build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /test

[dependabot]

Bumps google.golang.org/grpc from 1.81.1 to 1.82.1.

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.82.1

Security

• server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.

Release 1.82.0

Behavior Changes

• server: Remove support for GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING environment varibale. Strict incoming RPC path validation (which has been the default since v1.79.3) can no longer be disabled. (#9112)
• transport: Add environment variable to change the default max header list size from 16MB to 8KB. This may be enabled by setting GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true. This will be enabled by default in a subsequent release. (#9019)
• balancer: Load Balancing policy registry is now case-sensitive. Set GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false (and file an issue) to revert to case-insensitive behavior. (#9017)

New Features

• experimental/stats: Expose a new API, NewContextWithLabelCallback, to register a callback that is invoked when telemetry labels are added. (#8877)
  • Special Thanks: @​seth-epps
• client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (#8929)
  • Special Thanks: @​chengxilo
• server: Add environment variable GRPC_GO_SERVER_GOROUTINE_LABELS that controls setting runtime/pprof.Labels on goroutines spawned by the server. Set GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true to add the grpc.method label on goroutines spawned to handle incoming requests. (#9082)
  • Special Thanks: @​dfinkel

Bug Fixes

• xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (#9138)
• grpc: In the deprecated gzip Compressor (used via the deprecated WithCompressor dial option), enforce the MaxRecvMsgSize limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (#9114)
  • Special Thanks: @​evilgensec
• stats/opentelemetry: Record retry attempts, grpc.previous-rpc-attempts, at the call level and not the attempt level. (#8923)
• encoding: Ensure Close() is always called on readers returned from Compressor.Decompress if possible. (#9135)
• channelz: Fix the LastMessageSentTimestamp and LastMessageReceivedTimestamp fields in SocketMetrics to ensure they contain correct timestamp values. (#9109)

Commits

• ebd8f06 Change version to 1.82.1 (#9238)
• 4ea465d Cherry-pick commits (#9236)
• 9494a2c Change version to 1.82.1-dev (#9171)
• bd23985 Change version to 1.82.0 (#9170)
• 0f3086d Fix minor issues not covered by PR #9137 (#9147)
• fef07fb internal: Split v3procservicepb import into pb and grpc for extproc (#9163)
• 91dd64f transport: surface subsequent data when receiving non-gRPC header (#8929)
• adc97de test/kokoro: add config for regional-td test (#9158)
• 57c9ff1 xds: ensure full-string matching for RBAC Filter rules (#9148)
• b58f32d server: Set a pprof label on new stream goroutines (#9082)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	2.71s
✅ REPOSITORY	betterleaks	yes		no	no	1.36s
✅ REPOSITORY	checkov	yes		no	no	19.2s
⚠️ REPOSITORY	devskim	yes		1	no	4.03s
✅ REPOSITORY	dustilock	yes		no	no	0.05s
✅ REPOSITORY	gitleaks	yes		no	no	11.05s
✅ REPOSITORY	git_diff	yes		no	no	0.07s
❌ REPOSITORY	grype	yes		4	no	65.89s
✅ REPOSITORY	kingfisher	yes		no	no	9.98s
⚠️ REPOSITORY	osv-scanner	yes		2	no	1.48s
✅ REPOSITORY	secretlint	yes		no	no	5.29s
✅ REPOSITORY	syft	yes		no	no	3.64s
❌ REPOSITORY	trivy	yes		1	no	11.53s
✅ REPOSITORY	trivy-sbom	yes		no	no	12.75s
✅ REPOSITORY	trufflehog	yes		no	no	5.25s

Detailed Issues

❌ REPOSITORY / grype - 4 errors

[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME                    INSTALLED  FIXED IN  TYPE       VULNERABILITY        SEVERITY  EPSS         RISK  
oras.land/oras-go/v2    v2.6.1               go-module  GHSA-fxhp-mv3v-67qp  High      0.4% (35th)  0.3   
golang.org/x/text       v0.38.0    0.39.0    go-module  GO-2026-5970         High      0.2% (12th)  0.2   
golang.org/x/net        v0.55.0    0.56.0    go-module  GO-2026-5942         High      0.2% (5th)   0.1   
google.golang.org/grpc  v1.82.0    1.82.1    go-module  GHSA-hrxh-6v49-42gf  High      N/A          N/A   
golang.org/x/crypto     v0.53.0              go-module  GO-2026-5932         Unknown   N/A          N/A
[0065] ERROR discovered vulnerabilities at or above the severity threshold

