fix multiple cves in oadp-1.3

[weshayutin]

Update go.opentelemetry.io/otel/sdk v1.17.0 -> v1.43.0:

GHSA-hfvc-g4fc-pqhx: Arbitrary code execution via PATH hijacking on BSD/Solaris
Update golang.org/x/crypto v0.35.0 -> v0.53.0:

GHSA-56w8-48fp-6mgv: SSH client panic due to unexpected SSH_AGENT_SUCCESS
GHSA-qpw4-5x99-6vjp: Resource exhaustion via repeated channel opens
GHSA-45gg-vh54-h5m9: Unauthorized command execution via discarded SSH permissions
GHSA-w879-237q-wc7r: DoS via crafted public key with excessive parameters
GHSA-vgwf-h737-ff37: DoS via resource leak from unsolicited SSH responses
GHSA-f5wc-c3c7-36mc: Security bypass due to improper handling of key restrictions
GHSA-78mq-xcr3-xm33: DoS via crafted SSH certificate
GHSA-5cgq-3rg8-m6cv: Revocation bypass via unchecked SignatureKey
GHSA-x527-x647-q7gg: Authorization bypass due to skipped source-address validation
GHSA-q4h4-gmj2-qvw2: Server-side panic due to incorrect cast from bytes to int
Update golang.org/x/net v0.36.0 -> v0.56.0:

GHSA-w9p8-pvxh-rxpj: Arbitrary code execution via Cross-Site Scripting in html pkg
GHSA-m9x8-m34x-fj9q: XSS via Render of arbitrary HTML
CVE-2026-33814: DoS via malformed SETTINGS_MAX_FRAME_SIZE frame (HTTP/2)
GHSA-w2q5-6q6x-x959: Privilege escalation via incorrect Punycode label processing
GHSA-wrh2-89vg-4j9g: XSS via Render of arbitrary HTML
Update google.golang.org/grpc v1.57.0 -> v1.81.1:

GHSA-p77j-4mvh-x3m3 (CRITICAL): Authorization bypass due to improper HTTP/2 path validation
GHSA-m425-mq94-257g: gRPC-Go HTTP/2 Rapid Reset vulnerability

Otel CVE:
Open this link in a new tab
CVE-2026-41178

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f9ec56b6-e5bd-4a18-b9ed-75a29a6578c5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch oadp1310cve1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[oadp-snyk]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[weshayutin]

/test Check PR Title / Check PR Title (pull_request)

[openshift-ci]

@weshayutin: No presubmit jobs available for migtools/kopia@oadp-1.3

Details

In response to this:

/test Check PR Title / Check PR Title (pull_request)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Joeavaikath, sseago, weshayutin

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment