Bump go.opentelemetry.io/otel/sdk to v1.40.0 to resolve https://pkg.go.dev/vuln/GO-2026-4394

[ahrtr]

Bug report criteria

• This bug report is not security related, security issues should be disclosed privately via security@etcd.io.
• This is not a support request or question, support requests or questions should be raised in the etcd discussion forums.
• You have read the etcd bug reporting guidelines.
• Existing open issues along with etcd frequently asked questions have been checked and this is not a duplicate.

What happened?

We need to bump go.opentelemetry.io/otel/sdk to v1.40.0 for all supported releases to resolve GO-2026-4394

See https://pkg.go.dev/vuln/GO-2026-4394

What did you expect to happen?

.

How can we reproduce it (as minimally and precisely as possible)?

.

Anything else we need to know?

No response

Etcd version (please run commands below)

Details

$ etcd --version
# paste output here

$ etcdctl version
# paste output here

Etcd configuration (command line flags or environment variables)

Details

paste your configuration here

Etcd debug information (please run commands below, feel free to obfuscate the IP address or FQDN in the output)

Details

$ etcdctl member list -w table
# paste output here

$ etcdctl --endpoints=<member list> endpoint status -w table
# paste output here

Relevant log output

[ahrtr]

cc. @ArkaSaha30 @henrybear327

[henrybear327]

/assign @henrybear327

[henrybear327]

Release 3.4 branch doesn't seem to be using go.opentelemetry.io/otel/sdk

➜  etcd git:(release-3.4) ✗ grep -r "go.opentelemetry.io/otel/sdk" --include="go.mod" .      
➜  etcd git:(release-3.4) ✗