build(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1

[dependabot]

Bumps google.golang.org/grpc from 1.83.0 to 1.83.1.

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.1

Security

• xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)
  • Special Thanks: @​alimony

Performance

• transport: Restrict memory overhead of buffering small data frames. (#9331)

Commits

• 1550d9e Change version to 1.83.1 (#9336)
• ebba6f3 Cherry-pick #9258 and #9332 into v1.83.x (#9335)
• 8cfeca0 Cherry-pick #9331 to v1.83.x (#9333)
• dec6951 Change version to 1.83.1-dev (#9229)
• See full diff in compare view

[github-actions]

Bomly Diff Summary

Compared 967533f506893cfe674b953655e1ece1513062cf to a7ae7d70a655544ff02444f53c2bfedd82d77cca.

Overview

Status	Manifests	Dependencies	Findings	Duration
✅ Pass	+0 / ~1 / -0	0 added / 1 version changed / 0 detail changes / 0 removed	0 introduced / 0 persisted / 1 resolved	1m 23s

Dependency Changes

Summary: 0 added, 1 version changed, 0 detail changes, 0 removed.

Changed Dependencies

Change	Package	Version	Direct?	Scope	Licenses
changed	google.golang.org/grpc	v1.83.0 → v1.83.1	Yes	runtime	Apache-2.0

Vulnerabilities

Summary: 0 introduced, 0 persisted, 1 resolved.

Resolved Vulnerabilities

Change	Severity	ID	Package	Fixed In	Source	Title
resolved	HIGH	GHSA-vp52-pcj8-j9qc	google.golang.org/grpc@v1.83.0	1.83.1	grype	gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

License Changes

✅ No license changes.

Project Posture

✅ No project posture changes (--matchers +scorecard was not selected).

Policy Findings

Summary: 0 introduced, 0 persisted, 1 resolved.

Resolved Findings

	Status	Category	Severity	ID	Package	Fixed In	Title
✅	resolved	vulnerability	HIGH	GHSA-vp52-pcj8-j9qc	google.golang.org/grpc@v1.83.0	1.83.1	gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Legend: ✅ resolved · ❌ failing · ⚠️ warning