fix: bump google.golang.org/grpc to v1.83.2 for security advisories

[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-09-28.
Change type: Minor/patch version bumps — manifest and lockfile changes, no source edits.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
google.golang.org/grpc	Go	Minor	1.79.3 → 1.83.2	High	65d	Dependabot, Wiz	GHSA-hrxh-6v49-42gf
google.golang.org/grpc	Go	Minor	1.79.3 → 1.83.2	High	26d	Dependabot, Wiz	GHSA-vp52-pcj8-j9qc / CVE-2026-84304
google.golang.org/grpc	Go	Minor	1.79.3 → 1.83.2	High	18d	Dependabot, Wiz	GHSA-2v4p-qf9q-27wj / CVE-2026-84445
google.golang.org/grpc	Go	Minor	1.79.3 → 1.83.2	Medium	18d	Dependabot, Wiz	GHSA-qc2q-p7wx-3px3 / CVE-2026-84303
golang.org/x/net	Go	Minor (transitive)	0.48.0 → 0.58.0	Medium	87d	Dependabot	GHSA-5cv4-jp36-h3mw / CVE-2026-25680

golang.org/x/net moved to 0.58.0 transitively (required by grpc 1.83.2); also golang.org/x/mod 0.32.0 → 0.38.0, otel 1.41.0 → 1.44.0.

Deferred / excluded findings

• Deferred to open Dependabot PR chore(deps): bump the go_modules group across 1 directory with 2 updates #68 (fully fixes, CI green) — github.com/antchfx/xpath 1.3.5 → 1.3.6 (High, GHSA-65xw-vw82-r86x). chore(deps): bump the go_modules group across 1 directory with 2 updates #68 also bumps golang.org/x/net.
• golang.org/x/mod 0.32.0 → 0.40.0 (0.x major) is in the separate devin/dep-vulns-major-batch/2026-09-28 PR.

Verification

• Install: ✅ go mod tidy (Go 1.25.7, matching CI)
• Build: ✅ go build ./..., go vet ./...
• Tests: ✅ go test ./...
• Lint: ⚠️ golangci-lint v2.6.2 locally: 1 pre-existing govet buildtag finding in apis/generate.go (file untouched by this PR)

Link to Devin session: https://app.devin.ai/sessions/cf588db3ed68460d87eaa49277057d90
Open in Devin Desktop: https://app.devin.ai/desktop/session/cf588db3ed68460d87eaa49277057d90?variant=devin

---

Note

Overview
This PR updates only go.mod and go.sum—no application source changes. It bumps google.golang.org/grpc from 1.79.3 → 1.83.2 to address multiple high/medium gRPC security advisories (including CVE-2026-84304, CVE-2026-84445, CVE-2026-84303).

Transitive versions move with that bump: golang.org/x/net 0.48.0 → 0.58.0 (CVE-2026-25680), plus aligned updates to OpenTelemetry (1.41.0 → 1.44.0), golang.org/x/mod, oauth2, sync, sys, term, text, tools, genproto, and related checksum entries in go.sum (e.g. cel.dev/expr, gonum).

^{Reviewed by Cursor Bugbot for commit 6c53f03. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring