deps: bump google.golang.org/grpc to v1.83.2

[iurii-ssv]

Stacked on #3071.

Bumps google.golang.org/grpc v1.79.1 → v1.83.2, the first version that clears every grpc advisory reported against v1.79.1:

Advisory	Issue	Fixed in
GO-2026-4762	auth bypass via missing leading / in :path	1.79.3
GO-2026-6061	xDS RBAC + HTTP/2 server issues	1.82.1
GO-2026-6348	OOM via fragmented HTTP/2 DATA frames	1.83.1
GO-2026-6441	xDS RBAC header-match bypass	1.83.1
GO-2026-6443	server panic when :authority/Host are missing	1.82.2 / 1.83.2

v1.84.0 contains the same fixes, but the Go vuln DB still lists it as affected by GO-2026-6443, so govulncheck would keep flagging it. v1.83.2 is clean in both the Go DB and GHSA.

Exposure

grpc is only an indirect dependency, pulled in by the OTel OTLP gRPC exporters. Tracing is opt-in (EnableTraces), and the other end is the operator's own collector. Most of these advisories affect gRPC servers (xDS, HTTP/2 server), which we don't run. So this is low urgency, mainly to keep scanners quiet.

Why stacked on #3071

grpc v1.83.x requires otel/sdk ≥ v1.44.0. Without #3071's matching semconv move, resource.Default() switches to schema 1.41.0 while observability/resources.go stays on semconv v1.39.0, and buildResources fails at startup with conflicting Schema URL (the #3020 failure mode). On top of #3071 (otel v1.45.0 + semconv v1.43.0), go get changes nothing in OTel.

Side effects (MVS)

golang.org/x/{crypto 0.55.0, net 0.58.0, text 0.41.0, mod, sync, term, tools, telemetry}, genproto and gonum. Bonus: x/net 0.58.0 clears GO-2026-5025..5030 and GO-2026-5942, and x/crypto 0.55.0 clears GO-2026-6303. Those are still open on #3071's x/net 0.54.0 / x/crypto 0.52.0. Only go.mod/go.sum change, no code changes.

Verification

• go mod tidy makes no further changes (root and ssvsigner); build and vet pass.

• observability/... tests pass, including TestBuildResources and TestInitializeProvider_MeasurementReachesScrape from deps: security bumps (x/crypto, otel/sdk, chi) #3071.

• golangci-lint and the root unit tests pass on top of the follow-up PR stacked on this one, which is a superset of this change. The exceptions are three mDNS-based network tests, which fail the same way on unmodified stage in my local sandbox; CI covers those.

• E2E passed - [action log](put link here)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.7%. Comparing base (a3ccb4c) to head (3ba8990).

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[greptile-apps]

Confidence Score: 5/5

[High risk] Updates gRPC and related Go standard library dependencies.

This dependency-only PR appears safe to merge; no actionable regression was found.

What we checked:

• Resource schema stays unchanged: This PR does not change otel/sdk or the semconv import used by buildResources, so it does not introduce that version mismatch.

Summary

Updates google.golang.org/grpc from v1.79.1 to v1.83.2 and raises related dependencies.

• Changes only go.mod and go.sum.
• Keeps the existing OTel SDK version and resource schema import.
• No actionable issue caused by this PR was found. Builds and tests were not run during this review.

_{Reviews (1) · Last reviewed commit: "deps: bump google.golang.org/grpc to v1...." · Reviewed by Greptile}

The merge-base changed after approval.