fix: [FL-30998] bump google.golang.org/grpc to 1.83.2 (HIGH, GHSA-vp52-pcj8-j9qc)

[josue]

Stacked PR. Base is chore/FL-30996-go-1.27.1 (#107), itself stacked on patch/FL-30994-x-crypto-pin (#106). Merge order: #106 → #107 → this.

Corrected after review. The first revision was inert — a replace in _examples/go.mod shadowed the bump and the resolved version stayed vulnerable. Details below; the fix is in the second commit.

Problem

Dependabot alert #4 (HIGH): google.golang.org/grpc ≤ 1.83.0 is affected by GHSA-vp52-pcj8-j9qc, fixed in 1.83.1.

The alert was created 2026-09-02 07:50, after this wave's initial Dependabot sweep on 2026-08-31 returned CLEAN for this repo — genuinely new, not missed.

Solution

Bump to 1.83.2 — newest on the line, so a later patch doesn't reopen this.

Two places had to change, and the second is the whole story.

1. The root require (first commit) — insufficient on its own

2. The _examples replace (second commit) — what actually moved the version

_examples/go.mod carried replace google.golang.org/grpc => google.golang.org/grpc v1.82.1. Because go.work makes both modules main modules, replaces from every main module apply workspace-wide, and a replace is an absolute override, not an MVS input. So the root's require v1.83.2 lost to that wildcard replace:

$ go list -m google.golang.org/grpc        # before the fix
google.golang.org/grpc v1.83.2 => google.golang.org/grpc v1.82.1

v1.82.1 is precisely the version the advisory is filed against. The bump was inert for make test, make lint, CI's Testing job and the committed _examples/go.sum.

The pin was deliberate — #104 (FL-30189) added it as this repo's mechanism for controlling grpc — so it is raised to v1.83.2 rather than deleted, keeping the mechanism intact.

Also ran go work sync ./... + go mod tidy in _examples, which the first commit skipped. That is what make upgrade-deps ends with; without it _examples/go.mod kept the pre-bump versions, stale for GOWORK=off, Dependabot's resolver, or anyone lifting an example as a starting point.

Version changes that actually happened

Sourced from git diff, not from go get stdout — see the note below.

Module	From	To	Direct?
google.golang.org/grpc	1.82.1	1.83.2	indirect (root)
x/mod	0.35.0	0.38.0	indirect
x/sync	0.20.0	0.22.0	direct
x/text	0.36.0	0.41.0	indirect
x/tools	0.44.0	0.48.0	direct
genproto/googleapis/rpc	…afd174a4e478	…3dc84a4a5aaa	indirect

x/net and x/sys did NOT move, despite go get reporting them as upgraded. Both are replace-pinned (go.mod:53 at v0.55.0, go.mod:55 at v0.44.0) and their go.sum entries are untouched. My first description listed them because I transcribed go get's stdout, which reports what MVS selected before replaces override it. go get describes intent; go list -m describes reality — the same error as the inert bump, one layer down.

The genproto ambiguity

Bumping grpc alone fails — the old monolithic genproto and the split-out genproto/googleapis/rpc both provide googleapis/rpc/status. Moving genproto past the split resolves it, and go mod tidy then drops the monolithic module entirely.

Testing strategy

The resolver check first, because a green suite says nothing about which version it compiled:

workspace       -> v1.83.2 => google.golang.org/grpc v1.83.2
GOWORK=off root -> v1.83.2
GOWORK=off _ex  -> v1.83.2 => google.golang.org/grpc v1.83.2

_examples/go.sum carries the v1.83.2 hashes. All three modes, because one mode was exactly what hid the first revision's failure.

Everything below re-run against the real 1.83.2; the first revision's green results were collected on 1.82.1 and are void:

Check	root	_examples
go build ./...	✅ rc=0	✅ rc=0
go vet ./...	✅ rc=0	—
golangci-lint v2.13.2	✅ 0 issues	—
goimports	✅ clean	—
go test -count=1 ./...	✅ rc=0	✅ rc=0

Passing: ok github.com/flume/enthistory, ok github.com/flume/enthistory/internal/schemast, ok _examples.

Checked #106 for the same shadowing: there is no websocket replace, and it resolves v1.5.3 under both workspace and GOWORK=off, so that fix was never affected. tidy removed a redundant // indirect line for it — go.sum still pins v1.5.3 and go mod why -m still shows it reachable via entgql → gqlgen/client.

Rollback plan

Revert both commits — go.mod/go.sum in root and _examples. No source change, no API change.

Security review

• No application code changed.
• Closes one HIGH advisory — verified by resolver output, not by the presence of a require line.
• Two direct dependencies (x/sync, x/tools) moved as MVS requires, with the real test suite green.

[flume-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[flume-factory]

Review — 3 comment(s).