Need go 1.25.9+ and go.opentelemetry.io 1.43.0+ to address high-sev CVEs

[darrentma]

When possible, please update to "go 1.25.9" or higher and "go.opentelemetry.io 1.43.0" of higher. Thanks!

There are several high-sev CVEs that would be addressed with these version bumps:

• CVE-2026-32281
• CVE-2026-39883
• CVE-2026-27142
• CVE-2026-32289
• CVE-2026-25679
• CVE-2026-32280
• CVE-2026-32282
• CVE-2026-32283
• CVE-2026-32288

[DavidGobran]

We are also getting CVE-2026-32281 and CVE-2026-39883 and require go 1.25.9+ and go.opentelemetry.io 1.43.0. Thanks in advance!

[darrentma]

@acornett21 For planning purposes, can you give a rough ETA on when update go 1.25.9+ (or 1.26.2+) and go.opentelemetry.io 1.43.0+ might be available? Thanks!

[Preethi-Ps]

We are also getting CVE-2026-29181 and require the corresponding fix. Thanks in advance!

[ravipareek1976]

Gentle Reminder !! For Fix CVE-2026-32281

[ravipareek1976]

Gentle Reminder ! Fix FOr CVE-2026-39883

@DavidGobran FYI

[darrentma]

Still waiting for PR #213 to be merged.

[darrentma]

Looks like a new PR was created for the go update: #228

Still waiting for a new release to be created: https://github.com/operator-framework/ansible-operator-plugins/releases

[ravipareek1976]

Gentle Reminder !! waitng for this fix plz CVE-2026-29181

[ravipareek1976]

waiting for CVE-2026-39883 , any plan to fix this in near future please

[acornett21]

All CVEs raised in this issue (and in the comments) have been addressed on main:

Go stdlib CVEs — fixed by PR #228 (Go 1.25.7 → 1.26.3):

• CVE-2026-32281
• CVE-2026-39883
• CVE-2026-27142
• CVE-2026-32289
• CVE-2026-25679
• CVE-2026-32280
• CVE-2026-32282
• CVE-2026-32283
• CVE-2026-32288

OpenTelemetry CVE — fixed by PR #216 (go.opentelemetry.io/otel 1.40.0 → 1.43.0):

• CVE-2026-29181

These fixes will be included in the next release.

[acornett21]

Closing — all CVEs addressed on main.