fix(cve) bumb go-grpc to 1.83.2 to fix CVE-2026-84445

[vparfonov]

Description

Port-forward: #3468

/cc @Clee2691
/assign @jcantrill

Links

• Depending on PR(s):
• GitHub issue:
• JIRA:
• Enhancement proposal:

Summary by CodeRabbit

• Chores
  • Updated the application’s Go runtime and supporting libraries to newer versions.
  • Refreshed networking, synchronization, system, telemetry, configuration, and RPC components for compatibility and maintenance.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/cluster-logging-operator/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1e92f15f-d09c-4547-80ad-6296a643a92f

📥 Commits

Reviewing files that changed from the base of the PR and between dde56c0 and 842f75a.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The module now targets Go 1.26.0. Direct dependencies and several indirect dependencies were upgraded in go.mod. No exported or public entity declarations changed.

Changes

Go module updates

Layer / File(s)	Summary
Module toolchain and dependency versions go.mod	The Go version changed to 1.26.0. Direct golang.org/x dependencies and indirect CEL, HTTPSnoop, OpenTelemetry, YAML, Genproto, gRPC, and related modules were upgraded.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: jcantrill

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description includes reviewer and approver assignments and references the related port-forward pull request. It does not explain the CVE, the go-grpc upgrade, the rationale, or the implementation …	Add a clear summary stating that go-grpc is upgraded to version 1.83.2 to address CVE-2026-84445. Explain the rationale and relevant implementation impact. Keep the reviewer, approver, and related PR references.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: upgrading go-grpc to version 1.83.2 to address CVE-2026-84445. The typo “bumb” should be corrected to “bump,” but it does not prevent understanding.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description includes reviewer and approver assignments and references the related port-forward pull request. It does not explain the CVE, the go-grpc upgrade, the rationale, or the implementation scope required by the mandatory description section.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[vparfonov]

/test e2e-using-bundle

[jcantrill]

blocked by #3458 which include minio fix

[jcantrill]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jcantrill, vparfonov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jcantrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jcantrill]

/lgtm

[jcantrill]

/retest

[jcantrill]

/label verified

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 928795a and 2 for PR HEAD 842f75a in total

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 517d315 and 1 for PR HEAD 842f75a in total

[vparfonov]

/retest-required

[jcantrill]

/test e2e-using-bundle

[jcantrill]

/lgtm

[openshift-ci]

@vparfonov: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.