fix(deps): bump grpc to v1.82.1 for mgmt/console

[plural-copilot]

Summary

• bump google.golang.org/grpc in pluralsh/plural-cli from v1.82.0 to v1.82.1
• remediate advisory GHSA-hrxh-6v49-42gf with the minimal dependency-only change
• regenerate module checksums in go.sum

Why this repo is the remediation point

The live vulnerable image is ghcr.io/pluralsh/console:sha-08f96c1, but the scanner attributed the issue to /usr/local/bin/plural inside that image. Per the environment mapping for console-image Go vulnerabilities, fixes for the embedded plural CLI binary are made in pluralsh/plural-cli, not pluralsh/console.

Vulnerability details

• Advisory: GHSA-hrxh-6v49-42gf
• Package: google.golang.org/grpc
• Vulnerable version on default branch before this change: v1.82.0
• Fixed version in this PR: v1.82.1

Validation

• go mod tidy in golang:1.26.5
• go build -buildvcs=false ./cmd/plural in golang:1.26.5
• started go test ./... in golang:1.26.5 (no failure output captured before session timeout)

Runtime remediation note

After this PR merges, the console image must be rebuilt and published so the embedded /usr/local/bin/plural binary picks up google.golang.org/grpc v1.82.1 or newer in production.

Plural Service: mgmt/console

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Inspect the default branch of pluralsh/plural-cli and remediate the only in-scope fixable vulnerability for Plural Service mgmt/console....
🔗 Run history	View run history

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	google.golang.org/​grpc@​v1.82.0 ⏵ v1.82.1	+1	+16

View full report

[greptile-apps]

Greptile Summary

This PR bumps google.golang.org/grpc from v1.82.0 to v1.82.1 in both go.mod and go.sum to remediate security advisory GHSA-hrxh-6v49-42gf.

• go.mod: single-line version bump of the direct grpc dependency.
• go.sum: the module source hash is updated to the v1.82.1 digest; the go.mod hash is identical to v1.82.0, which is expected for a patch release that only changes source code.

Confidence Score: 5/5

Minimal, targeted dependency patch with no logic changes — safe to merge.

The change is limited to replacing two lines in go.mod and two lines in go.sum. No application code is touched, and the patch-level grpc bump carries no API changes, so there is no risk of behavioral regression.

No files require special attention.

Important Files Changed

Filename	Overview
go.mod	Single line change bumping google.golang.org/grpc from v1.82.0 to v1.82.1 to remediate GHSA-hrxh-6v49-42gf
go.sum	Checksum entries updated to reflect new grpc v1.82.1 hash; go.mod hash is unchanged (expected for a patch release with identical module metadata)

_{Reviews (1): Last reviewed commit: "fix(deps): bump grpc to v1.82.1" | Re-trigger Greptile}