[Amperstrand]

What

Clears the 4 dependabot alerts that surfaced on main after #681's sweep:

• scripts/token-recovery: google.golang.org/grpc → v1.83.1 — clears GHSA-2v4p-qf9q-27wj (high), GHSA-vp52-pcj8-j9qc (high), GHSA-qc2q-p7wx-3px3 (medium). Standalone module; go build ./... + go vet ./... green.
• src (root module): the OpenTelemetry graph now resolves otlptrace to v1.47.0 — clears GHSA-8wmf-6v46-5gfg (low). The fix releases the stale explicit pin in src/go.mod (go.sum already carried 1.47.0); go build ./... + go vet ./... green.

Verification

make go-battery on this branch: merchant red with two PRE-EXISTING failures, reproduced identically on clean origin/main (cb4db7f) with zero involvement from this diff (the merchant module's go.mod is untouched): (1) TestLateReceiveOutcomeIsRecordedWhenReceiveCompletesAfterTheDeadline — the known racy assertion, fix pending in #718; (2) TestPurchaseSessionGuardHoldsThroughTheOutcomeUnknownWindow — newly discovered, deterministic in isolation on clean main, reported on #665 (last merchant-touching commits #681/#700/#619 — same #681-timing suspicion class). Every other module green.

Changelog

Entry under [Unreleased] → Changed / Internal.

[Amperstrand]

Review (PR-REVIEW.md pass) — disposition: land (fragment conversion pending).

Small and deliberately shaped: grpc → v1.83.1 in the standalone scripts/token-recovery module (clears three GHSA advisories), and the root module's otel graph resolved to v1.47.0 by releasing a stale go.mod pin rather than adding one — go.sum already carried 1.47.0, which is the minimal-diff form of this fix. Build+vet green in both modules; full battery documented with the two pre-existing merchant reds reproduced on clean main (both now root-caused on #665 — one fixed by #718, one awaiting its own look).

One author-side fix: convert the direct CHANGELOG.md edit to changelog.d/727-deps-post-sweep.fixed.md per the fragment convention. Note for the ledger: the push-time "4 vulnerabilities" banner GitHub prints is this PR's own subject — once merged the banner clears, which will also stop confusing every future push's output.

[felixfelix-bot]

Cross-family review — 8582555f904ba8db1686a26c4bda7a8f33b2ee23

What it does. Clears the four post-sweep dependabot alerts. scripts/token-recovery bumps google.golang.org/grpc v1.82.1 → v1.83.1 (GHSA-2v4p-qf9q-27wj, GHSA-vp52-pcj8-j9qc high; GHSA-qc2q-p7wx-3px3 medium) with the matching x/mod/x/sync/x/tools/otelhttp transitive bumps, and src/go.mod is tidied so the OpenTelemetry graph resolves the patched line — dropping the stale pins (go-logr/logr, otel/log → otel/auto/sdk). A changelog.d/727-...internal.md fragment is included (head commit moves the entry out of CHANGELOG.md per the fragment convention).

Verification (independent). Nothing in src imports go.opentelemetry.io/otel/log or go-logr/logr, so the tidy is safe. scripts/token-recovery go build ./... succeeds; src go mod verify reports "all modules verified" and go build ./... succeeds. The bumped versions resolve (downloads clean).

Findings (non-blocking).

• The changelog describes only the grpc/otlptrace bumps but src/go.mod also drops go-logr/logr and swaps otel/log for otel/auto/sdk. Either mention the tidy or drop the detail — a deps changelog that names a subset of the module graph is mildly misleading.
• Base freshness: the branch is 13 commits behind main; go.mod/go.sum PRs are the most conflict-prone to rebase, so re-tidy + rebase against current main before landing (and re-run go mod verify).
• No tests accompany a pure version bump — expected, and CI's dependency-graph job is the backstop.

Disposition: land (after a rebase + re-tidy). Security-alert clearance with a verified build and a credible changelog; the only asks are the freshness rebase and the changelog wording.

[c03rad0r]

🏷️ Next action — approved

Approved; rebase + go mod tidy against current main, then merge.

[Amperstrand]

Pre-review with evidence — dependabot alert clears (grpc v1.83.1 in token-recovery, otel otlptrace v1.47.0 in src). MERGEABLE against current main, both touched modules build clean on the PR tree, changelog fragment present, no API changes (pure version bumps clearing CVE alerts). Note: touchpoint overlaps the #791 fence domain (token-recovery go.mod) — the pin fence still passes because the gonuts pin is untouched. One-click approval candidate.

[Amperstrand]

Closing in favor of #885 — identical file set (token-recovery + src go.mod/go.sum + fragment), #885 is the broader evolved sweep (grpc ×3 advisories + otel lockstep, dependabot #89x series). Nominated to the 0.6.0 quick-win set in #909.