHSA-8wmf-6v46-5gfg	None	None	see lockfile		confirmed

Not Included

• Deferred by batch limit: 2 advisories. They will be considered by future runs.
• Other deferred scanner findings: 0.
• Unconfirmed attempted fixes: 0.

---

Note

Medium Risk
No source changes, but newer Docker engine/client and OpenTelemetry versions can affect container and telemetry behavior at runtime.

Overview
Bumps Go module dependencies to address GHSA-8wmf-6v46-5gfg, with lockfile-only changes in go.mod and go.sum.

Direct: golang.org/x/sys v0.43.0 → v0.47.0.

Indirect: github.com/go-logr/logr v1.4.3 → v1.4.4; OpenTelemetry (go.opentelemetry.io/otel and related metric/sdk/trace packages) aligned to v1.45.0 (from mixed v1.43/v1.44).

Replace pins: github.com/docker/cli → v29.2.0 and github.com/docker/docker → a newer v28.5.3 pre-release commit, keeping declared require versions while pulling patched builds for the Docker stack used by the CLI.

^{Reviewed by Cursor Bugbot for commit bf37171. Bugbot is set up for automated code reviews on this repo. Configure here.}