fix(deps): remediate CVE-2026-81870 in OpenTelemetry SDK

[plural-copilot]

Security remediation

Remediates CVE-2026-81870.

The affected deployed workload is mgmt/console, running ghcr.io/pluralsh/console:sha-47254bb at digest sha256:c880047b435470ba9eee5d12d3f84e399ed925fe5f39ada07ff4e2e8de968f96. Although the runtime image is pluralsh/console, authoritative dependency provenance maps its Go CLI dependency remediation to this pluralsh/plural-cli repository.

Dependency resolution

• Moves go.opentelemetry.io/otel/sdk from vulnerable v1.44.0 to safe v1.45.0.
• Keeps the coupled core OpenTelemetry modules coherent at v1.45.0: go.opentelemetry.io/otel, /metric, /trace, and /sdk/metric.
• The resolved graph updates compatible github.com/go-logr/logr to v1.4.4 and go.opentelemetry.io/otel/metric/x to v0.67.0, as required by the upgraded family.
• go mod tidy also corrects the existing github.com/vektah/gqlparser/v2 classification to direct. No replace workaround or unrelated dependency version upgrade is included.

Validation

Using golang:1.26.6-alpine3.24:

• go mod download — passed
• go list -m all | grep -E ... — confirmed all five core OTel modules resolve to v1.45.0 and go-logr/logr to v1.4.4
• go mod verify — passed (all modules verified)
• go mod tidy and git diff --check — passed
• go build -o /tmp/plural ./cmd/plural && /tmp/plural version — passed
• go test ./cmd/command/config — passed

Deployment/GitOps tags were intentionally not changed pending a rebuilt and published image; no image tag was manufactured.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create exactly one remediation PR against the repository's current default branch for CVE-2026-81870....
🔗 Run history	View run history

[greptile-apps]

Confidence Score: 5/5

The dependency-only remediation appears safe to merge, with no actionable correctness or security regression identified.

Summary

This PR remediates the OpenTelemetry SDK vulnerability by upgrading the coupled core OpenTelemetry modules from v1.44.0 to v1.45.0.

• Updates the resolved checksums and compatible go-logr and metric/x transitive versions.
• Correctly classifies gqlparser as direct because repository tests import it.
• Keeps the core OpenTelemetry module family aligned at v1.45.0.

_{Reviews (1) · Last reviewed commit: "fix(deps): remediate CVE-2026-81870"}