build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1

[dependabot]

Bumps google.golang.org/grpc from 1.82.1 to 1.83.1.

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.1

Security

• xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)
  • Special Thanks: @​alimony

Performance

• transport: Restrict memory overhead of buffering small data frames. (#9331)

Release 1.83.0

Security

• server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
• xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

New Features

• xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
• xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
• authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
  • Special Thanks: @​hnefatl
• xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
• xds: Add support for xDS-based HTTP CONNECT proxies.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
• xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

• credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
• grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)
  • Special Thanks: @​Yusufihsangorgel

Release 1.82.2

Security

• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)

... (truncated)

Commits

• 1550d9e Change version to 1.83.1 (#9336)
• ebba6f3 Cherry-pick #9258 and #9332 into v1.83.x (#9335)
• 8cfeca0 Cherry-pick #9331 to v1.83.x (#9333)
• dec6951 Change version to 1.83.1-dev (#9229)
• 4c226da Change version to 1.83.0 (#9228)
• c198988 Cherrypick 9223 into v1.83.x (#9279)
• 8ce3ebf Cherrypick PR 9255 into v1.83.x (#9263)
• e393849 Cherry-pick recent changes from master (#9240)
• 2a112a8 authz: add onPolicyUpdate callback to authz file watcher (#9142)
• 1a80fca vet: adds a check to disallow usage of regex.Compile in xDS code (#9216)
• Additional commits viewable in compare view

Summary by CodeRabbit

• Chores
  • Performed internal maintenance updates to supporting components.
  • No changes were made to user-facing features, functionality, or public interfaces.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 172d4716-c8be-4392-b4d6-ad9ea75e5959

📥 Commits

Reviewing files that changed from the base of the PR and between 140adf7 and c985e31.

📒 Files selected for processing (1)

• go.mod

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• codeready-toolchain/mcp-common (manual)
• codeready-toolchain/mcp-server-devsandbox (manual)
• codeready-toolchain/api (manual)
• codeready-toolchain/toolchain-common (manual)
• codeready-toolchain/host-operator (manual) → reviewed against open PR #1293 dependabot/go_modules/google.golang.org/grpc-1.83.1 instead of the default branch
• codeready-toolchain/toolchain-e2e (manual)

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: Bundle matches config
• GitHub Check: Lint
• GitHub Check: build-test-coverage

🧰 Additional context used

📓 Path-based instructions (1)

-Focus on major issues impacting performance, readability, maintainability and security.

⚙️ CodeRabbit configuration file

Files:

• go.mod

🔇 Additional comments (2)

go.mod (2)

19-19: LGTM!

Also applies to: 21-21, 25-25, 70-76, 93-94

---

95-95: 🔒 Security & Privacy

Establish whether this binary accepts gRPC server traffic.

No direct grpc.NewServer or gRPC .Serve path exists in the repository. Production use of an indirect gRPC server remains unknown, so the required dependency version cannot be determined from the available evidence.

---

Walkthrough

The pull request updates indirect Go module dependencies in go.mod, including CEL, OpenTelemetry, Google Genproto, and gRPC packages.

Changes

Go dependency updates

Layer / File(s)	Summary
Module version updates go.mod	Updates indirect CEL, OpenTelemetry, Google Genproto, and gRPC dependency versions.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to c985e

The dependency upgrades introduce no demonstrated merge-blocking behavior or production impact in the repository.

Suggested labels: security

Suggested reviewers: fbm3307

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the Google gRPC dependency upgrade from 1.82.1 to 1.83.1, which is the stated primary objective of the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/go_modules/google.golang.org/grpc-1.83.1

---

_{Comment @coderabbitai help to get the list of available commands.}