❌ REPOSITORY / trivy - 1 error

───────┼───────────────────┤
│ build/Dockerfile.config_exporter                 │ dockerfile │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docs/investigation/rbac/assets/clusterrole.yaml  │ kubernetes │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docs/investigation/rbac/assets/clusterrole2.yaml │ kubernetes │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ docs/investigation/rbac/assets/role.yaml         │ kubernetes │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/clusterrole.yaml          │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/clusterrolebinding.yaml   │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/communicationsecret.yaml  │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/deployment.yaml           │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/global-config.yaml        │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/persistent-config.yaml    │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/rbac-groups.yaml          │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/service.yaml              │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/serviceaccount.yaml       │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/system-config.yaml        │    helm    │        -        │         0         │
├──────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ helm/botkube/templates/systemroles.yaml          │    helm    │        -        │         0         │
└──────────────────────────────────────────────────┴────────────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


go.mod (gomod)
==============
Total: 5 (UNKNOWN: 3, LOW: 0, MEDIUM: 0, HIGH: 2, CRITICAL: 0)

┌────────────────────────┬─────────────────────┬──────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│        Library         │    Vulnerability    │ Severity │  Status  │ Installed Version │ Fixed Version │                            Title                            │
├────────────────────────┼─────────────────────┼──────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto    │ GO-2026-5932        │ UNKNOWN  │ affected │ v0.53.0           │               │ The golang.org/x/crypto/openpgp package is unmaintained,    │
│                        │                     │          │          │                   │               │ unsafe by design, and has known security...                 │
├────────────────────────┼─────────────────────┤          ├──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/net       │ CVE-2026-46600      │          │ fixed    │ v0.55.0           │ 0.56.0        │ Parsing an invalid SVCB or HTTPS RR can panic when the      │
│                        │                     │          │          │                   │               │ size...                                                     │
│                        │                     │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46600                  │
├────────────────────────┼─────────────────────┤          │          ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/text      │ CVE-2026-56852      │          │          │ v0.38.0           │ 0.39.0        │ A norm.Iter can enter an infinite loop when handling input  │
│                        │                     │          │          │                   │               │ containing ...                                              │
│                        │                     │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56852                  │
├────────────────────────┼─────────────────────┼──────────┤          ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc │ GHSA-hrxh-6v49-42gf │ HIGH     │          │ v1.82.0           │ 1.82.1        │ gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities                │
│                        │                     │          │          │                   │               │ https://github.com/advisories/GHSA-hrxh-6v49-42gf           │
├────────────────────────┼─────────────────────┤          ├──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ oras.land/oras-go/v2   │ CVE-2026-50163      │          │ affected │ v2.6.1            │               │ oras-go: Oras-go: Information disclosure and arbitrary file │
│                        │                     │          │          │                   │               │ access via crafted tarball hardlinks...                     │
│                        │                     │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-50163                  │
└────────────────────────┴─────────────────────┴──────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

test/go.mod (gomod)
===================
Total: 3 (UNKNOWN: 3, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

┌─────────────────────┬────────────────┬──────────┬──────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │  Status  │ Installed Version │ Fixed Version │                           Title                            │
├─────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ GO-2026-5932   │ UNKNOWN  │ affected │ v0.53.0           │               │ The golang.org/x/crypto/openpgp package is unmaintained,   │
│                     │                │          │          │                   │               │ unsafe by design, and has known security...                │
├─────────────────────┼────────────────┤          ├──────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ golang.org/x/net    │ CVE-2026-46600 │          │ fixed    │ v0.55.0           │ 0.56.0        │ Parsing an invalid SVCB or HTTPS RR can panic when the     │
│                     │                │          │          │                   │               │ size...                                                    │
│                     │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46600                 │
├─────────────────────┼────────────────┤          │          ├───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ golang.org/x/text   │ CVE-2026-56852 │          │          │ v0.38.0           │ 0.39.0        │ A norm.Iter can enter an infinite loop when handling input │
│                     │                │          │          │                   │               │ containing ...                                             │
│                     │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56852                 │
└─────────────────────┴────────────────┴──────────┴──────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.72.0 of Trivy is now available, current version is 0.71.2

