diff --git a/opentelemetry-collector.yaml b/opentelemetry-collector.yaml
index 9a37ef31fc1..4df9c2c3455 100644
--- a/opentelemetry-collector.yaml
+++ b/opentelemetry-collector.yaml
@@ -1,7 +1,7 @@
 package:
   name: opentelemetry-collector
   version: "0.142.0"
-  epoch: 0 # CVE-2025-61729
+  epoch: 1 # GHSA-cfpf-hrx2-8rv6
   description: OpenTelemetry Collector
   copyright:
     - license: Apache-2.0
@@ -29,6 +29,10 @@ pipeline:
       tag: v${{package.version}}
       expected-commit: b579eb1cd7f4334b0f460eb05a81373e5635942f
 
+  - uses: go/bump
+    with:
+      deps: github.com/expr-lang/expr@v1.17.7
+
   - uses: go/build
     with:
       packages: .