chore(deps): Update google.golang.org/grpc and ubi base image (main)

[simonbaird]

Update google.golang.org/grpc module dependency.

Version changes:

• acceptance/go.mod: v1.82.0 → v1.83.2
• go.mod: v1.82.0 → v1.83.2
• tools/go.mod: v1.82.0 → v1.83.2

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 8adafb33-7837-440f-bb22-fd827c07f60b

📥 Commits

Reviewing files that changed from the base of the PR and between 1cc50a7 and 629c54d.

📒 Files selected for processing (4)

• Dockerfile
• Dockerfile.dist
• acceptance/kubernetes/kind/acceptance.Dockerfile
• rpms.lock.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request refreshes Go module dependencies, container base image digests, and locked gzip RPM packages. It also removes an obsolete indirect Go tooling dependency from the kubectl module.

Changes

Dependency and build refresh

Layer / File(s)	Summary
Go module dependency updates go.mod, acceptance/go.mod, tools/go.mod, tools/kubectl/go.mod	The modules update CEL, networking, security, telemetry, SPIFFE, and gRPC dependencies. The kubectl module removes the obsolete indirect golang.org/x/tools entry.
Container base image pin updates Dockerfile, Dockerfile.dist, acceptance/kubernetes/kind/acceptance.Dockerfile	The Dockerfiles replace pinned UBI minimal image digests.
RPM lock refresh rpms.lock.yaml	The locked gzip package changes to version 1.12-2.el9_8 for four architectures.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: 🔵 Low · up to 629c5

The updated container images may leave SQLite below 3.53.2 in all three final images despite the package refresh, creating a bounded security-configuration risk. Verify or pin the fixed package before merging; the PR is otherwise mergeable with owner follow-up.

Suggested reviewers: st3penta

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description identifies the gRPC version changes but omits the required What, Why, and Tickets sections. It also omits the UBI base image and related security context described in the pull request …	Add the required What, Why, and Tickets headings. Describe the UBI base image update, explain the reason for the dependency and image changes, and link a related ticket or state that no ticket applies.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main changes: the gRPC dependency update and the UBI base image update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description identifies the gRPC version changes but omits the required What, Why, and Tickets sections. It also omits the UBI base image and related security context described in the pull request objectives.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Upgrade gRPC to v1.83.2 across Go modules

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Upgrade gRPC to v1.83.2 across root, acceptance, and tools modules.
• Refresh transitive Go dependencies and checksums for all affected module graphs.
• Align kubectl helper dependencies with the resolved shared Go ecosystem versions.

Diagram

graph TD
  H["Upgrade helper"] --> G["gRPC v1.83.2"] --> R["Go resolver"] --> M["Root module"]
  R --> A["Acceptance module"]
  R --> T["Tools module"]
  R --> K["Kubectl module"]
  M --> S["Checksums"]
  A --> S
  T --> S
  K --> S

Loading

High-Level Assessment

The current approach is appropriate: use the repository's module-upgrade helper, update gRPC consistently in every module that resolves it, and commit the resolver-selected transitive versions and checksums. Updating only the root module was considered but would leave acceptance and tooling graphs inconsistent.

Files changed (8) +114 / -115

Other (8) +114 / -115

go.modUpgrade acceptance-test gRPC dependency +8/-8

Upgrade acceptance-test gRPC dependency

• Raises gRPC from v1.82.0 to v1.83.2 in the acceptance module. Also records resolver-selected updates to CEL and golang.org/x transitive dependencies.

acceptance/go.mod

go.sumRefresh acceptance dependency checksums +18/-18

Refresh acceptance dependency checksums

• Replaces checksums for gRPC and the transitive dependency versions selected by the acceptance module.

acceptance/go.sum

go.modUpgrade root gRPC and transitive dependencies +12/-12

Upgrade root gRPC and transitive dependencies

• Raises gRPC to v1.83.2 and updates related networking, security, telemetry, SPIFFE, CEL, and Go tooling dependencies selected by module resolution.

go.mod

go.sumRefresh root module checksums +24/-24

Refresh root module checksums

• Updates integrity hashes for gRPC v1.83.2 and all newly resolved transitive dependency versions.

