fix(deps): remediate console Go CVEs

[plural-copilot]

Summary

Plural Service: mgmt/console

Remediates the eligible fixed-version Go dependency findings for the console image (built from this plural-cli repository):

• CVE-2026-53495: github.com/containerd/containerd v1.7.33 → v1.7.35. This remains an indirect dependency, used in the CLI path through pkg/pr → Helm registry.
• CVE-2026-84445: google.golang.org/grpc v1.83.1 → v1.83.2. This is a direct dependency used by pkg/provider/gcp.

go.mod and Go-tool-generated go.sum were updated only. The unfixable openpgp finding was intentionally unchanged because it is unfixable and out of scope. No redis, cloud-db, Dockerfile, GitOps, or tag-promotion changes are included.

Validation

Passed in Dockerized Go 1.26.6:

• go mod verify
• go list -m all confirmed github.com/containerd/containerd v1.7.35 and google.golang.org/grpc v1.83.2
• go list -m -json showed no module replacement for either dependency
• go test ./pkg/provider/gcp ./pkg/pr ./cmd/plural
• go build -o /tmp/plural ./cmd/plural
• /tmp/plural --help

A full Docker image build was also attempted. It downloaded modules and reached the Dockerfile's final go build step, but exceeded the deliberate 15-minute command timeout (exit 124); therefore image-build success is not claimed here.

Deployment note

A new console image build/publish is required before GitOps promotion. This PR deliberately does not make a GitOps/tag-promotion change.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create a single remediation PR for the currently deployed mgmt/console console image only (this image maps to this plural-cli repository). Do not make GitOps/tag-promotion changes....
🔗 Run history	View run history

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	google.golang.org/​grpc@​v1.83.1 ⏵ v1.83.2	+1	+16

View full report

[greptile-apps]

Confidence Score: 5/5

The dependency-only remediation appears safe to merge.

Summary

• Upgrades google.golang.org/grpc from v1.83.1 to v1.83.2.
• Upgrades indirect dependency github.com/containerd/containerd from v1.7.33 to v1.7.35.
• Keeps the module checksum file synchronized with both upgrades.

_{Reviews (1) · Last reviewed commit: "fix(deps): remediate console Go CVEs"}