High and Critical CVEs should be addressed in otel-cli

[n4zukker]

Hi Amy (@tobert ).

Thank you for creating otel-cli. I'm using it to track work performed by a bash script.

jfrog has found several vulnerabilities in the code. These are all easily resolved with some simple upgrades to go.mod.
Would you please take a look at the PR I am opening. The PR also addresses a log vulnerability in the otel-cli project's code.

Thank you.

X-Ray vulnerability scan results

Severity	Fixable	Non-Fixable	Total
Critical	3	0	3
High	20	0	20
Medium	20	0	20
Low	2	0	2
Unknown	0	0	0
Total	45	0	45

Fixes

Severity	CVE	Component	Fixed version(s)
Critical	CVE-2025-68121	go://github.com/golang/go:1.24.2	[1.24.13], [1.25.7], [1.26.0-rc.3]
Critical	CVE-2026-27143	go://github.com/golang/go:1.24.2	[1.25.9], [1.26.2]
Critical	CVE-2026-33186	go://google.golang.org/grpc:1.64.0	[1.79.3]
High	CVE-2025-22874	go://github.com/golang/go:1.24.2	[1.24.4]
High	CVE-2025-4674	go://github.com/golang/go:1.24.2	[1.23.11], [1.24.5]
High	CVE-2025-47907	go://github.com/golang/go:1.24.2	[1.23.12], [1.24.6]
High	CVE-2025-58187	go://github.com/golang/go:1.24.2	[1.24.9], [1.25.2]
High	CVE-2025-58188	go://github.com/golang/go:1.24.2	[1.24.8], [1.25.2]
High	CVE-2025-61723	go://github.com/golang/go:1.24.2	[1.24.8], [1.25.2]
High	CVE-2025-61725	go://github.com/golang/go:1.24.2	[1.24.8], [1.25.2]
High	CVE-2025-61726	go://github.com/golang/go:1.24.2	[1.24.12], [1.25.6]
High	CVE-2025-61729	go://github.com/golang/go:1.24.2	[1.24.11], [1.25.5]
High	CVE-2025-61731	go://github.com/golang/go:1.24.2	[1.24.12], [1.25.6]
High	CVE-2025-61732	go://github.com/golang/go:1.24.2	[1.24.13], [1.25.7]
High	CVE-2025-68119	go://github.com/golang/go:1.24.2	[1.24.13], [1.25.6]
High	CVE-2026-25679	go://github.com/golang/go:1.24.2	[1.25.8], [1.26.1]
High	CVE-2026-27140	go://github.com/golang/go:1.24.2	[1.25.9], [1.26.2]
High	CVE-2026-27144	go://github.com/golang/go:1.24.2	[1.25.9], [1.26.2]
High	CVE-2026-32280	go://github.com/golang/go:1.24.2	[1.25.9], [1.26.2]
High	CVE-2026-32281	go://github.com/golang/go:1.24.2	[1.25.9], [1.26.2]
High	CVE-2026-32283	go://github.com/golang/go:1.24.2	[1.25.9], [1.26.2]
High	CVE-2026-24051	go://go.opentelemetry.io/otel/sdk:1.27.0	[1.40.0]
High	CVE-2026-39883	go://go.opentelemetry.io/otel/sdk:1.27.0	[1.43.0]
Medium	CVE-2025-0913	go://github.com/golang/go:1.24.2	[1.23.10], [1.24.4]
Medium	CVE-2025-4673	go://github.com/golang/go:1.24.2	[1.23.10], [1.24.4]
Medium	CVE-2025-47906	go://github.com/golang/go:1.24.2	[1.23.12], [1.24.6]
Medium	CVE-2025-47912	go://github.com/golang/go:1.24.2	[1.24.8], [1.25.2]
Medium	CVE-2025-58183	go://github.com/golang/go:1.24.2	[1.24.8], [1.25.2]
Medium	CVE-2025-58185	go://github.com/golang/go:1.24.2	[1.24.8], [1.25.2]
Medium	CVE-2025-58186	go://github.com/golang/go:1.24.2	[1.24.8], [1.25.2]
Medium	CVE-2025-58189	go://github.com/golang/go:1.24.2	[1.24.8], [1.25.2]
Medium	CVE-2025-61724	go://github.com/golang/go:1.24.2	[1.24.8], [1.25.2]
Medium	CVE-2025-61727	go://github.com/golang/go:1.24.2	[1.24.11], [1.25.5]
Medium	CVE-2025-61728	go://github.com/golang/go:1.24.2	[1.24.12], [1.25.6]
Medium	CVE-2025-61730	go://github.com/golang/go:1.24.2	[1.24.12], [1.25.6]
Medium	CVE-2026-27142	go://github.com/golang/go:1.24.2	[1.25.8], [1.26.1]
Medium	CVE-2026-32282	go://github.com/golang/go:1.24.2	[1.25.9], [1.26.2]
Medium	CVE-2026-32288	go://github.com/golang/go:1.24.2	[1.25.9], [1.26.2]
Medium	CVE-2026-32289	go://github.com/golang/go:1.24.2	[1.25.9], [1.26.2]
Medium	CVE-2023-45288	go://golang.org/x/net:0.22.0	[0.23.0]
Medium	CVE-2025-22870	go://golang.org/x/net:0.22.0	[0.36.0]
Medium	CVE-2025-22872	go://golang.org/x/net:0.22.0	[0.38.0]
Medium	CVE-2025-58190	go://golang.org/x/net:0.22.0	[0.45.0]
Low	CVE-2025-22873	go://github.com/golang/go:1.24.2	[1.23.9], [1.24.3]
Low	CVE-2026-27139	go://github.com/golang/go:1.24.2	[1.25.8], [1.26.1]

[tobert]

Thanks for the PR! Merged.

[n4zukker]

Thank you. Would you kindly include this in a release so that I can reference it in my Dockerfile.