fix(deps): vuln minor upgrades — 7 packages (minor: 5 · patch: 2) [test/e2e/go.mod]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 7 packages upgraded (MINOR changes included)

Manifests changed:

• test/e2e/go.mod (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
github.com/go-git/go-git/v5	v5.19.1	v5.19.2	patch	Transitive	3 HIGH, 3 MEDIUM
google.golang.org/grpc	v1.81.0	v1.83.1	minor	Transitive	2 HIGH
go.opentelemetry.io/otel	v1.43.0	v1.45.0	minor	Transitive	3 MEDIUM
github.com/gorilla/websocket	v1.5.1	v1.5.3	patch	Transitive	1 MEDIUM
golang.org/x/crypto	v0.53.0	v0.55.0	minor	Transitive	1 UNKNOWN
golang.org/x/mod	v0.36.0	v0.40.0	minor	Transitive	2 UNKNOWN
golang.org/x/text	v0.38.0	v0.41.0	minor	Transitive	1 UNKNOWN

---

Security Details

🚨 Critical & High Severity (5 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/go-git/go-git/v5	GHSA-hc8v-wwc9-vgxm	HIGH	go-git: Worktree operations may follow symlinks	v5.19.1	5.19.2	-
github.com/go-git/go-git/v5	CVE-2026-71556	high	go-git: Worktree operations may follow symlinks	v5.19.1	-	-
github.com/go-git/go-git/v5	GO-2026-6213	high	Worktree operations may follow symlinks in github.com/go-git/go-git	v5.19.1	5.19.2	-
google.golang.org/grpc	GHSA-hrxh-6v49-42gf	HIGH	gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities	v1.81.0	1.82.1	-
google.golang.org/grpc	GO-2026-6061	HIGH	Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc	v1.81.0	1.82.1	-

ℹ️ Other Vulnerabilities (11)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/go-git/go-git/v5	CVE-2026-71557	medium	go-git: Malicious reference names may modify files outside the reference storage	v5.19.1	-	-
github.com/go-git/go-git/v5	GO-2026-6214	medium	Path traversal via crafted reference names in github.com/go-git/go-git	v5.19.1	5.19.2	-
go.opentelemetry.io/otel	GO-2026-5158	medium	Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel	v1.43.0	1.42.0	-
go.opentelemetry.io/otel	CVE-2026-41178	medium	OpenTelemetry-Go's baggage parsing no longer caps raw header length	v1.43.0	-	-
github.com/go-git/go-git/v5	GHSA-qgq7-7hm3-q39j	MODERATE	go-git: Malicious reference names may modify files outside the reference storage	v5.19.1	5.19.2	-
github.com/gorilla/websocket	GHSA-w67g-5rqw-f597	MODERATE	Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key	v1.5.1	1.5.3	-
go.opentelemetry.io/otel	GHSA-5wrp-cwcj-q835	MODERATE	opentelemetry-go's baggage parsing no longer caps raw header length	v1.43.0	-	-
golang.org/x/crypto	GO-2026-5932	unknown	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues	v0.53.0	-	-
golang.org/x/mod	GO-2026-6180	unknown	Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb	v0.36.0	0.40.0	-
golang.org/x/mod	GO-2026-6179	unknown	Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog	v0.36.0	0.40.0	-
golang.org/x/text	GO-2026-5970	unknown	Infinite loop on invalid input in golang.org/x/text	v0.38.0	0.39.0	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[datadog-prod-us1-4]

✅ All CI checks and tests passed.

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 7896983 | Docs | View more details | Give us feedback!}

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with main — rebased onto 89cf319.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}

[dd-prapprover-prod-77c48c]

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

• ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-09-02T18:48:11Z
• ✅ CI tests passed - 2026-09-02T18:49:19Z
• ✅ Approved (commit: 7896983) - 2026-09-02T18:49:21Z
• ✅ Merge Started
• ⬜ Merged

➡️ Current phase: ⏳ Merge via MergeQueue is already in progress...

[dd-prapprover-prod-77c48c]

This PR has been automatically approved by the DD PR Approver bot.