build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2

[dependabot]

Bumps google.golang.org/grpc from 1.83.1 to 1.83.2.

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.2

Security

• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)
  • Special Thanks: @​winklemad

Commits

• 030ee8b Update version to 1.83.2 (#9375)
• 8668b69 cherry-pick #9365 to v1.83.x (#9366)
• a3e952d cherry-pick #9346 to v1.83.x and update x/net dependency (#9369)
• 58f8fd9 Change version to 1.83.2-dev (#9337)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[claude]

Claude finished @dependabot[bot]'s task in 1m 40s —— View job

---

Dependency review: grpc 1.83.1 → 1.83.2

• Identify all changed dependencies
• Review release notes / semver impact
• Search repo for usage of upgraded deps
• Verify build, vet, and unit tests — could not run locally (see Not verified)
• Post findings

Verdict: safe to merge. Patch-level security release with no API surface changes, and nothing in this repo imports the upgraded modules directly.

---

What actually changed

The PR title says grpc, but MVS pulled up a batch of golang.org/x/* modules too — all // indirect:

Module	Old → New	Why
google.golang.org/grpc	1.83.1 → 1.83.2	The requested bump (security patch)
golang.org/x/net	0.55.0 → 0.58.0	grpc 1.83.2 itself bumped x/net (grpc-go#9369)
golang.org/x/crypto	0.52.0 → 0.55.0	transitive
golang.org/x/sys	0.45.0 → 0.47.0	transitive
golang.org/x/term	0.43.0 → 0.45.0	transitive (go.sum only)
golang.org/x/text	0.37.0 → 0.41.0	transitive
golang.org/x/sync	0.20.0 → 0.22.0	transitive
golang.org/x/mod	0.35.0 → 0.38.0	transitive
golang.org/x/tools	0.44.0 → 0.48.0	transitive

go.mod:63 — grpc stays // indirect, which is correct.

Semver / breaking-change assessment

grpc 1.83.2 is a single-fix patch release: grpc-go#9365 makes the server reject requests that carry neither :authority nor a Host header, with HTTP 400 and gRPC status Internal. No exported API changed, no deprecations.

Does the fix touch this codebase?

Nothing here imports grpc, x/net, x/crypto, x/text, or x/sync — I grepped all .go files and the only file mentioning these paths is go.mod. So the exposure is entirely transitive:

• grpc server path is live but not at risk. main.go:27 calls providerserver.Serve, which stands up a gRPC server via terraform-plugin-go + hashicorp/go-plugin. So the changed server-side validation is on a code path this provider executes. The only client of that server is the Terraform CLI's go-plugin gRPC client over a local socket, and it always sets :authority. No behavior change expected — and the stricter check is a net positive for the plugin handshake.
• Kosli API client is unaffected. pkg/client/client.go uses stdlib net/http plus hashicorp/go-retryablehttp, not golang.org/x/net, so the x/net bump does not touch outbound HTTP to the Kosli API.
• golang.org/x/text 0.37 → 0.41 is the widest-reaching bump, since hcl/v2 and go-cty lean on it for string handling. Risk is limited to subtle Unicode normalization/width table changes — realistically irrelevant for attestation-type names, environment names, and JSON schema payloads, none of which do Unicode-sensitive comparison. Not worth blocking on.
• x/mod and x/tools only feed test/tooling paths (terraform-plugin-testing, hc-install). No runtime impact.

No schema or resource changes, so per CLAUDE.md there is nothing for make docs to regenerate here.

Not verified

I was unable to run go build ./..., go vet, or make test in this run — go/make invocations are outside my allowed tool set for this workflow, so they were denied rather than failing. To have me validate builds on future dependency PRs, add Bash(go build:*), Bash(go vet:*), Bash(go test:*), and Bash(make test:*) to --allowedTools.

Until then, please confirm via CI:

• unit tests + go vet + golangci-lint green on this branch
• go mod verify and go mod tidy produce no diff (worth a glance given how many indirects moved at once)
• at least one acceptance test run (e.g. make testacc-environment) to exercise the real plugin gRPC handshake against the updated server-side header validation — this is the one changed behavior with any theoretical reach into this provider
  • branch dependabot/go_modules/google.golang.org/grpc-1.83.2