fix(deps): vuln minor upgrades — 9 packages (minor: 7 · patch: 2) [server/go.mod]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 9 packages upgraded (MINOR changes included)

Manifests changed:

• server/go.mod (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
google.golang.org/grpc	v1.83.0	v1.83.2	patch	Transitive	6 HIGH, 3 MEDIUM
golang.org/x/crypto	v0.55.0	v0.57.0	minor	Transitive	4 HIGH, 1 UNKNOWN
github.com/aws/aws-sdk-go-v2/service/s3	v1.96.1	v1.113.4	minor	Direct	3 MEDIUM
go.temporal.io/server	v1.27.4	v1.32.0	minor	Direct	3 MEDIUM, 3 LOW
github.com/klauspost/compress	v1.18.0	v1.20.1	minor	Transitive	1 UNKNOWN
go.opentelemetry.io/otel/exporters/otlp/otlptrace	v1.35.0	v1.46.0	minor	Transitive	2 LOW
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	v1.35.0	v1.46.0	minor	Transitive	2 LOW
go.opentelemetry.io/otel/sdk	v1.44.0	v1.46.0	minor	Transitive	2 LOW
filippo.io/edwards25519	v1.1.0	v1.1.1	patch	Transitive	3 LOW

---

Security Details

🚨 Critical & High Severity (10 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
golang.org/x/crypto	CVE-2026-56855	high	Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh	v0.55.0	-	-
golang.org/x/crypto	CVE-2026-78662	high	Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh	v0.55.0	-	-
golang.org/x/crypto	GO-2026-6354	high	Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh	v0.55.0	0.56.0	-
golang.org/x/crypto	GO-2026-6355	high	Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh	v0.55.0	0.56.0	-
google.golang.org/grpc	CVE-2026-84445	high	gRPC-Go: Denial of Service (DoS) via crash due to missing :authority and Host headers in the xDS servers	v1.83.0	-	-
google.golang.org/grpc	GO-2026-6443	high	Server panic via missing authority or Host headers in google.golang.org/grpc	v1.83.0	1.82.2	-
google.golang.org/grpc	CVE-2026-84304	high	gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation	v1.83.0	-	-
google.golang.org/grpc	GO-2026-6348	high	Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc	v1.83.0	1.83.1	-
google.golang.org/grpc	GHSA-vp52-pcj8-j9qc	HIGH	gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation	v1.83.0	1.83.1	-
google.golang.org/grpc	GHSA-2v4p-qf9q-27wj	HIGH	gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers	v1.83.0	1.82.2	-

ℹ️ Other Vulnerabilities (23)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
google.golang.org/grpc	CVE-2026-84303	medium	gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion	v1.83.0	-	-
google.golang.org/grpc	GO-2026-6441	medium	Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc	v1.83.0	1.83.1	-
github.com/aws/aws-sdk-go-v2/service/s3	CVE-2026-89090	MODERATE	Denial of service in the event stream header decoder in AWS SDK for Go v2	v1.96.1	-	-
github.com/aws/aws-sdk-go-v2/service/s3	GO-2026-5764	MODERATE	DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.96.1	1.97.3	-
github.com/aws/aws-sdk-go-v2/service/s3	GHSA-xmrv-pmrh-hhx2	MODERATE	Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder	v1.96.1	1.97.3	-
go.temporal.io/server	GHSA-q98v-9f9w-f49q	MODERATE	Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint	v1.27.4	1.28.4	-
go.temporal.io/server	GO-2026-5578	MODERATE	Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint in go.temporal.io/server	v1.27.4	1.28.4	-
go.temporal.io/server	CVE-2026-5724	MODERATE	Missing Authentication on Streaming gRPC Replication Endpoint	v1.27.4	-	-
google.golang.org/grpc	GHSA-qc2q-p7wx-3px3	MODERATE	gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion	v1.83.0	1.83.1	-
filippo.io/edwards25519	GHSA-fw7p-63qq-7hpr	LOW	filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity	v1.1.0	1.1.1	-
filippo.io/edwards25519	CVE-2026-26958	LOW	filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity	v1.1.0	-	-
filippo.io/edwards25519	GO-2026-4503	LOW	Invalid result or undefined behavior in filippo.io/edwards25519	v1.1.0	1.1.1	-
go.opentelemetry.io/otel/exporters/otlp/otlptrace	CVE-2026-81870	LOW	OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs	v1.35.0	-	-
go.opentelemetry.io/otel/exporters/otlp/otlptrace	GHSA-8wmf-6v46-5gfg	LOW	OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs	v1.35.0	1.45.0	-
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	CVE-2026-81870	LOW	OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs	v1.35.0	-	-
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	GHSA-8wmf-6v46-5gfg	LOW	OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs	v1.35.0	1.45.0	-
go.opentelemetry.io/otel/sdk	GHSA-8wmf-6v46-5gfg	LOW	OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs	v1.44.0	1.45.0	-
go.opentelemetry.io/otel/sdk	CVE-2026-81870	LOW	OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs	v1.44.0	-	-
go.temporal.io/server	GO-2026-5766	LOW	Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster in go.temporal.io/server	v1.27.4	1.29.5	-
go.temporal.io/server	CVE-2026-5199	LOW	Cross Namespace Access via Batch Operation	v1.27.4	-	-
go.temporal.io/server	GHSA-xpg8-3hhp-p7w8	LOW	Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster	v1.27.4	1.30.3	-
github.com/klauspost/compress	GO-2026-5841	unknown	OOB read in github.com/klauspost/compress/s2	v1.18.0	1.18.7	-
golang.org/x/crypto	GO-2026-5932	unknown	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues	v0.55.0	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with main — rebased onto 00e9f36.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}

[hferentschik]

Closing this PR. The Go version bump from 1.25.6 to 1.26.8 in server/go.mod and go.work is problematic.

We intentionally keep the codec module on the lowest Go version possible so that external users on older Go versions can import it without being forced to upgrade. The go.work should use the minimum Go version across all modules, not the maximum.

If go.temporal.io/server v1.31.3 requires Go 1.26.8, then only the server module should bump — the codec module and go.work should stay on go 1.25.6. A follow-up PR should be opened with that constraint in mind.