fix(workspace): force google.golang.org/grpc v1.83.2 to patch CVE-2026-84304/84303/84445

[davidcollom]

Problem

Three open Dependabot security alerts for gRPC-Go:

• deps: bump the kube group with 4 updates #67 — CVE-2026-84304 / GHSA-vp52-pcj8-j9qc — Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
• deps: bump the istio group with 2 updates #69 — CVE-2026-84303 / GHSA-qc2q-p7wx-3px3 — xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
• deps: bump the argo group across 1 directory with 3 updates #70 — CVE-2026-84445 / GHSA-2v4p-qf9q-27wj — gRPC-Go xDS servers DoS via missing :authority and Host headers

Root cause

google.golang.org/grpc is not a direct dependency of any pkg/*/go.mod — it is purely transitive, pulled in by linkerd2 v0.5.1-… (pinning grpc v1.81.1), cert-manager v1.21.2, argo-cd v3.6.0-rc2, etc. Dependabot had no single go.mod it could bump, so the alerts stayed open.

Per the GitHub Advisory DB the minimum stable gRPC that patches all three is v1.83.2 (CVE-2026-84304/84303 first patched in 1.83.1; CVE-2026-84445's >= 1.83.0, < 1.83.2 range first patched in 1.83.2).

Fix

Add a workspace-wide replace in go.work:

replace (
    k8s.io/api => k8s.io/api v0.37.0
    ...
    google.golang.org/grpc => google.golang.org/grpc v1.83.2   // <-- this PR
)

go list -m confirms the resolution in both modules that actually load gRPC:

module	resolved
pkg/linkerd	google.golang.org/grpc v1.84.0 => v1.83.2
pkg/argo/workflows	google.golang.org/grpc v1.84.0 => v1.83.2

The other 11 modules don't actually link google.golang.org/grpc in their compile graphs (they use the REST client), so the go.work replace is a no-op for them — but the workspace-level Dependabot alerts are now closed.

Verification

• go vet ./... in pkg/linkerd → exit 0
• go build ./... in pkg/linkerd → exit 0
• go mod download in every workspace module → clean

Notes

• go work sync itself fails on this repo because of a pre-existing argo-cd v0.0.0 staging-placeholder issue (the existing go.work comment explains the workaround). That's unrelated to this fix and works fine for CI.
• The pkg/argo/*/go.sum files are unchanged in this PR — they were already at the patched gRPC version (Dependabot had previously marked the same CVEs as fixed in those manifests).
• The 3 linkerd2 bumps from the original 10-PR merge (deps: bump the all group in /pkg/utils with 2 updates #157–deps: bump the all group in /pkg/argo/workflows with 3 updates #166) are not touched here; the pkg/linkerd replace for sigs.k8s.io/gateway-api v1.0.0 (from PR fix(pkg/linkerd): force gateway-api v1.0.0 to fix vet/lint after linkerd2 bump #167) is preserved.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T08:10:54.813545Z	5f72f34	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f72f3483d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pin gRPC in the published Linkerd module

When consumers import pkg/linkerd as a released module, their Go command does not read this repository's go.work, so this replacement never reaches them; because pkg/linkerd/go.mod remains unchanged and has no gRPC requirement, its dependency graph can still select Linkerd's vulnerable pre-1.83.2 version. Add the minimum safe requirement to the affected module's go.mod rather than relying solely on a workspace replacement.

AGENTS.md reference: AGENTS.md:L38-L38

Useful? React with 👍 / 👎.

[Copilot]

🟡 Changes recommended

The workspace pin does not protect standalone consumers, and several module checksum files do not match their declared requirements.

1 open finding

• Workspace gRPC override does not patch the released linkerd module · New

What changed in this PR

Pins transitive gRPC to v1.83.2 to address three reported CVEs and refreshes Go module checksums.

Changes:

• Adds a workspace-wide gRPC replacement.
• Refreshes dependency checksum files.
• Removes obsolete root checksums.

File	Summary
go.work	Adds the gRPC v1.83.2 replacement; standalone consumers still require a module-level requirement.
go.sum	Removes obsolete root checksums.
pkg/​velero/​go.sum	Updates checksum entries; requires matching module graph updates.
pkg/​utils/​go.sum	Updates checksum entries; requires matching module graph updates.
pkg/​linkerd/​go.sum	Updates checksum entries; requires matching module graph updates.
pkg/​k8s/​go.sum	Updates checksum entries; requires matching module graph updates.
pkg/​istio/​go.sum	Updates checksum entries; requires matching module graph updates.
pkg/​flux/​go.sum	Updates checksum entries; requires matching module graph updates.
pkg/​externalsecrets/​go.sum	Updates checksum entries; requires matching module graph updates.
pkg/​certmanager/​go.sum	Updates checksum entries; requires matching module graph updates.

🧠 Review effort: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.