chore(deps): bump modules with known advisories

[dogancanbakir]

Closes #7631

govulncheck ./... on dev reported 23 vulnerabilities from 3 modules plus the standard library. These four bumps clear every actionable one:

Module	From	To	Reachability
golang.org/x/text	v0.38.0	v0.39.0	called (GO-2026-5970)
github.com/yuin/goldmark	v1.7.13	v1.7.17	called (GO-2026-5320)
github.com/klauspost/compress	v1.18.5	v1.18.7	imported (GO-2026-5841)
go.opentelemetry.io/otel	v1.43.0	v1.44.0	imported (GO-2026-5158)

golang.org/x/mod and golang.org/x/tools come along as requirements of those versions. After the bump govulncheck reports 1 module instead of 3, and 5 import-only findings instead of 7.

What is left is not fixable by a bump:

• GO-2026-5932, golang.org/x/crypto/openpgp is unmaintained with no fixed version, reached only through go-github's package init from pkg/reporting/trackers/github.
• Standard library findings come from the toolchain that builds the module, and CI already uses go-version: stable, so no go directive change is needed.

go build ./..., go vet ./..., the unit suite and the full integration suite are green.

Summary by CodeRabbit

• Chores
  • Updated underlying library dependencies to newer versions.
  • Improved compatibility, performance, and maintenance through routine dependency updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 673b2401-cf2c-45b3-96b9-a2987f5e0993

📥 Commits

Reviewing files that changed from the base of the PR and between ba05210 and 938b19d.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

---

Walkthrough

This PR updates four module dependencies in go.mod: golang.org/x/text, github.com/klauspost/compress, github.com/yuin/goldmark, and OpenTelemetry core/metric/trace packages. It also bumps indirect dependencies golang.org/x/mod and golang.org/x/tools. No code or exported entity changes occur.

Changes

Dependency Updates

Layer / File(s)	Summary
Version bumps for vulnerability fixes go.mod	golang.org/x/text moves from v0.38.0 to v0.39.0. github.com/yuin/goldmark moves from v1.7.13 to v1.7.17. OpenTelemetry core, metric, and trace packages move from v1.43.0 to v1.44.0. github.com/klauspost/compress moves from v1.18.5 to v1.18.7. golang.org/x/mod moves from v0.36.0 to v0.37.0. golang.org/x/tools moves from v0.45.0 to v0.47.0.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: dwisiswant0, mzack9999

Poem

A hop, a skip, a version bump,
No code to break, no need to jump.
govulncheck now sleeps at ease,
Four modules fixed with gentle squeeze.
🐇✨ Carrots for the CI trees!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies a dependency update that addresses known advisories.
Linked Issues check	✅ Passed	The changes update all four required modules and align with the issue scope for reducing actionable advisories.
Out of Scope Changes check	✅ Passed	The reviewed change is limited to Go module version updates and matches the linked issue objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/bump-kin-openapi

---

_{Comment @coderabbitai help to get the list of available commands.}