fix(deps): patch grpc and containerd CVEs

[plural-copilot]

Summary

Remediates the two reported Go dependency vulnerabilities in the source repository authoritatively mapped to ghcr.io/pluralsh/console:0.12.42:

• CVE-2026-84445: google.golang.org/grpc v1.83.1 -> v1.83.2 (the smallest requested fixed release).
• CVE-2026-53495: github.com/containerd/containerd v1.7.33 -> v1.7.35 (the minimum requested fixed release).

Why this fixes the Console image finding

The repository Dockerfile copies go.mod/go.sum, downloads the module graph, and statically builds ./cmd/plural. The CI build-image job builds that Dockerfile and publishes ghcr.io/pluralsh/plural-cli. Per the authoritative image-to-source mapping, Console image Go findings are remediated in this repository’s CLI module; no GitOps, deployment, promotion, Dockerfile, or image-tag changes are needed.

google.golang.org/grpc is linked through pkg/provider/gcp. github.com/containerd/containerd is also linked Go code, not a base-image or bundled-runtime component: go mod why -m github.com/containerd/containerd reports pkg/pr -> helm.sh/helm/v3/pkg/registry -> github.com/containerd/containerd/remotes. Updating the indirect module requirement therefore remediates the code compiled into the CLI binary.

Scope

Only generated Go module metadata changed:

• go.mod — bump the direct grpc requirement and the indirect containerd requirement.
• go.sum — replace the corresponding grpc and containerd checksums.

The updates were generated with standard Go tooling:

go get google.golang.org/grpc@v1.83.2 github.com/containerd/containerd@v1.7.35
go mod tidy

Validation

Passed:

docker run --rm hello-world
git diff --check
docker run --rm -v "$PWD:/workspace:ro" -w /workspace golang:1.26.6-alpine3.24 \
  sh -ec 'go list -m all | grep -E "^(github.com/containerd/containerd|google.golang.org/grpc) "'

The final resolver output was:

github.com/containerd/containerd v1.7.35
google.golang.org/grpc v1.83.2

Attempted the documented test target in the supplied test container:

docker run --rm -v "$PWD:/workspace" -w /workspace plural-cli-cve-test:local \
  sh -ec 'go install gotest.tools/gotestsum@latest && make test'

It executed the repository’s race-enabled suite and showed passing tests, but the explicit 700-second command timeout stopped it before completion; gotestsum reported two timeout-induced failures while two packages were still running. A focused race rerun (go test -race ./cmd/command/cd ./cmd/command/crypto, 5-minute limit) and production docker build (12-minute limit) also reached their intentional compilation time limits in this constrained environment. Docker was available and no containers were left running. The pre-existing test-image default command is ineffective without a repository bind mount because .dockerignore excludes Makefile; this PR deliberately does not broaden scope to fix that unrelated issue.

Hosted CI should run the full test suite and production image build with its normal resources/cache.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create one focused PR to remediate the two reported vulnerabilities in ghcr.io/pluralsh/console:0.12.42, whose Go dependency source is authoritatively mapped to this repository (pluralsh/plural-cli). Do not make any GitOps, deployment, or image tag-promotion changes....
🔗 Run history	View run history

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	google.golang.org/​grpc@​v1.83.1 ⏵ v1.83.2	+1	+16

View full report

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge because it contains consistent patch-level dependency updates with no identified behavioral or reachable security regression.

Summary

• Updates google.golang.org/grpc from v1.83.1 to v1.83.2.
• Updates indirect github.com/containerd/containerd from v1.7.33 to v1.7.35.
• Keeps the dependency graph metadata internally consistent without changing application code.

_{Reviews (1) · Last reviewed commit: "fix(deps): patch grpc and containerd vul..."}