Bump grpc to v1.83.2 for CVE-2026-84445; the base-image rows clear on rebuild

[ai-collaboration-app]

Covers the whole set of findings that dev chart scan 34330594840 attributes to this repository: 12 HIGH / 27 MEDIUM over 39 CVE-package groups on stackstate-k8s-process-agent:d1ca2bd2. One source bump; the other 38 rows are base-image RPMs that need no source change.

The one source change

Finding	Severity	Action
CVE-2026-84445	HIGH (both scanners)	google.golang.org/grpc v1.83.1 -> v1.83.2

Mind the direction: v1.83.1 is what #272 moved this repository up to for CVE-2026-84304, and v1.83.1 is now itself affected. This is a follow-on, not a repeat of finished work.

OSV confirms the lead rather than us taking the scanner's word: GHSA-2v4p-qf9q-27wj has ranges introduced 0 / fixed 1.82.2 and introduced 1.83.0 / fixed 1.83.2, so v1.83.2 is the fix on the line already in use. golang.org/x/net moves v0.57.0 -> v0.58.0 solely because grpc v1.83.2's own go.mod requires it; nothing else in the graph moved, and neither new version has an OSV entry.

The advisory is scoped to gRPC-Go xDS servers crashing on requests with no :authority and no Host header. That path is absent here: 66 google.golang.org/grpc packages are reachable from ./cmd/... and none is under grpc/xds. Bumped anyway, for the same reason as #272 — a compatible patch release exists, which is cheaper and more durable than a suppression.

The 38 base-image rows need no change here, and today's channel clears every one

libopenssl3, openssl-3, libcares2, curl, libcurl4, wget, libusb-1_0-0, libbz2-1 and libnghttp2-14. BCI.dockerfile pins no package versions, so this is a rebuild, not an edit.

Verified rather than assumed: replaying the exact BCI.dockerfile stage pins today — bci-micro:15.7 exported to a chroot, bci-base:latest builder, the same zypper refresh && update && install sequence — resolves exactly the fixed version the scan asks for, for all nine packages:

curl           8.14.1-150700.7.26.1
libbz2-1       1.0.8-150400.3.4.1
libcares2      1.34.8-150000.3.29.1
libcurl4       8.14.1-150700.7.26.1
libnghttp2-14  1.64.0-150700.3.6.1
libopenssl3    3.5.0-150700.5.50.1
libusb-1_0-0   1.0.24-150400.3.6.1
openssl-3      3.5.0-150700.5.50.1
wget           1.24.5-150700.3.12.1

list-updates then answers No updates found and up --dry-run Nothing to do, so that is today's ceiling and not a partial refresh. The rebuild this PR triggers is what delivers them; confirmation belongs on the rebuilt image in CI, not on this diff.

Validation

• go mod verify passes.
• go build and go test with the release tag set (kubelet kubeapiserver linux cri containerd linux_bpf) leave exactly the two failures a bare checkout already produces on master — undefined runtime.Tracer and runtime.RuntimeSecurity in the datadog-agent upstream eBPF compile assets that the CI prebuild step generates. config, model, pkg/kube, pkg/pods and test-server pass.
• scripts/verify-openpgp-absent.sh with the release tags reports openpgp absent from 1886 packages, keeping the GO-2026-5932 compensating control honest across the bump.
• CI on this branch is the evidence for the image itself. Read the evaluator output, not the check mark: mode: inform landed in STAC-25360: drop the dead Artifactory env passthrough #265, so a green run carries no vulnerability verdict.

exceptions/GO-2026-5932.yaml is deliberately untouched — its component purl is x/crypto@v0.56.0, which this PR does not move.

Not fixed here

exceptions/GO-2026-5932.yaml expires 2026-09-10, tomorrow. No bump can clear GO-2026-5932: it has introduced: 0 and no fixed event in any version. Renewing it a third time or approving the vexhub statement is a human decision, tracked on cve-reporter#27.

Coordination ticket: cve-reporter#69.

Merge order note: #277 also edits go.sum, so whichever merges second needs a refresh. It changes no module version and moves none of these rows.

[ai-collaboration-app]

CI on this branch is red for a pre-existing reason that has nothing to do with this diff, and #280 is the fix.

