chore: bump google.golang.org/grpc to v1.82.1 for GO-2026-6061

[hatayama]

Summary

• Clear govulncheck finding GO-2026-6061 by raising transitive google.golang.org/grpc from v1.82.0 to v1.82.1 across the CLI Go modules.

User Impact

• No product behavior change. Unblocks Go CLI Security Analysis on v3-beta PRs (including feat: configurable compile wait timeout and working timeout recovery #2036) that currently fail solely on this dependency.

Changes

• go get google.golang.org/grpc@v1.82.1 && go mod tidy in cli/dispatcher and cli/release-automation (attestation / sigstore path).
• Workspace sync also moves golang.org/x/sys in cli/common and cli/project-runner to the selected MVS version; stamps refreshed via scripts/stamp-release-inputs.sh.
• cli/dispatcher/go.mod grows because go mod tidy now materializes previously omitted indirect requires from the sigstore graph (same expansion happens from tidy alone on current Go).

Verification

• govulncheck ./... in all four modules: no called vulnerabilities (workspace and GOWORK=off).
• scripts/check-go-cli.sh passed.

Note

Independent of #2032 / #2036. After this merges, #2036 should merge origin/v3-beta to clear the remaining red check.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a9a82c3c-2bc8-4c47-ac94-3406e1a4d33b

📥 Commits

Reviewing files that changed from the base of the PR and between 5aa4ac7 and 30c573a.

⛔ Files ignored due to path filters (8)

• cli/common/go.mod is excluded by none and included by none
• cli/common/go.sum is excluded by !**/*.sum and included by none
• cli/dispatcher/go.mod is excluded by none and included by none
• cli/dispatcher/go.sum is excluded by !**/*.sum and included by none
• cli/project-runner/go.mod is excluded by none and included by none
• cli/project-runner/go.sum is excluded by !**/*.sum and included by none
• cli/release-automation/go.mod is excluded by none and included by none
• cli/release-automation/go.sum is excluded by !**/*.sum and included by none

📒 Files selected for processing (2)

• cli/dispatcher/shared-inputs-stamp.json
• cli/project-runner/shared-inputs-stamp.json

---

📝 Walkthrough

Walkthrough

The pull request updates the sharedInputsHash values in the dispatcher and project runner stamp files.

Changes

Shared input stamp updates

Layer / File(s)	Summary
Update shared input hashes cli/dispatcher/shared-inputs-stamp.json, cli/project-runner/shared-inputs-stamp.json	Replaces the existing sharedInputsHash values with new hash strings in both CLI stamp files.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main change: bumping grpc to v1.82.1 to address GO-2026-6061.
Description check	✅ Passed	The description matches the changeset and explains the grpc vulnerability fix, related module updates, and refreshed stamps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/bump-grpc-1.82.1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}