DriftGuard found 2 critical/high CVEs in your dependencies

## DriftGuard Security Scan DriftGuard's scanner found **2 critical/high CVEs** (CVSS ≥ 7) in this repository's dependency graph, sourced from the [OSV Database](https://osv.dev) across **1** ecosystem(s). | Risk Score | Act Now | Plan to Fix | Noise | |:---:|:---:|:---:|:---:| | **4.3 / 10** | 2 | 2 | 0 | ### Scan details | Field | Value | |---|---| | Scanned at | `2026-04-07T17:52:45.788Z` | | Vulnerability source | [OSV Database](https://osv.dev) | | Ecosystems scanned | `Go` | | Targeted because | `pushed_30d`, `issues_enabled`, `has_open_issues`, `stars_25plus`, `original_repo` (signal score: **95/100**) | ### Top findings | CVEs | Package | Severity | Fix | |-----|---------|:--------:|-----| | [`GHSA-p77j-4mvh-x3m3`](https://osv.dev/vulnerability/GHSA-p77j-4mvh-x3m3), [`GO-2026-4762`](https://osv.dev/vulnerability/GO-2026-4762) | `google.golang.org/grpc@v1.72.2` | **CRITICAL** | `>= 1.79.3` | | [`GHSA-9h8m-3fm2-qjrq`](https://osv.dev/vulnerability/GHSA-9h8m-3fm2-qjrq), [`GO-2026-4394`](https://osv.dev/vulnerability/GO-2026-4394) | `go.opentelemetry.io/otel/sdk@v1.36.0` | **HIGH** | `>= 1.40.0` | [See all 4 findings →](https://driftguard-mcp.vercel.app/scan?v=4&a=2&p=2&n=0&r=4.3&utm_source=github&utm_medium=auto_issue&utm_campaign=scanner) ### Suggested fix Run these commands to upgrade the top critical/high vulnerabilities: ```bash go get google.golang.org/grpc@v1.79.3 go get go.opentelemetry.io/otel/sdk@v1.40.0 ``` Verify in a branch before merging. Upgrade paths may need manual review for breaking changes. ### About this report This is your first automated scan from DriftGuard. **The first vulnerability report and any remediation we generate from it are free** — no signup, no payment, no follow-up emails. If you'd like to apply the suggested fixes automatically, the open-source MCP server can do it for you: ```bash npx -y @claytivi/driftguard-mcp init ``` Then ask Claude, Cursor, or Windsurf: > *"Scan my dependencies with DriftGuard and apply the safe upgrades"* Teams that need continuous scanning, scan history, or compliance reports can [see our plans](https://driftguard-mcp.vercel.app?utm_source=github&utm_medium=auto_issue&utm_campaign=scanner). Otherwise, use this report as-is — that's why it's free. ### Opt out Prefer no automated follow-ups from DriftGuard? **Close this issue** or add a `driftguard:ignore` topic to the repo. The scanner uses a 90-day cooldown per repository to avoid duplicate reports. --- *Automated scan by [DriftGuard](https://driftguard-mcp.vercel.app?utm_source=github&utm_medium=auto_issue&utm_campaign=scanner) — AI-native dependency security for the MCP era.*