Run 34334224116 fails in the first step on both architectures:

E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired
Process completed with exit code 100

The prebuild images are Debian 11 bullseye, now EOL, so apt-get update exits 100 and the step cannot install rsync. Every downstream job — including the image build and the Trivy/Grype scan that would be this PR's real evidence — is skipped as a result.

This is not caused by the grpc bump. #277 failed identically on 2026-09-08, a day before this branch existed, and the last green CI in the repository was 2026-09-07T09:35Z. #280 removes the apt dependency.

Merge #280 first, then this branch needs a rebase to pick it up and produce a green run with a scanned image.

Meanwhile, verified locally against the published digest sha256:0e6fe8cb… rather than waiting on CI:

• go version -m on the packaged binary: google.golang.org/grpc v1.83.1 — the affected version is genuinely what ships.
• Trivy 0.74.0 and Grype 0.117.0 both report CVE-2026-84445 / GHSA-2v4p-qf9q-27wj against it, fixed version 1.83.2.
• Grype reproduces all 37 base-image rows at exactly the installed and fixed versions the scan lists, and the image's own rpm database matches the scan's Installed column for all nine packages.

[ai-collaboration-app]

Validated: this bump takes the image to unmanaged: 0 on both architectures.

Because CI on this branch cannot run until #280 lands, I validated the combined tree instead — #280's commit plus this commit, as branch cve-grpc-84445-validation at fa8ae745, dispatched as run 34337687775. All build, test and scan jobs green on amd64 and arm64. Nothing was published: the publish jobs are skipped on workflow_dispatch.

Evaluator, identical on both architectures:

image-pipeline evaluator (mode: inform)
  total in-scope findings:  1
  suppressed by exception:  1
  expired:                  0
  unmanaged:                0
  unused exceptions:        0
Suppressed:
  - GO-2026-5932 [UNKNOWN] pkg:golang/golang.org/x/crypto@v0.56.0 — exceptions/GO-2026-5932.yaml

unmanaged goes 1 → 0. CVE-2026-84445 is gone, and no base-image row replaces it. Read from the evaluator rather than the check mark, since mode: inform means a green run carries no vulnerability verdict on its own.

For contrast, #280 alone — the same tree without this commit — reports unmanaged: 1, that one finding being CVE-2026-84445 [HIGH] pkg:golang/google.golang.org/grpc@v1.83.1. That pair of runs isolates this diff as the cause of the change.

All 39 rows the scan attributes to this repository are now accounted for: 37 base-image rows cleared by the rebuild in #280's run at exactly the fixed versions, and the 2 grpc rows cleared here.

The validation branch exists only to carry this evidence and can be deleted once this PR is rebased onto #280 and produces its own green run.

[ai-collaboration-app]

Administrative correction: the updatecli bot closed #277 and reopened the same change as #279 (go.sum only, +5/-26, no module version moved) at 09:29Z today. The merge-order note above should read #279, not #277. Nothing else changes: it still moves none of this repository's scan rows, and it still overlaps only textually in go.sum, so whichever of it and this PR merges second needs a refresh.

[ai-collaboration-app]

Independent CVE review of 3e4740d066817fefde5196f42b651e5ea4bec04f (supervised remediation run, dev scan 34330594840). Verdict: lacks post-rebase evidence — do not merge yet.

The change itself checks out: grpc v1.83.2 is present in the combined-run artifacts on both architectures, and run 34337687775 reports unmanaged: 0 on both. The immutable scan digest was verified and no suppressions were added.

The gap is evidence on this head. This PR cannot go green until #280 lands, and the validation above came from the separate combined branch fa8ae7454a41c40a5a12bf7b1cff7c1434b6d50b, not from the PR head. #280 also currently needs a correction of its own. Sequence: correct and merge #280, then rebase this PR and obtain a green dual-architecture, dual-scanner run on the actual PR head before merging.

Separately, and needing a human decision today: the reviewer judged that letting GO-2026-5932 expire is unsafe. The versionless VEX proposal on StackVista/cve-reporter#27 works; the alias fragility is real but currently mitigated by Grype --by-cve.

Human review and merge remain mandatory.