security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-5wrp-cwcj-q835	GHSA-5wrp-cwcj-q835	None	None	see lockfile		confirmed

Not Included

• Deferred by batch limit: 3 advisories. They will be considered by future runs.
• Other deferred scanner findings: 0.
• Unconfirmed attempted fixes: 0.

---

Note

Low Risk
Lockfile-only security bumps with no CLI logic changes; minor version skew between OTel core (1.44) and SDK (1.43) and Docker pre-release replaces are worth a quick build/test pass.

Overview
This PR addresses GHSA-5wrp-cwcj-q835 by refreshing Go module dependencies only—there are no application source changes.

OpenTelemetry indirect modules go.opentelemetry.io/otel, otel/metric, and otel/trace move from v1.43.0 to v1.44.0; otel/sdk and otel/sdk/metric stay on v1.43.0. go.sum is regenerated with a large set of new transitive checksums (including GCP OTel detectors, envoy/grpc-related packages, and Docker CLI stack deps).

Existing replace pins are updated: github.com/docker/cli → v29.2.0, and github.com/docker/docker → a newer v28.5.3 pre-release pseudo-version. Other deferred advisories (including a non-CVE docker/docker finding) are explicitly out of scope for this batch.

^{Reviewed by Cursor Bugbot for commit b53eca3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ulziibay-kernel]

lgtm — dependency-only security bump, CI green