fix(deps): vuln minor upgrades — 4 packages (minor: 4) [local_tests/golang/go.mod]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 4 packages upgraded (MINOR changes included)

Manifests changed:

• local_tests/golang/go.mod (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
google.golang.org/grpc	v1.80.0	v1.83.2	minor	Transitive	4 HIGH
github.com/valyala/fasthttp	v1.41.0	v1.73.0	minor	Transitive	1 UNKNOWN
golang.org/x/mod	v0.36.0	v0.40.0	minor	Transitive	2 UNKNOWN
golang.org/x/text	v0.38.0	v0.41.0	minor	Transitive	1 UNKNOWN

---

Security Details

🚨 Critical & High Severity (4 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
google.golang.org/grpc	GHSA-hrxh-6v49-42gf	HIGH	gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities	v1.80.0	1.82.1	-
google.golang.org/grpc	GO-2026-6061	HIGH	Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc	v1.80.0	1.82.1	-
google.golang.org/grpc	GHSA-vp52-pcj8-j9qc	HIGH	gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation	v1.80.0	1.83.1	-
google.golang.org/grpc	CVE-2026-84304	HIGH	gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation	v1.80.0	-	-

ℹ️ Other Vulnerabilities (4)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/valyala/fasthttp	GO-2026-4950	unknown	Authorization bypass via double-encoded paths in github.com/valyala/fasthttp	v1.41.0	1.70.0	-
golang.org/x/mod	GO-2026-6180	unknown	Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb	v0.36.0	0.40.0	-
golang.org/x/mod	GO-2026-6179	unknown	Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog	v0.36.0	0.40.0	-
golang.org/x/text	GO-2026-5970	unknown	Infinite loop on invalid input in golang.org/x/text	v0.38.0	0.39.0	-

⚠️ Dependencies that have Reached EOL (1)

Dependency	Unsafe Version	EOL Date	New Version	Path	Case
github.com/valyala/fasthttp	v1.41.0	Oct 25, 2025	v1.73.0	local_tests/golang/go.mod	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[datadog-datadog-prod-us1-2]

 

✨ Unblock PR with BitsAI

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 2 Pipeline jobs failed

DataDog/datadog-lambda-extension | e2e-test-status (amd64, fips) — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

DataDog/datadog-lambda-extension | e2e-test-status (amd64)

View more details · View in GitLab

ℹ️ Info

🔄 Datadog auto-retried 3 jobs - 2 passed on retry

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: d2d2f56 | Docs | View more details | Give us feedback!}

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with main — rebased onto 2c6ac4b.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}