Description of the patch:
This update for containerized-data-importer fixes the following issues:
- Security: re-vendor Go dependencies to address CVEs tracked against
containerized-data-importer (backport of upstream PR #4110, post-v1.65.0).
Fixed by this update:
- google.golang.org/grpc 1.65.0 -> 1.79.3:
bsc#1260295 (CVE-2026-33186)
- golang.org/x/net 0.33.0 -> 0.48.0:
bsc#1238699 (CVE-2025-22870), bsc#1241838 (CVE-2025-22872),
bsc#1251495 (CVE-2025-47911), bsc#1251689 (CVE-2025-58190)
- golang.org/x/crypto 0.31.0 -> 0.46.0:
CVE-2025-22869, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181
(no separate CDI bug filed)
- go.opentelemetry.io/otel 1.28.0 -> 1.41.0:
CVE-2026-29181 (otel is pulled in transitively at 1.39.0 by the grpc
bump; pinned to 1.41.0 so the update does not introduce it)
- Record CVEs already fixed by the x/net release vendored in 1.64.0
(x/net 0.33.0), not previously noted in the changelog:
bsc#1236523 (CVE-2023-45288), bsc#1230323 (CVE-2023-39325)