[PR] fix(deps): bump go-jose and OpenTelemetry to address security alerts [pulsar-client-go]

["merlimat (via GitHub)" <gi...@apache.org>]

merlimat opened a new pull request, #1516:
URL: https://github.com/apache/pulsar-client-go/pull/1516

   ### Motivation
   
   Several open Dependabot alerts affect Go module dependencies. This PR addresses the ones that have a published fix:
   
   | Alert | Severity | Dependency | Exposure |
   |---|---|---|---|
   | #47 | high | `github.com/go-jose/go-jose/v4` | **runtime** (`pulsar/auth` via AthenZ) |
   | #44 | high | `go.opentelemetry.io/otel/sdk` | test-only (testcontainers → docker) |
   | #49 | high | `go.opentelemetry.io/otel/sdk` | test-only |
   | #48 | medium | `.../otlptrace/otlptracehttp` | test-only |
   
   ### Modifications
   
   - Bump `github.com/go-jose/go-jose/v4` `4.0.5` → `4.1.4` (fixes the JWE decryption panic). This is the only runtime-impacting dependency here.
   - Bump the OpenTelemetry modules to `v1.43.0` (`otel`, `otel/sdk`, `otel/metric`, `otel/trace`, `otel/exporters/otlp/otlptrace/otlptracehttp`). These are only reachable from the test binary (`testcontainers-go` → `docker/docker`). The large transitive bumps they trigger (grpc, `golang.org/x/net`) stay on the test side; the runtime-facing transitive bumps are limited to minor/patch versions (`protobuf`, `golang.org/x/oauth2`, `golang.org/x/crypto`).
   - `go mod tidy` additionally drops the already-unused `github.com/99designs/keyring` dependency tree.
   
   The remaining `github.com/docker/docker` alerts (#45, #46, #50, #51, #52) are **not** addressed here: the latest published module (`v28.5.2+incompatible`) is still within their vulnerable ranges (the fixed `v29.3.1` is not published as a Go module), and they are test-only.
   
   ### Verifying this change
   
   - [x] Make sure that the change passes the CI checks.
   
   This change is a dependency upgrade without code changes; covered by the existing build and tests.
   
   ### Does this pull request potentially affect one of the following parts:
   
     - Dependencies (does it add or upgrade a dependency): **yes** (see above)
     - The public API: no
     - The schema: no
     - The default values of configurations: no
     - The wire protocol: no
   
   ### Documentation
   
     - Does this pull request introduce a new feature? no
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org