go.sum

go.modUpgrade tools module gRPC dependency +12/-12

Upgrade tools module gRPC dependency

• Raises gRPC to v1.83.2 in the tools module and aligns its transitive dependency graph, including Go libraries, telemetry detectors, SPIFFE, and CEL.

tools/go.mod

go.sumRefresh tools dependency checksums +24/-24

Refresh tools dependency checksums

• Replaces checksums for the upgraded gRPC release and resolver-selected transitive dependencies used by development tools.

tools/go.sum

go.modAlign kubectl transitive Go dependencies +4/-5

Align kubectl transitive Go dependencies

• Updates networking, system, terminal, text, and tooling dependencies to versions selected by the refreshed module graph. Removes the now-unneeded explicit indirect golang.org/x/tools requirement.

tools/kubectl/go.mod

go.sumRefresh kubectl dependency checksums +12/-12

Refresh kubectl dependency checksums

• Updates checksums for the kubectl helper module's aligned golang.org/x dependency versions.

tools/kubectl/go.sum

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:21 PM UTC · Completed 2:28 PM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.29

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can start a comment with 'qodo' or '@qodo' to chat about any finding

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

Review

Findings

High

• [protected-path] Dockerfile, Dockerfile.dist — These files are under the Dockerfile protected path prefix. The PR has no linked issue providing justification for modifying governance or infrastructure files. The changes update the UBI9 ubi-minimal base image digest (sha256:8eb2830d... → sha256:7fbeae18...), which is a routine dependency update, but human approval is always required for protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Looks good to me

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.46% <ø> (ø)
generative	12.27% <ø> (ø)
integration	23.59% <ø> (ø)
unit	72.21% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dheerajodha]

The Conforma check is still failing on last 2 vulnerabilities, both CVEs (CVE-2026-11822 and CVE-2026-11824) are SQLite FTS5 vulnerabilities fixed in SQLite 3.53.2. They're coming from the sqlite-libs package in the UBI 9 minimal base image, which is pinned to an old digest, and still needs to be updated.

I checked the latest UBI 9 minimal digest to see if it contains the latest sqlite-libs package:

% podman pull registry.access.redhat.com/ubi9/ubi-minimal:latest
Trying to pull registry.access.redhat.com/ubi9/ubi-minimal:latest...
Getting image source signatures
Checking if image destination supports signatures
Copying blob sha256:8289a871631249c9c1a3b2366de832716cd43c77864c245a1c1364a2abeb5704
Copying config sha256:19a5d5dc0e92607939d631511c68a3b399a200a3bfbe6a1dfe726549e1527ae0
Writing manifest to image destination
Storing signatures
19a5d5dc0e92607939d631511c68a3b399a200a3bfbe6a1dfe726549e1527ae0


% podman inspect registry.access.redhat.com/ubi9/ubi-minimal:latest --format '{{.Digest}}'
sha256:ef4cc5df86b558d28771321713685ba56413570c87a8d0767bad36c9eda054f3


% podman run --rm registry.access.redhat.com/ubi9/ubi-minimal:latest rpm -q sqlite-libs
sqlite-libs-3.34.1-11.el9_8.aarch64

Nope, its still using 3.34 version, we need >= 3.53.2 :(

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:56 PM UTC · Completed 3:08 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.17

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Routine dependency update PR (grpc v1.82.0 to v1.83.2 + UBI base image digest) with elevated Tier 1 signals from multiple dependency files (8) and protected paths (2 Dockerfiles), but low git history risk and no source code changes, resulting in a moderate overall risk.

[fullsend-ai-review]

See the review comment for full details.

