fix(deps): upgrade grpc and x/crypto

[plural-copilot]

Summary

Updates the Go dependency graph used to build the console image's /usr/local/bin/plural binary. This image finding is remediated in pluralsh/plural-cli, where the root module is built as ./cmd/plural by Dockerfile.

Vulnerability remediation

• CVE-2026-84304: google.golang.org/grpc v1.82.1 → v1.83.1
• CVE-2026-78662: golang.org/x/crypto v0.55.0 → v0.56.0
• CVE-2026-56855: golang.org/x/crypto v0.55.0 → v0.56.0

Changed files and root cause

• go.mod: updates the two direct dependency constraints that selected the vulnerable versions.
• go.sum: refreshes only the corresponding module checksums.

Dockerfile already builds ./cmd/plural from this root module. The vulnerable library versions were explicitly required by the root module, so updating those constraints makes the module graph used for the CLI binary resolve to the patched versions. No Dockerfile, GitOps, or image-tag changes are included.

Verification

Run in a Git-enabled golang:1.26.6-alpine3.24 container (the repository Dockerfile's Go version):

• go mod verify — passed
• go list -m all — resolved google.golang.org/grpc v1.83.1 and golang.org/x/crypto v0.56.0
• go mod graph — confirmed root-module edges to both patched versions
• go list -deps ./cmd/plural — passed
• go test ./cmd/command/crypto ./pkg/crypto ./cmd/command/cd — passed
• CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -buildvcs=false -o /tmp/plural ./cmd/plural — passed
• go mod tidy and git diff --check — passed

Deployment note

No GitOps tag bump is included. After merge, a rebuilt and published console image tag containing this updated /usr/local/bin/plural binary must be deployed separately.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create exactly one remediation PR in pluralsh/plural-cli for the Go dependency vulnerabilities detected in the mgmt/console service's console image. The image contains /usr/local/bin/plural, so this is the authoritative source repository for these findings—not pluralsh/console....
🔗 Run history	View run history

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​crypto@​v0.55.0 ⏵ v0.56.0	+1
	google.golang.org/​grpc@​v1.82.1 ⏵ v1.83.1	+1	+16

View full report

[greptile-apps]

Greptile Summary

Updates the root Go module to patched releases of gRPC and x/crypto, with corresponding checksum updates.

• Upgrades golang.org/x/crypto from v0.55.0 to v0.56.0.
• Upgrades google.golang.org/grpc from v1.82.1 to v1.83.1.
• Refreshes only the associated go.sum entries.

Confidence Score: 5/5

The dependency-only change appears safe to merge, with no concrete changed-code failure identified.

The manifest and checksum changes consistently select the intended patched gRPC and x/crypto releases, while the unrelated containerd advisories concern an unchanged indirect dependency with no reachable CRI checkpoint path in the CLI.

Important Files Changed

Filename	Overview
go.mod	Upgrades the two direct dependency constraints to the intended patched versions; no actionable compatibility or reachability issue was identified.
go.sum	Replaces only the checksums associated with the two upgraded module versions.

_{Reviews (1): Last reviewed commit: "fix(deps): upgrade grpc and x/crypto" | Re-trigger Greptile}