chore(gomod): Update module google.golang.org/grpc to v1.83.2

[anomalorenovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
google.golang.org/grpc	v1.83.1 → v1.83.2

---

Release Notes

grpc/grpc-go (google.golang.org/grpc)

v1.83.2: Release 1.83.2

Compare Source

Security

• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#​9365)
  • Special Thanks: @​winklemad

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[anomalo-atlantis]

Error: This repo is not allowlisted for Atlantis.

[greptile-apps]

Greptile Summary

This PR upgrades google.golang.org/grpc from v1.83.1 to v1.83.2, incorporating the patch release's stricter server-side request validation.

• Updates the gRPC requirement in go.mod.
• Adds the corresponding v1.83.2 checksums to go.sum.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete compatibility, runtime, or security regression identified.

The upgraded release changes gRPC server handling for malformed requests, while this repository uses gRPC only as a client, and the dependency metadata is consistent with the version bump.

_{Reviews (1): Last reviewed commit: "chore(gomod): Update module google.golan..." | Re-trigger Greptile}

[anomalogravity]

Dependency Review: google.golang.org/grpc v1.83.1 → v1.83.2

Change type: patch
Risk assessment: Safe to merge

Usage in codebase

grpc is used in exactly one file, and only on the client side:

• trigger/pubsub/pubsub.go:44-45 — grpc.WithDialer returned as a grpc.DialOption, passed to the Google Cloud Pub/Sub client via option.WithGRPCDialOption
• trigger/pubsub/pubsub.go:90,108 — grpc/codes + grpc/status used to classify errors (status.Code(err) != codes.NotFound)
• No grpc.NewServer or gRPC server registrations anywhere in the repo; no pinned version constraints on grpc.

Changelog summary

v1.83.2 is a single-entry security patch release (grpc/grpc-go#9365, released 2026-08-25):

• Security: server now rejects HTTP/2 requests missing both :authority and Host headers with HTTP 400. This fixes grpc/grpc-go#9354 — an index-out-of-range crash in the xDS server routing interceptor when :authority is omitted (a server DoS vector). No new features, bug fixes, or API changes. Cherry-picked to the 1.82.x/1.83.x/1.84.x maintenance branches; no CVE number assigned.

Breaking changes

None affecting keel. The change is strictly in the HTTP/2 server transport (internal/transport/http2_server.go + xDS routing check); keel runs no gRPC server, and gRPC clients always send :authority in normal operation. Even for server users, only malformed requests that previously crashed the process are rejected.

Test results

⚠️ go build ./... and go test ./... could not be run in this review environment — no Go toolchain is installed (no go binary, no docker/nix fallback). Compile risk is minimal for this change: the PR touches only the grpc version string in go.mod and two go.sum hash lines, and the Renovate compatibility check for v1.83.1 → v1.83.2 is reported as passing. Recommend CI on the PR for final confirmation.

Recommendation

Safe to merge. Patch bump with a single server-side security hardening change; keel's only usage is client-side (Pub/Sub dialer + error codes), none of which is touched by this release.