Addressing security vulnerabilities in the Cadence release v1.4.1

Description

The latest Cadence server image ubercadence/server:v1.4.1 ships several dependencies with known CVEs. Requesting these be upgraded and a new release cut.

• CVE-2026-33814 (golang.org/x/net/http2): HTTP/2 transport enters an infinite loop writing CONTINUATION frames on a SETTINGS_MAX_FRAME_SIZE of 0. Fixed in x/net v0.53.0.
• CVE-2025-65637 (github.com/sirupsen/logrus): DoS via logrus.Writer() when logging a >64KB line without newlines. Fixed in logrus v1.9.1.
• CVE-2026-29181 (go.opentelemetry.io/otel): resource-exhaustion DoS via baggage header extraction. Fixed in otel v1.41.0.

Steps to Reproduce / How to Trigger

The CVEs below were detected by scanning the released image with Snyk:

docker pull ubercadence/server:v1.4.1
snyk container test ubercadence/server:v1.4.1

(any container vulnerability scanner will surface the same findings.)

Actual Behavior

ubercadence/server:v1.4.1 still bundles golang.org/x/net/http2 v0.48.0 and github.com/sirupsen/logrus v1.9.0, so the CVEs above are flagged by Snyk.

Logs / Screenshots

Environment

• Cadence server version: v1.4.1 (image ubercadence/server:v1.4.1)
• Cadence SDK language and version (if applicable): N/A — issue is in the server image dependencies
• Cadence web version (if applicable): N/A
• DB & version: N/A — dependency/build issue, not runtime/DB specific
• Scale: N/A