deps: bump grpc 1.83.2 + x/crypto 0.56.0 (GHSA-vp52-pcj8-j9qc, GO-2026-6354/6355)

[Cre-eD]

Summary

Closes the open OpenSSF Scorecard Vulnerabilities finding, plus two reachable
x/crypto/ssh advisories that CI surfaced on the first run of this branch.

Severity	Fixed	Deferred	Unfixable
HIGH	1	0	0
MEDIUM (govulncheck, unscored)	2	0	0
CRITICAL / LOW	0	0	1 (pre-existing, VEXed)

Fixed

Package	Old -> New	Advisory	Reachable?	Source
google.golang.org/grpc	1.82.1 -> 1.83.2	GHSA-vp52-pcj8-j9qc / CVE-2026-84304, HIGH	linked, on deploy path	Scorecard, osv.dev
golang.org/x/crypto	0.55.0 -> 0.56.0	GO-2026-6355 + GO-2026-6354	called (trace below)	govulncheck CI gate

1. grpc — heap exhaustion via DATA-frame fragmentation

An unauthenticated remote peer opens a gRPC stream and fragments its payload into
millions of 1-byte HTTP/2 DATA frames. Every fragment carries its own tracking-struct
and queue allocation, so heap use scales with frame count, not payload bytes -- the
total stays inside the connection and stream flow-control windows while the runtime
OOMs. Multiplexed across concurrent streams that is a remote DoS.

Upstream fixed it in 1.83.1 with receive-buffer compaction (consecutive small buffers
coalesce from a shared pool). 1.83.2 is current stable, so this takes the newer one.

Reaches us indirectly, through the Pulumi SDK's gRPC transport:

$ go mod why -m google.golang.org/grpc
github.com/simple-container-com/api/pkg/api
github.com/pulumi/pulumi/sdk/v3/go/pulumi
google.golang.org/grpc

Every provision/deploy talks to the Pulumi engine over that channel.

MVS collateral: grpc 1.83.2's own go.mod pulled four transitive companions
forward. All patch/minor, none are lint or codegen tooling, so no golangci-lint /
staticcheck analysis-API fallout:

• cel.dev/expr 0.25.1 -> 0.25.2
• github.com/spiffe/go-spiffe/v2 2.6.0 -> 2.7.0
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp 1.32.0 -> 1.33.0
• go.opentelemetry.io/contrib/detectors/gcp 1.43.0 -> 1.44.0

2. x/crypto/ssh — two channel-deadlock DoS advisories

Not caused by this branch -- main also pins 0.55.0. The advisories were published
after the last green run, so this PR is simply the first build to see them. They are
included here rather than split off because the govulncheck gate is required and
would block on them regardless.

govulncheck rates both called, not merely present:

Vulnerability #1: GO-2026-6355   Prevent DoS on deadlocked established channel
Vulnerability #2: GO-2026-6354   Prevent DoS on deadlocked undecided channel
  Module: golang.org/x/crypto   Found in: v0.55.0   Fixed in: v0.56.0
  Example traces found:
    #1: pkg/clouds/pulumi/provision.go:100:50:
        pulumi.prepareStackForOperations calls auto.UpsertStackInlineSource,
        which eventually calls ssh.NewClientConn

That is git+ssh stack-source cloning inside UpsertStackInlineSource. A hostile or
compromised git remote can wedge the SSH connection. Fixed in 0.56.0; one line each in
go.mod and go.sum, no MVS collateral.

Deferred to devs (breaking changes)

None. Both are drop-in bumps, no app-side code change.

Unfixable (no patched version yet)

GO-2026-5932 -- golang.org/x/crypto/openpgp is unmaintained and unsafe by design,
Fixed in: N/A. Module-level only; govulncheck's symbol scan does not place it on any
call path. Already carried as a not_affected statement in vex/openvex.json, and
re-confirmed still valid this pass (upstream still ships no fix; it survives the
x/crypto 0.56.0 bump unchanged).

VEX re-triage

vex/openvex.json carries 3 pre-existing not_affected statements:

Statement	Action this pass
GO-2026-5932 (x/crypto/openpgp unmaintained)	re-confirmed -- still Fixed in: N/A at x/crypto 0.56.0
GO-2022-0635	carried forward unchanged, unrelated to this pass
GO-2022-0646	carried forward unchanged, unrelated to this pass

No statement was added for any advisory in this PR -- all three are fixed, not
suppressed.

Dependabot reconciliation

No open Dependabot PR touches google.golang.org/grpc or golang.org/x/crypto, so
nothing to supersede or rebase onto. The repo's Dependabot alert API returned 403 for
the token used here, so alert state was cross-checked against Trivy, govulncheck and
osv.dev rather than the alert list. Any matching alert should auto-close once this
lands on main.

Evidence

Source scan -- trivy fs --scanners vuln --severity CRITICAL,HIGH,MEDIUM,LOW (0.69.0)

0 findings across all severities (targets: go.mod, go.sum)

Re-run after each of the two bumps; clean both times.

govulncheck -- module mode, after the x/crypto bump

=== Module Results ===

Vulnerability #1: GO-2026-5932
    The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design,
    and has known security issues
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.56.0
    Fixed in: N/A

The two ssh advisories are gone; only the already-VEXed openpgp entry remains.
The reachability-aware symbol scan runs on the CI gate.

Advisory range check -- grpc

$ curl -s https://api.osv.dev/v1/vulns/GHSA-vp52-pcj8-j9qc | jq '.affected[0].ranges'
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.83.1"}]}]

$ go list -m -versions google.golang.org/grpc | tr ' ' '\n' | tail -4
v1.83.0
v1.83.1
v1.83.2      <- selected
v1.84.0-dev

1.82.1 is inside [0, 1.83.1); 1.83.2 is outside it.

Test plan

• go mod tidy clean after each bump; go.sum regenerated and committed.
• GOMEMLIMIT=3GiB go build -p 2 ./... -- exit 0 after both bumps, no compile errors
  from the four transitive grpc companions or from the x/crypto minor.
• trivy fs -- 0 findings at every severity.
• govulncheck -scan=module -- only the pre-existing, VEXed openpgp entry remains.
  The symbol-mode reachability verdict comes from the CI gate (source mode peaks past
  local memory on this module).

[github-actions]

Semgrep Scan Results

Repository: api | Commit: de33806

Check	Status	Details
⚠️ Semgrep	Warning	2 warning(s), 6 total

Scanned at 2026-09-06 20:06 UTC

[github-actions]

Security Scan Results

Repository: api | Commit: de33806

Check	Status	Details
✅ Secret Scan	Pass	No secrets detected
✅ Dependencies (Trivy)	Pass	1 total (no critical/high)
✅ Dependencies (Grype)	Pass	1 total (no critical/high)
📦 SBOM	Generated	523 components (CycloneDX)

Scanned at 2026-09-06 20:07 UTC

[github-actions]

📊 Statement coverage

Measured on the documented included set (see docs/TESTING.md → Coverage scope). Observe-only — no regression gate is enforced yet.

Scope	This PR	main baseline	Δ
Included set (Gold-tier denominator)	90.5%	90.5%	+0.0 pp
Full set (whole repo, transparency)	29.1%	29.1%	+0.0 pp

Baseline: main @ fccdc83