Security dependency bumps for v2.4.3 (go-jose/v4, otel/sdk). Closes #4974, #4976

[kaidaguerre]

Summary

Security-driven dependency bumps for the v2.4.3 release line, plus the v2.4.3 CHANGELOG entry.

Applied (verified present in the module graph via go mod why):

Package	From	To	CVE(s)
github.com/go-jose/go-jose/v4	v4.1.3	v4.1.4	CVE-2026-34986
go.opentelemetry.io/otel/sdk (+ otel, metric, sdk/metric, trace)	v1.40.0	v1.43.0	CVE-2026-24051, CVE-2026-39883

golang.org/x/sys moved v0.40.0 -> v0.42.0 as a transitive consequence of the otel v1.43.0 bump (pulled in by go mod tidy).

The CHANGELOG v2.4.3 entry also records the already-merged jackc/pgx/v5 v5.7.6 -> v5.9.2 bump (CVE-2026-41889, #4990) since it landed on this release line without its own CHANGELOG entry.

go mod why triage evidence

github.com/go-jose/go-jose/v4 — present (SPIFFE chain):

github.com/turbot/steampipe/v2/cmd
github.com/turbot/steampipe-plugin-sdk/v5/plugin
github.com/turbot/steampipe-plugin-sdk/v5/getter
github.com/hashicorp/go-getter
cloud.google.com/go/storage
google.golang.org/grpc/xds/googledirectpath
google.golang.org/grpc/internal/xds/bootstrap
google.golang.org/grpc/credentials/tls/certprovider
github.com/spiffe/go-spiffe/v2/bundle/spiffebundle
github.com/go-jose/go-jose/v4

go.opentelemetry.io/otel/sdk — present (telemetry chain):

github.com/turbot/steampipe/v2/pkg/initialisation
github.com/turbot/steampipe-plugin-sdk/v5/telemetry
go.opentelemetry.io/otel/sdk/resource
go.opentelemetry.io/otel/sdk

Nothing skipped — both target packages are in the graph.

Verification

• GOTOOLCHAIN=auto go build ./... — clean (exit 0)
• GOTOOLCHAIN=auto go test ./... — 21 packages pass (ok), 0 fail, 21 with no test files

Notes

• No standalone Phase A CHANGELOG-only PR exists for steampipe (Phase A prep was deferred), so there is none to supersede.
• Related open dependabot PRs [dep][go](deps): Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 #4974 (go-jose/v4) and [dep][go](deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 #4976 (otel/sdk) are superseded by this consolidated PR.
• Targets v2.4.x. No tag/release/merge performed by this change.