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 10000 characters out of 15009)

⚠️ REPOSITORY / devskim - 1 error

92","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"internal/config/testdata/TestGetProvider/all.yaml"},"region":{"startLine":17,"startColumn":18,"endLine":17,"endColumn":27,"charOffset":383,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"internal/config/testdata/TestGetProvider/from-cli-flag-second.yaml"},"region":{"startLine":5,"startColumn":18,"endLine":5,"endColumn":27,"charOffset":74,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/notifier/bot.go"},"region":{"startLine":17,"startColumn":4,"endLine":17,"endColumn":8,"charOffset":487,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/discord.go"},"region":{"startLine":353,"startColumn":4,"endLine":353,"endColumn":8,"charOffset":10980,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/discord.go"},"region":{"startLine":188,"startColumn":3,"endLine":188,"endColumn":7,"charOffset":6161,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/discord.go"},"region":{"startLine":27,"startColumn":3,"endLine":27,"endColumn":7,"charOffset":588,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/slack_cloud.go"},"region":{"startLine":571,"startColumn":4,"endLine":571,"endColumn":8,"charOffset":18684,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/slack_cloud.go"},"region":{"startLine":349,"startColumn":7,"endLine":349,"endColumn":11,"charOffset":11675,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/formatx/space_table.go"},"region":{"startLine":28,"startColumn":3,"endLine":28,"endColumn":7,"charOffset":517,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/mattermost.go"},"region":{"startLine":358,"startColumn":4,"endLine":358,"endColumn":8,"charOffset":11218,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/mattermost.go"},"region":{"startLine":47,"startColumn":3,"endLine":47,"endColumn":7,"charOffset":1269,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/mattermost.go"},"region":{"startLine":28,"startColumn":3,"endLine":28,"endColumn":7,"charOffset":581,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/slack_socket.go"},"region":{"startLine":250,"startColumn":9,"endLine":250,"endColumn":13,"charOffset":8620,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/slack_socket.go"},"region":{"startLine":32,"startColumn":3,"endLine":32,"endColumn":7,"charOffset":769,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"examples/ingress-recommendations/ingress-overrides.yaml"},"region":{"startLine":28,"startColumn":28,"endLine":28,"endColumn":37,"charOffset":612,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"hack/target/serve-plugins/main.go"},"region":{"startLine":16,"startColumn":66,"endLine":16,"endColumn":75,"charOffset":334,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/branch-build.yml"},"region":{"startLine":16,"startColumn":27,"endLine":16,"endColumn":31,"charOffset":318,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS112852","level":"note","message":{"text":"Go - Hard-coded SSL/TLS Protocol"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/grpcx/credentials.go"},"region":{"startLine":47,"startColumn":39,"endLine":47,"endColumn":51,"charOffset":1393,"charLength":12,"snippet":{"text":"VersionTLS13","rendered":{"text":"VersionTLS13","markdown":"`VersionTLS13`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Cryptography.Protocol.TLS.Hard-Coded"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"internal/source/kubernetes/recommendation/ingress_backend_service_valid.go"},"region":{"startLine":59,"startColumn":7,"endLine":59,"endColumn":11,"charOffset":2041,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS162092","level":"note","message":{"text":"Do not leave debug code in production"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"pkg/bot/slack_renderer_test.go"},"region":{"startLine":50,"startColumn":30,"endLine":50,"endColumn":39,"charOffset":1426,"charLength":9,"snippet":{"text":"localhost","rendered":{"text":"localhost","markdown":"`localhost`"}},"sourceLanguage":"go"}}}],"properties":{"tags":["Hygiene.Network.AccessingLocalhost"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}}],"columnKind":"utf16CodeUnits"}]}

(Truncated to last 10000 characters out of 24930)

