## Overview

Consolidates the 6 open Dependabot/ADMS vulnerability PRs into a single
PR.

| Source PR | Manifest | Notes |
|---|---|---|
| #1258 | `integration-tests/lambda/otlp-java/pom.xml` |
`io.opentelemetry:opentelemetry-api` 1.58.0 → 1.63.0 |
| #1259 | `local_tests/golang/go.{mod,sum}` | `aws-sdk-go`,
`golang.org/x/net`, `golang.org/x/sys` minor bumps |
| #1260 | `integration-tests/lambda/otlp-node/package*.json` |
Superseded by #1263 (lock already has `@grpc/[email protected]`,
`@protobufjs/utf8` override carried over) |
| #1261 | `integration-tests/package*.json` | `uuid` 9 → 14 (ported
manually onto #1262 to avoid lock conflict) |
| #1262 | `integration-tests/package*.json` | `axios` 1.15 → 1.18, plus
overrides for `@opentelemetry/core`, `fast-xml-parser`,
`fast-xml-builder`, `fast-uri`, `brace-expansion` |
| #1263 | `integration-tests/lambda/otlp-node/package*.json` | Major
OTel SDK bump (`@opentelemetry/sdk-node` 0.54 → 0.219, `protobufjs`
7.5.4 → 7.6.4) |

Closes the following Dependabot alerts: #191, #192 (`@grpc/grpc-js`);
#183–#190 + older axios alerts; protobufjs alerts via the major OTel SDK
bump; uuid #180; OpenTelemetry Java #176.

## Testing

GitHub Actions checks (Build All, Test Suite, Clippy, Audit, CodeQL)
passed on each individual source PR. `dd-gitlab/*` checks failed
identically on all 6 — appears to be an unrelated infra/permissions
issue with the bot-authored branches. Re-running CI on this branch
(created from a maintainer account) should clear them.

The vendored deps live entirely under `integration-tests/` and
`local_tests/`, so they have no impact on the shipped extension binary.

---------

Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>