chore: upgrade google.golang.org/grpc to v1.83.2 for CVE-2026-84445

Merged
CL
2mo ago
+16-16

Summary

Upgrades google.golang.org/grpc from v1.83.1 to v1.83.2 to remediate CVE-2026-84445 (HIGH).

gRPC-Go servers created with xds.NewGRPCServer() install an xDS routing interceptor on every RPC. The HTTP/2 server transport previously accepted requests carrying neither :authority nor Host, and the interceptor then indexed into an empty slice of authorities, panicking and terminating the server process (DoS). The fix in v1.83.2 rejects such requests at the transport layer.

Changes

  • google.golang.org/grpc v1.83.1 → v1.83.2 (patched floor from the advisory)
  • Minimum module requirements pulled forward by grpc v1.83.2, via go mod tidy:
    • golang.org/x/net v0.57.0 → v0.58.0
    • golang.org/x/crypto v0.54.0 → v0.55.0 (indirect)
    • golang.org/x/text v0.40.0 → v0.41.0 (indirect)

No source changes were needed.

Verification

  • go list -m google.golang.org/grpc resolves to v1.83.2, so no affected version remains in the module graph.
  • go build ./... — clean.
  • go test ./... -short — passes except for the pre-existing internal/e2e scoring failures (TestBM25, TestJava, TestKotlin, TestCpp, TestPython, TestRuby, TestScala, TestGo, TestRepoRanks). These fail identically on the base commit f066712 in this environment (symbol scoring depends on ctags) and are unrelated to this upgrade.
  • go vet ./... — only pre-existing findings in untouched first-party code (cmd/zoekt-sourcegraph-indexserver/main.go, index/*_test.go).

Fixes SOU-2198

🤖 Generated with Claude Code

[!NOTE]
Low Risk
Patch-level dependency upgrade with no source changes; low risk aside from normal grpc/x/net transitive behavior changes.

Overview
Bumps google.golang.org/grpc from v1.83.1 to v1.83.2 to address CVE-2026-84445 (server DoS when xDS-enabled gRPC accepts HTTP/2 requests without :authority or Host). There are no first-party code changes—only go.mod / go.sum.

go mod tidy also raises minimum versions pulled in by the new grpc release: golang.org/x/net v0.58.0, and indirect golang.org/x/crypto v0.55.0 and golang.org/x/text v0.41.0.

Reviewed by Cursor Bugbot for commit f5691f3be5bbd4957df3e01fc94e16d815f40aed. Bugbot is set up for automated code reviews on this repo. Configure here.