deps: bump google.golang.org/grpc v1.82.2 for CVE-2026-84445

[baijum]

Summary

• Bumps google.golang.org/grpc from v1.82.1 to v1.82.2 to fix CVE-2026-84445
• gRPC-Go: Denial of Service via malformed RPC requests (CVSS 7.5, Important)
• Servers using xds.NewGRPCServer() could panic on an RPC missing the :authority and Host headers, terminating the entire server process
• Fixed in gRPC-Go 1.82.2 and 1.83.2

Jira: HELM-857 / OCPTOOLS-2684

Changes

Only the gRPC dependency bump — no changes to go directive, Kubernetes API versions, or any other dependencies.

🤖 Generated with Claude Code

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: baijum

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [baijum]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:15 AM UTC · Completed 5:25 AM UTC

Commit: 3386c07 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.71

[fullsend-ai-review]

Review skipped — this PR is already merged.

The /fs-review command only reviews open PRs/MRs.

_{Posted by fullsend pre-review check}

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 5:15 AM UTC · Completed 5:26 AM UTC

Commit: 3386c07 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.62

[fullsend-ai-review]

Review skipped — this PR is already merged.

The /fs-review command only reviews open PRs/MRs.

_{Posted by fullsend post-review check}

[fullsend-ai-retro]

Retro: PR #81 — deps: bump grpc v1.82.2 for CVE-2026-84445

Timeline

1. 05:13:59Z — baijum opens PR deps: bump google.golang.org/grpc v1.82.2 for CVE-2026-84445 #81 targeting release-3.21 (single-commit gRPC dependency bump, co-authored with Claude Opus 4.6)
2. 05:14:03Z — fullsend dispatches review (run 36672469196)
3. 05:14:15Z — openshift-ci auto-approves (author self-approval via OWNERS)
4. 05:14:44Z — PR merged (45 seconds after creation)
5. 05:15:11Z — Review agent posts "Started" comment
6. 05:15:14Z — Review agent detects PR is already merged, posts "Review skipped" (3 seconds after starting)
7. 05:15:56Z — Retro agent dispatched (run 36672524265)

Observations

This is a straightforward vendored dependency bump fixing CVE-2026-84445 (gRPC-Go DoS, CVSS 7.5). PR #81 is the same fix as PR #78 but targeting release-3.21 instead of release-3.22. Both PRs exhibited the same merge-before-review pattern.

No novel proposals are warranted. All improvement opportunities identified are already tracked in existing open issues:

• Merge-before-review — fullsend-ai/fullsend#7616: PR deps: bump google.golang.org/grpc v1.82.2 for CVE-2026-84445 #81 provides additional evidence for this recurring pattern. The PR merged in 45 seconds — faster than the review agent's startup latency (~68 seconds from dispatch to first comment). This is the second consecutive PR on this repo where the review agent could not complete before merge (PR deps: bump google.golang.org/grpc v1.82.2 for CVE-2026-84445 #78 had the same outcome).

• Skip retro when no agent activity — fullsend-ai/fullsend#7803 (and 8+ related issues including helm list on Linux mishandles Windows release timestamps helm/helm#7486, Is there a way or work around to render value file for use in third part chart which doesn't use tpl function? helm/helm#7392, Helm search should have the option to exit with 1 if no results found helm/helm#7197): This retro was dispatched despite zero substantive agent activity on PR deps: bump google.golang.org/grpc v1.82.2 for CVE-2026-84445 #81 — the only agent interaction was the review agent immediately skipping. This retro is itself an instance of the waste those issues aim to eliminate.

• Add CLAUDE.md — redhat-developer/helm#79: Still open, filed by the PR deps: bump google.golang.org/grpc v1.82.2 for CVE-2026-84445 #78 retro. No new evidence to add.

What went well

• The review agent's pre-review check caught the merged state in 3 seconds on PR deps: bump google.golang.org/grpc v1.82.2 for CVE-2026-84445 #81, compared to PR deps: bump google.golang.org/grpc v1.82.2 for CVE-2026-84445 #78 where the review agent ran to completion at $2.54 before discovering the PR was merged. This suggests the early-exit path described in fullsend-ai/fullsend#7393 may be partially addressed for the "already merged at dispatch time" case.

Agents repo

Discovered from run 36387333268 logs: fullsend-ai/agents@v0.43.0 (commit 7ab05564b3c9).