fix(deps): remediate console Go vulnerabilities

[plural-copilot]

Summary

Plural Service: mgmt/console

Remediates the remaining owned, fixed-version Go dependency vulnerabilities for the requested deployed image artifacts. This PR changes only the relevant Go module manifests and checksums; it does not change GitOps, redis/cloud-db, Dockerfiles, workflows, image deployment configuration, or image tags.

Vulnerability remediation

• CVE-2026-84304 → google.golang.org/grpc v1.83.2
• CVE-2026-84303 → google.golang.org/grpc v1.83.2
• CVE-2026-84445 → google.golang.org/grpc v1.83.2
• CVE-2026-78662 → golang.org/x/crypto v0.56.0
• CVE-2026-56855 → golang.org/x/crypto v0.56.0

These are the smallest requested fixed versions. The gRPC update also updates its required minimal-version-selection transitive minimums (OpenTelemetry, genproto, x/net, and cel.dev/expr) where applicable.

GO-2026-5932/openpgp was not remediated because no fixed version exists.

Affected artifacts, build paths, and module roots

Deployed image	CI/Docker build path	Go module root(s)
nexus:0.12.41	build context go/nexus; Dockerfile go/nexus/Dockerfile	go/nexus
kubernetes-agent:sha-8703bfe — kas	build context go; Dockerfile go/kubernetes-agent/hack/docker/Dockerfile; binary ./cmd/kas	go/kubernetes-agent/kas
kubernetes-agent:sha-8703bfe — agentk	build context go; Dockerfile go/kubernetes-agent/hack/docker/Dockerfile.agentk; binary ./cmd/agentk	go/kubernetes-agent/kas (shared with kas)
kubernetes-agent:sha-8703bfe — bundled API component	build context go; multi-binary Dockerfile go/kubernetes-agent/hack/docker/Dockerfile; binary .	go/kubernetes-agent/api
deployment-controller:sha-8703bfe	build context ./go; Dockerfile go/controller/Dockerfile; manager cmd/*.go	go/controller
oci-auth:v0.12.41	build context ./go; Dockerfile go/oci-auth/Dockerfile; binary .	go/oci-auth

Resolved versions after the update:

• go/nexus: gRPC v1.83.2, x/crypto v0.56.0
• go/kubernetes-agent/kas (kas and agentk): gRPC v1.83.2, x/crypto v0.56.0
• go/kubernetes-agent/api: x/crypto v0.56.0; gRPC remains its non-affected resolved v1.79.3
• go/controller: gRPC v1.83.2, x/crypto v0.56.0
• go/oci-auth: x/crypto v0.56.0; gRPC remains its non-affected resolved v1.68.1

Validation

All Go commands used Go 1.26.5 in Docker with GOWORK=off to verify each module independently.

• go mod tidy -diff in go/nexus, go/kubernetes-agent/api, go/kubernetes-agent/kas, go/controller, and go/oci-auth — passed with no diff.
• go list -m all | grep -E '^(google\.golang\.org/grpc|golang\.org/x/crypto) ' in all five module roots — confirmed the resolved versions listed above.
• go test ./... && go build ./cmd/main.go in go/nexus — passed.
• go build -buildvcs=false . in go/kubernetes-agent/api — passed.
• go build -buildvcs=false ./cmd/kas && go build -buildvcs=false ./cmd/agentk in go/kubernetes-agent/kas — passed.
• go build -buildvcs=false ./cmd/... in go/controller — passed.
• go test -buildvcs=false ./... && go build -buildvcs=false . in go/oci-auth — passed.
• git diff --check — passed.

Limitation: full test suites for the API, KAS, and controller modules were not completed in this bounded run because of their broad integration/dependency footprint. Their module resolution and production entrypoint builds passed.

Promotion note

Rebuilt and published image tags are required before a later GitOps promotion. This PR intentionally does not update any image tag or GitOps configuration.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create exactly one remediation PR against main for the remaining owned fixed-version Go dependency vulnerabilities deployed by mgmt/console. Do not modify GitOps, redis/cloud-db, or any image deployment/tag configuration....
🔗 Run history	View run history

[soffi-ai]

Soffi AI Summary

This PR remediates five Go dependency security vulnerabilities (CVE-2026-84304, CVE-2026-84303, CVE-2026-84445, CVE-2026-78662, CVE-2026-56855) across multiple Go modules in the monorepo. The fix targets two packages: google.golang.org/grpc is bumped to v1.83.2 (addressing three gRPC CVEs) and golang.org/x/crypto is bumped to v0.56.0 (addressing two crypto CVEs). Affected module roots are go/nexus, go/kubernetes-agent/kas, go/kubernetes-agent/api, go/controller, and go/oci-auth. The gRPC upgrade also pulls in aligned transitive minimums for OpenTelemetry (v1.44.0), genproto, x/net, and cel.dev/expr. Only go.mod and go.sum files are modified — no application code, Dockerfiles, workflows, or GitOps image tags are changed. One known vulnerability (GO-2026-5932/openpgp) was intentionally left unremediated due to the absence of a fixed upstream release.

Changes

Go dependency security vulnerability remediation

• Bumped google.golang.org/grpc to v1.83.2 and golang.org/x/crypto to v0.56.0 across five Go module roots (go/nexus, go/kubernetes-agent/kas, go/kubernetes-agent/api, go/controller, go/oci-auth) to remediate five CVEs (CVE-2026-84304, CVE-2026-84303, CVE-2026-84445, CVE-2026-78662, CVE-2026-56855). Transitive dependencies — OpenTelemetry SDK/API/metrics/trace (v1.44.0), cel.dev/expr, and google.golang.org/genproto — were updated to satisfy new minimal-version-selection requirements introduced by the gRPC upgrade. Only module manifests and checksums are changed; no application code or deployment configuration is touched. (0e16c93)

---

Updated: 2026-09-10 19:43 UTC

Deploy in Soffi

[greptile-apps]

Confidence Score: 5/5

The dependency-only changes appear safe to merge, with no concrete regression or newly introduced security exposure identified.

Summary

• Upgrades google.golang.org/grpc to v1.83.2 in controller, KAS, and Nexus.
• Upgrades golang.org/x/crypto to v0.56.0 across the five affected module roots.
• Applies the associated OpenTelemetry, genproto, x/net, and CEL expression transitive updates required by module resolution.
• Leaves application logic, build definitions, deployment configuration, and image tags unchanged.

_{Reviews (1) · Last reviewed commit: "fix(deps): remediate console Go vulnerab..."}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​go.opentelemetry.io/​otel/​sdk@​v1.44.0

View full report