chore: upgrade google.golang.org/grpc to v1.83.1 (CVE-2026-84304)

Merged
CL
2mo ago
+3-3

Related to SOU-2120

Summary

Upgrades google.golang.org/grpc from v1.83.0 to v1.83.1 to remediate CVE-2026-84304.

Current main already contains the overlapping OpenTelemetry and gRPC v1.83.0 dependency updates from #25. Rebasing this change onto that commit leaves the minimal resolution: the direct gRPC requirement and its matching checksums advance to v1.83.1, with no source changes or transitive dependency churn.

Verification

  • go mod verify
  • go mod why -m google.golang.org/grpc
  • go list -m google.golang.org/grpc → v1.83.1
  • Confirmed go mod graph contains no gRPC v1.82 references
  • go test ./... (including internal/e2e)
  • go build -o <temporary-output>/ ./cmd/...
  • Confirmed the built zoekt-sourcegraph-indexserver and zoekt-webserver binaries contain gRPC v1.83.1 and OpenTelemetry v1.45.0
  • go vet ./... reports only pre-existing source findings (unkeyed test literals and a lock-copy warning), unrelated to this dependency-only change