Bump google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf)

[stevenolen]

Summary

Remediates a High severity Snyk finding: Incorrect Authorization (GHSA-hrxh-6v49-42gf, CWE-863) in google.golang.org/grpc, which is vulnerable below v1.82.1.

grpc is an indirect dependency pulled in transitively through the Pulumi SDK. Bumping it to v1.82.1 in the lib module forces minimal version selection to the patched release. The cmd module inherits the fix through its local replace of lib.

Changes

• lib/go.mod, lib/go.sum: grpc v1.80.0 to v1.82.1
• cmd/go.mod, cmd/go.sum: grpc v1.80.0 to v1.82.1 (inherited via the lib replace)

Verification

• go build ./... clean in both modules
• go test ./... passes in both modules
• snyk test reports 0 vulnerable paths in both modules (finding cleared)

[claude]

Claude finished @stevenolen's task in 33s —— View job

---

PR Review

• Read changed files
• Review go.mod changes
• Verify dependency bump is correct and complete
• Post review

---

This is a clean, minimal CVE fix. A few observations:

Correct scope: Both lib/ and cmd/ modules are updated symmetrically. The genproto/googleapis/api and genproto/googleapis/rpc co-packages are also bumped alongside grpc — these share grpc's release cadence and need to be updated together, so that's correct.

go.sum integrity: The new hash entries for v1.82.1 and the updated genproto timestamps look structurally correct (h1 hash + go.mod hash for each module).

Indirection is appropriate: grpc is listed as // indirect in both modules, which is accurate since it's pulled in transitively through the Pulumi SDK. The explicit version pin in go.mod is the right way to force MVS to the patched version.

No issues found. The change is exactly as narrow as it should be for a CVE remediation.