[robnester-rh]

LGTM

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 3:36 PM UTC · Completed 3:48 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.32

[fullsend-ai-retro]

Retro: PR #3519 — chore(deps): Update google.golang.org/grpc and ubi base image

Timeline

1. Aug 26 14:20 — Simon Baird (human) opens PR with a single commit upgrading google.golang.org/grpc v1.82.0 → v1.83.2 across four Go modules (8 files).
2. Aug 26 14:20–14:28 — CodeRabbit (effort: trivial, risk: low), Qodo (no issues), and fullsend review agent (Run 1, fullsend-ai/agents@v0.37.0, $1.29) all review. The review agent dispatches correctness and style-conventions sub-agents — both return empty findings. No protected paths matched. APPROVED.
3. Aug 31 11:23 — dheerajodha (human) comments that the Conforma check is still failing on two SQLite FTS5 CVEs (CVE-2026-11822, CVE-2026-11824) because UBI 9 ships sqlite-libs 3.34, not the required ≥3.53.2.
4. Sep 1 14:54 — Simon force-pushes a second commit adding UBI base image digest updates to three Dockerfiles and rpms.lock.yaml.
5. Sep 1 14:55–15:08 — Fullsend review agent (Run 2, fullsend-ai/agents@v0.39.0, $2.17) re-reviews the expanded 12-file PR. Dockerfiles now match the REVIEW_PROTECTED_PATHS prefix. No linked issue found. Files a HIGH [protected-path] finding. CHANGES_REQUESTED.
6. Sep 1 15:34 — robnester-rh (human) approves with "LGTM", recognizing the changes as routine base image digest pin updates.
7. Sep 1 15:35 — Simon self-merges.

What went well

• Run 1 was correct and efficient — the agent correctly classified the go.mod-only changes as mechanical, dispatched sub-agents at trivial scope, and approved in ~8 minutes for $1.29.
• All CI checks passed on both iterations — tests, lint, CodeQL, stress benchmark, codecov.
• Risk assessment was reasonable — moderate (2/5) on Run 2, correctly noting elevated signals from dependency file count and protected paths but low structural risk.
• dheerajodha's human comment added valuable context about unresolved SQLite CVEs that no agent surfaced — a good example of human review providing domain-specific security context beyond diff analysis.

Key finding: protected-path false positive on Dockerfile digest updates

The review agent's Run 2 filed CHANGES_REQUESTED for a HIGH protected-path finding on Dockerfile and Dockerfile.dist. The actual changes were single-line base image digest swaps (sha256:8eb2830d... → sha256:7fbeae18...) — the most mechanical, lowest-risk type of Dockerfile modification possible. The agent acknowledged the changes were "routine" in its own finding text but was forced to escalate by the blanket rule: protected path touched + no linked issue = HIGH. The human reviewer immediately overrode this by approving.

Existing issues that cover this gap

This pattern is well-covered by existing proposals across three repos:

• conforma/cli #3503 — Proposes AGENTS.md documentation for the UBI base image bump workflow to prevent false-positive review findings. This retro provides additional evidence: the same false-positive pattern recurred on PR chore(deps): Update google.golang.org/grpc and ubi base image (main) #3519 after being identified on PR chore(deps): Update ubi-minimal base image (v0.8) #3499.
• conforma/cli #3502 — Proposes AGENTS.md guidance for UBI base image bump workflow and release branch scope.
• fullsend-ai/agents #741 — Proposes that the review agent assess semantic significance of protected-path changes before assigning high severity. This is the agent-layer fix that would prevent the false positive class across all repos, not just conforma/cli.
• fullsend-ai/agents #513 and #301 — Propose short-circuiting to a lightweight review mode after classifying a PR as a mechanical dependency bump, which would also reduce cost for this type of PR.

Autonomy assessment

For this class of change (go.mod/go.sum updates + Dockerfile digest pin swaps), the human review added no analytical findings beyond the agent — the human approved with bare "LGTM". The agent's first review (APPROVED for go.mod-only changes) was fully correct. The agent's second review was a false positive that the human had to override. This suggests that once fullsend-ai/agents#741 lands (diff-aware protected-path severity), the review agent could reliably auto-approve pure dependency digest updates without human friction.

Cost

Total review cost: $3.46 across two runs. Run 2 ($2.17) was more expensive due to the larger diff (12 files vs 8) but produced only a false positive. If fullsend-ai/agents#513 (lightweight path for mechanical changes) were implemented, Run 2 could be significantly cheaper.

Conclusion

No novel proposals are warranted. The single meaningful improvement opportunity (reducing false positives on mechanical Dockerfile changes) is already covered by existing issues at both the repo layer (#3502, #3503) and the agent layer (fullsend-ai/agents#741, #513, #301). This retro adds corroborating evidence for those existing proposals.