deps(dm): update vulnerable dependencies on release-8.5

[GMHDBJD]

What problem does this PR solve?

Issue Number: ref #12637

release-8.5 already includes Go 1.25.12 and the dependency updates from #12773 and #12776, but two actionable dependency findings remain in the current DM image scan:

• GO-2026-5158 is reachable from DM's OpenTelemetry baggage propagation path and is fixed in OpenTelemetry v1.44.0.
• GHSA-r277-6w6q-xmqw and GHSA-jpcw-4wr7-c3vq affect github.com/getkin/kin-openapi v0.131.0 and are fixed in v0.144.0.

What is changed and how it works?

• Update the coordinated OpenTelemetry modules from v1.43.0 to v1.44.0:
  • go.opentelemetry.io/otel
  • go.opentelemetry.io/otel/metric
  • go.opentelemetry.io/otel/sdk
  • go.opentelemetry.io/otel/sdk/metric
  • go.opentelemetry.io/otel/trace
• Update github.com/getkin/kin-openapi from v0.131.0 to v0.144.0 and accept only the transitive module changes required by that release.
• Regenerate checksums with the release-8.5 module graph.
• Preserve the release-specific TiDB/parser and TiKV/PD dependency pins.

This intentionally does not cherry-pick #12769 or #12772: all of their other relevant fixed-version floors are already present on release-8.5, and copying either module graph wholesale would create unrelated release-branch churn.

Check List

Tests

• Unit test
  • env -u HTTP_PROXY -u HTTPS_PROXY -u ALL_PROXY -u NO_PROXY make dm_unit_test (pass; full race/failpoint suite, including dm/worker)
  • go test ./dm/openapi ./engine/jobmaster/dm/openapi (pass)
• Manual test
  • go mod tidy -diff (clean)
  • go mod verify (pass)
  • make dm (pass)
  • make cdc engine sync-diff-inspector (pass)
  • go version -m on DM binaries: Go 1.25.12, kin-openapi v0.144.0, gRPC v1.82.1, and the coordinated OpenTelemetry modules at v1.44.0
  • govulncheck ./dm/...: GO-2026-5158 and the two kin-openapi advisories are no longer reported

The vulnerability scan still reports existing findings outside this focused update: a coordinated etcd upgrade, Avro advisories with no published fixed release, and a TiDB pseudo-version mapping false positive whose selected release-8.5 commit already contains the upstream fix. This PR does not claim that all govulncheck findings are cleared.

Questions

Will it cause performance regression or break compatibility?

No expected regression. These are fixed-version dependency updates; the directly affected OpenAPI packages, the full DM race/failpoint suite, and all shipped binaries build successfully.

Do you need to update user documentation, design documentation or monitoring documentation?

No.

Release note

Update OpenTelemetry and kin-openapi dependencies to address known vulnerabilities in DM.

[GMHDBJD]

/run-dm-integration-test

[GMHDBJD]

/run-dm-compatibility-test

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a72ba812-fb2b-4f6d-ad4c-00e59ce09a00

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release-8.5@b558e06). Learn more about missing BASE report.

Additional details and impacted files

Components	Coverage Δ
cdc	57.6469% <0.0000%> (?)
dm	49.5682% <0.0000%> (?)
engine	50.7675% <0.0000%> (?)

Flag	Coverage Δ
cdc	57.6469% <ø> (?)
unit	53.6668% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

@@               Coverage Diff                @@
##             release-8.5     #12784   +/-   ##
================================================
  Coverage               ?   53.6668%           
================================================
  Files                  ?       1007           
  Lines                  ?     138512           
  Branches               ?          0           
================================================
  Hits                   ?      74335           
  Misses                 ?      58636           
  Partials               ?       5541           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[GMHDBJD]

/run-dm-integration-test

[GMHDBJD]

/run-dm-compatibility-test

[GMHDBJD]

/retest

[ti-chi-bot]

@joechenrh: adding LGTM is restricted to approvers and reviewers in OWNERS files.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: D3Hunter, joechenrh, lidezhu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [D3Hunter,lidezhu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-08-04 06:25:51.607954107 +0000 UTC m=+2509337.644049163: ☑️ agreed by D3Hunter.
• 2026-08-04 06:45:54.085911391 +0000 UTC m=+2510540.122006447: ☑️ agreed by lidezhu.