⚠️ REPOSITORY / osv-scanner - 2 errors

Scanning dir .
Starting filesystem walk for root: /
Scanned examples/src/go.mod file and found 9 packages
Scanned go.mod file and found 260 packages
Scanned test/go.mod file and found 167 packages
End status: 209 dirs visited, 904 inodes visited, 3 Extract calls, 57.01805ms elapsed, 57.01825ms wall time
Filtered 1 local/unscannable package/s from the scan.
Failed to run code analysis (govulncheck) on 'examples/src/go.mod' because govulncheck: loading packages: err: exit status 1: stderr: go: go.mod requires go >= 1.26.4 (running go 1.26.3; GOTOOLCHAIN=local)

(the Go toolchain is required)
Failed to run code analysis (govulncheck) on 'go.mod' because govulncheck: loading packages: err: exit status 1: stderr: go: go.mod requires go >= 1.26.4 (running go 1.26.3; GOTOOLCHAIN=local)

(the Go toolchain is required)
Failed to run code analysis (govulncheck) on 'test/go.mod' because govulncheck: loading packages: err: exit status 1: stderr: go: go.mod requires go >= 1.26.4 (running go 1.26.3; GOTOOLCHAIN=local)

(the Go toolchain is required)

Total 12 packages affected by 18 known vulnerabilities (0 Critical, 2 High, 0 Medium, 0 Low, 16 Unknown) from 1 ecosystem.
16 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+------------------------+---------+---------------+---------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE                | VERSION | FIXED VERSION | SOURCE              |
+-------------------------------------+------+-----------+------------------------+---------+---------------+---------------------+
| https://osv.dev/GO-2026-4961        |      | Go        | golang.org/x/image     | 0.41.0  | 0.42.0        | examples/src/go.mod |
| https://osv.dev/GO-2026-5061        |      | Go        | golang.org/x/image     | 0.41.0  | 0.43.0        | examples/src/go.mod |
| https://osv.dev/GO-2026-5062        |      | Go        | golang.org/x/image     | 0.41.0  | 0.43.0        | examples/src/go.mod |
| https://osv.dev/GO-2026-5066        |      | Go        | golang.org/x/image     | 0.41.0  | 0.43.0        | examples/src/go.mod |
| https://osv.dev/GO-2026-4970        |      | Go        | stdlib                 | 1.26.4  | 1.26.5        | examples/src/go.mod |
| https://osv.dev/GO-2026-5856        |      | Go        | stdlib                 | 1.26.4  | 1.26.5        | examples/src/go.mod |
| https://osv.dev/GO-2026-5932        |      | Go        | golang.org/x/crypto    | 0.53.0  | --            | go.mod              |
| https://osv.dev/GO-2026-5942        |      | Go        | golang.org/x/net       | 0.55.0  | 0.56.0        | go.mod              |
| https://osv.dev/GO-2026-5970        |      | Go        | golang.org/x/text      | 0.38.0  | 0.39.0        | go.mod              |
| https://osv.dev/GHSA-hrxh-6v49-42gf | 8.8  | Go        | google.golang.org/grpc | 1.82.0  | 1.82.1        | go.mod              |
| https://osv.dev/GO-2026-5880        | 7.1  | Go        | oras.land/oras-go/v2   | 2.6.1   | 2.6.2         | go.mod              |
| https://osv.dev/GHSA-fxhp-mv3v-67qp |      |           |                        |         |               |                     |
| https://osv.dev/GO-2026-4970        |      | Go        | stdlib                 | 1.26.4  | 1.26.5        | go.mod              |
| https://osv.dev/GO-2026-5856        |      | Go        | stdlib                 | 1.26.4  | 1.26.5        | go.mod              |
| https://osv.dev/GO-2026-5932        |      | Go        | golang.org/x/crypto    | 0.53.0  | --            | test/go.mod         |
| https://osv.dev/GO-2026-5942        |      | Go        | golang.org/x/net       | 0.55.0  | 0.56.0        | test/go.mod         |
| https://osv.dev/GO-2026-5970        |      | Go        | golang.org/x/text      | 0.38.0  | 0.39.0        | test/go.mod         |
| https://osv.dev/GO-2026-4970        |      | Go        | stdlib                 | 1.26.4  | 1.26.5        | test/go.mod         |
| https://osv.dev/GO-2026-5856        |      | Go        | stdlib                 | 1.26.4  | 1.26.5        | test/go.mod         |
+-------------------------------------+------+-----------+------------------------+---------+---------------+---------------------+

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

Show us your support by starring ⭐ the repository