fix(deps): remediate PROD-5214 dependency alerts

[plural-copilot]

Summary

Fixes PROD-5214

Dependency-only remediation for Go module manifests/sums, the JS Yarn lock/workspace manifests, Python requirements, and Mix lock. No Dockerfiles, GitOps, or deployment image tags were changed.

Alert families and versions addressed

• Go OpenTelemetry — go/kubernetes-agent/kas, go/datastore, and go/controller now coherently resolve go.opentelemetry.io/otel, SDK/core/metric/trace, and applicable OTLP trace exporters at v1.45.0.
• Go containerd — go/helm-test, go/tools, and go/deployment-operator resolve github.com/containerd/containerd at v1.7.35. The deployment-operator replacement was updated from v1.7.33 to v1.7.35, preserving the other valid replacements.
• Go crypto — golang.org/x/crypto is v0.56.0 in go/ai-proxy, go/client, go/cloud-query, go/deployment-operator, go/deployment-operator/terratest, go/helm-test, go/polly, go/tools, and datastore after graph assessment.
• JavaScript Vitest/mocker — design-system vitest/@vitest/ui are 5.0.1 and the lock has only @vitest/mocker 5.0.1. The old Storybook path was removed by updating the coherent Storybook family and eslint plugin to 10.6.0, rather than forcing an unsafe mocker resolution.
• JavaScript decode-uri-component — Yarn's supported resolution updates the old query-string@5.1.1 descriptor to 0.5.0.
• JavaScript Mermaid — documentation now pins 11.16.1; design-system's compatible 11.16.1 remains unchanged.
• Python — utils/compatibility/requirements.txt pins soupsieve==2.9.0.
• Elixir — Mix resolves gun 2.4.1 and cowlib 2.20.0. Cowlib must remain 2.x: gun requires >= 2.15.0 and < 3.0.0, grpc_server uses ~> 2.14, and Cowboy requires >= 2.19.0 and < 3.0.0; 2.20.0 is the safe resolver intersection, so no invented 3.x dependency was added.

Validation

• go mod verify passed for all 11 impacted Go modules.
• Go module updates used Go 1.27 go get and go mod tidy.
• node .yarn/releases/yarn-4.17.1.cjs install --immutable passed (existing peer-dependency warnings remain).
• node .yarn/releases/yarn-4.17.1.cjs workspace @pluralsh/design-system test passed: 4 files, 18 tests.
• yarn why @vitest/mocker confirmed only 5.0.1; yarn why decode-uri-component confirmed only 0.5.0.
• python -m pip install -r requirements.txt && python -c 'import soupsieve; print(soupsieve.__version__)' passed and reported 2.9.
• mix deps.update gun cowlib completed and selected cowlib 2.20.0.
• Limitation: a focused Mix compile was stopped after nine minutes while compiling the large unrelated dependency tree (warnings only before stop); no completed Mix compile is claimed. Helm-test builds exceeded practical two-minute bounds and were stopped without test results.

Changed files

• go/ai-proxy/go.mod, go/ai-proxy/go.sum
• go/client/go.mod, go/client/go.sum
• go/cloud-query/go.mod, go/cloud-query/go.sum
• go/controller/go.mod, go/controller/go.sum
• go/datastore/go.mod, go/datastore/go.sum
• go/deployment-operator/go.mod, go/deployment-operator/go.sum
• go/deployment-operator/terratest/go.mod, go/deployment-operator/terratest/go.sum
• go/helm-test/go.mod, go/helm-test/go.sum
• go/kubernetes-agent/kas/go.mod, go/kubernetes-agent/kas/go.sum
• go/polly/go.mod, go/polly/go.sum
• go/tools/go.mod, go/tools/go.sum
• js/design-system/package.json
• js/documentation/package.json
• js/yarn.lock
• mix.lock
• utils/compatibility/requirements.txt

