Backport patch-safe CVE fixes for v0.24.4

[thomasmaas]

Cherry-pick of CVE security fixes for the v0.24.4 patch release.

Changes

• Upgrade Go toolchain directive from 1.26.4 to 1.26.7 (fixes Go stdlib CVEs: net/url, crypto/tls, html/template, net/http, encoding/asn1)
• Upgrade go.opentelemetry.io/otel and related packages from v1.43.0 to v1.46.0 (fixes CVE-2026-41178: DoS via oversized baggage headers)
• Update semconv from v1.40.0 to v1.43.0 to match SDK version

Jira

• CONNLINK-1552 (authorino OTel DoS)

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 89adc1f2-f2b1-482f-aad0-3cd0c2e694ed

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}