chore(go.mod): reduce blast radius in go.mod from #2817 (#2979)

[darccio]

What does this PR do?

Reduces blast radius of dependencies introduced by #2817.

Motivation

Avoid future difficulties and friction while dogfooding upcoming release v1.70.0.

Reviewer's Checklist

• Changed code has unit tests for its functionality at or near 100% coverage.
• System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
• There is a benchmark for any new code, or changes to existing code.
• If this interacts with the agent in a new way, a system test has been added.
• Add an appropriate team label so this PR gets put in the right place for the release notes.
• Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.

Unsure? Have a question? Request a review!

[datadog-datadog-prod-us1]

🟡 Library Vulnerability

google.golang.org/grpc → 1.64.0

Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go (...read more)

Impact

This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.

Patches

The issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0

Workarounds

If using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.

    

[pr-commenter]

Benchmarks

Benchmark execution time: 2024-11-28 11:38:03

Comparing candidate commit e092e6e in PR branch dario.castane/cherrypick-gomod-2979 with baseline commit 63e7470 in branch main.

Found 1 performance improvements and 0 performance regressions! Performance is the same for 58 metrics, 0 unstable metrics.

scenario:BenchmarkHttpServeTrace-24

• 🟩 execution_time [-613.133ns; -532.467ns] or [-3.738%; -3.246%]