GitHub alert closure is not claimed: it requires merge and a post-merge rescan.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create ONE dependency remediation PR from current master for PROD-5214. Do not inspect, fetch, compare, review, or reuse closed-unmerged PRs #4329/#4330 or their diffs. Scope ONLY dependency manifests/locks; do not alter Dockerfiles/GitOps/deployment image tags....
🔗 Run history	View run history

[linear]

PROD-5214

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​storybook/​react-vite@​9.1.20 ⏵ 10.6.0			+1
	npm/​storybook@​9.1.20 ⏵ 10.6.0
	golang/​go.opentelemetry.io/​otel/​exporters/​otlp/​otlptrace/​otlptracehttp@​v1.43.0 ⏵ v1.45.0		+1
	npm/​eslint-plugin-storybook@​9.1.20 ⏵ 10.6.0	+1		+1
	pypi/​soupsieve@​2.8.4 ⏵ 2.9		+3
	npm/​@​storybook/​addon-docs@​9.1.20 ⏵ 10.6.0			+2
	npm/​@​storybook/​builder-vite@​9.1.20 ⏵ 10.6.0	+4		+1
	npm/​@​storybook/​addon-links@​9.1.20 ⏵ 10.6.0			+1

View full report

[soffi-ai]

Soffi AI Summary

This PR is a pure dependency remediation targeting PROD-5214 security alerts. No application logic, Dockerfiles, or deployment image tags were changed — only package manifests and lock files across all five language ecosystems in the monorepo.

Go modules: OpenTelemetry libraries are unified at v1.45.0 across kubernetes-agent/kas, datastore, and controller; containerd is bumped to v1.7.35 in helm-test, tools, and deployment-operator; golang.org/x/crypto is raised to v0.56.0 in all nine affected modules.

JavaScript: Vitest and @vitest/ui are pinned to 5.0.1 in the design-system; Storybook and its ESLint plugin are updated to 10.6.0 to eliminate the conflicting @vitest/mocker resolution; decode-uri-component is forced to 0.5.0 via a Yarn resolution override (replacing the vulnerable query-string@5.1.1 path); Mermaid is pinned to 11.16.1 in the documentation package.

Python: soupsieve is pinned to 2.9.0 in utils/compatibility/requirements.txt.

Elixir: gun is updated to 2.4.1 and cowlib to 2.20.0 in mix.lock, staying within the v2.x constraint required by gun, grpc_server, and Cowboy.

Changes

Security dependency remediation (PROD-5214)

• Bumps vulnerable transitive and direct dependencies across all language ecosystems to close PROD-5214 security alerts: Go OpenTelemetry to v1.45.0, containerd to v1.7.35, golang.org/x/crypto to v0.56.0; JS Vitest to 5.0.1, Storybook to 10.6.0, decode-uri-component to 0.5.0, Mermaid to 11.16.1; Python soupsieve to 2.9.0; Elixir gun to 2.4.1 and cowlib to 2.20.0. No application code or deployment images were modified. (db3d1af)

---

Updated: 2026-09-20 00:50 UTC

Deploy in Soffi

[greptile-apps]

Confidence Score: 5/5

The dependency remediation appears safe to merge, with no concrete correctness, security, or repository-rule violations identified.

Summary

This PR remediates dependency alerts across Go, JavaScript, Python, and Elixir manifests and lockfiles.

• Aligns selected Go OpenTelemetry modules at v1.45.0 and updates containerd and x/crypto.
• Upgrades the design-system Storybook and Vitest families while refreshing the Yarn lockfile.
• Pins updated Mermaid and soupsieve releases and refreshes gun/cowlib lock entries.
• Preserves existing application code, deployment images, and infrastructure configuration.

_{Reviews (1) · Last reviewed commit: "fix(deps): remediate PROD-5214 vulnerabl..."}

[github-actions]

Storybook preview: https://6a8c1fbd32d6c1cc8fc131a5-hqtefboxmj.chromatic.com/