[dependabot]

Bumps google.golang.org/grpc from 1.79.3 to 1.83.2.

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.2

Security

• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)
  • Special Thanks: @​winklemad

Release 1.83.1

Security

• xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)
  • Special Thanks: @​alimony

Performance

• transport: Restrict memory overhead of buffering small data frames. (#9331)

Release 1.83.0

Security

• server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
• xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

New Features

• xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
• xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
• authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
  • Special Thanks: @​hnefatl
• xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
• xds: Add support for xDS-based HTTP CONNECT proxies.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
• xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

• credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
• grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)
  • Special Thanks: @​Yusufihsangorgel

... (truncated)

Commits

• 030ee8b Update version to 1.83.2 (#9375)
• 8668b69 cherry-pick #9365 to v1.83.x (#9366)
• a3e952d cherry-pick #9346 to v1.83.x and update x/net dependency (#9369)
• 58f8fd9 Change version to 1.83.2-dev (#9337)
• 1550d9e Change version to 1.83.1 (#9336)
• ebba6f3 Cherry-pick #9258 and #9332 into v1.83.x (#9335)
• 8cfeca0 Cherry-pick #9331 to v1.83.x (#9333)
• dec6951 Change version to 1.83.1-dev (#9229)
• 4c226da Change version to 1.83.0 (#9228)
• c198988 Cherrypick 9223 into v1.83.x (#9279)
• Additional commits viewable in compare view

[github-actions]

## Ark ReviewBot review

**Verdict:** Comment only

### Findings

#### [P2] Embedded etcd v3.5.18 may be incompatible with forced grpc v1.83.2
`go.mod:23-25` (region: `go.etcd.io/etcd/server/v3 v3.5.18` alongside `google.golang.org/grpc v1.83.2`)

Speedle+ embeds `go.etcd.io/etcd/server/v3` as a library. etcd 3.5.x is built and tested against much older gRPC versions (its own go.mod requires grpc ~v1.58); upstream etcd historically does not compile against newer gRPC releases because it uses experimental balancer/resolver APIs that have been removed or changed (e.g., `google.golang.org/grpc/balancer`, `naming`, removed `resolver.Address` fields, clientconn internal changes). Overriding the module to grpc v1.83.2 via the root `require` forces the embedded etcd server to build against an untested, potentially API-incompatible gRPC. Concrete scenario: `go build ./...` fails inside etcd server packages, or, worse, it compiles but embedded-etcd watch/lease behavior regresses at runtime, breaking ADS policy watching. Impact: build failure or subtle store/watcher regressions in the policy store path. Smallest safe correction: run `go build ./...` plus the etcd-store integration tests before merge, or pin grpc to a version etcd 3.5.18 officially supports and only bump `golang.org/x/net`.

**Uncertainty:** This is a static review; I cannot verify whether etcd 3.5.18 compiles cleanly against grpc 1.83.2. The risk is based on known upstream compatibility gaps, so it may resolve to a build error (immediately visible) or nothing at all.

### What looks good
- go.mod and go.sum are updated consistently for every changed module (net, grpc, crypto, oauth2, sync, term, text, tools, genproto api/rpc, gonum), with matching `h1:` and `/go.mod` hash pairs replaced atomically.
- The bump upgrades `golang.org/x/net` and `golang.org/x/crypto`, which carry frequently published HTTP/2 and crypto CVE fixes relevant to an authz service.
- No other code changes; no lock/module mismatch visible in the diff.

### Validation gaps
- No CI output is included; cannot confirm the module graph resolves, that `go mod tidy` was run, or that all packages (especially etcd server and the mongo/k8s transitive deps) compile against grpc v1.83.2 and x/net v0.58.0.
- Cannot verify the integrity of the new go.sum hashes against the Go checksum database from a static diff.
- `golang.org/x/oauth2` (v0.34.0 → v0.36.0) and `google.golang.org/genproto` pseudo-version date 2026-05-26 cannot be validated for provenance from the diff alone; confirm these resolve from the public proxy.

<!-- reviewbot-verdict:actionable-findings -->
— **Ark ReviewBot**

Reviewed commit: a6b5783924709f8b85a44dbfe0ecdcf12f567988

[caiwl]

Maintainer verification of the Ark compatibility concern:

• go mod tidy -diff produced no changes.
• go vet -composites=false ./pkg/... ./cmd/... ./api/... passed.
• all three shipped binaries built successfully.
• etcd store, Mongo store, evaluator, and evaluator-function tests passed against gRPC v1.83.2.

This resolves the static-review validation gap for the embedded etcd path.