Fix gRPC vulnerabilities by upgrading to v1.83.2

[jonnguyen1]

What

Upgrade google.golang.org/grpc from v1.82.1 to v1.83.2 to remediate CVE-2026-84304 and CVE-2026-84445.

Align the existing golang.org/x/crypto, golang.org/x/net, and golang.org/x/sys replace pins with the dependency versions selected by the declared gRPC v1.83.2 module graph, so the replace directives do not silently force older effective versions.

Why v1.83.2

• CVE-2026-84304 is fixed in gRPC v1.83.1.
• CVE-2026-84445 is fixed in gRPC v1.82.2 and v1.83.2.
• v1.83.2 is the first release on the v1.83 line that contains both fixes.

Validation

• go test -count=1 ./...
• go build ./... on Windows
• Cross-build ./... for Linux AMD64 and Darwin AMD64
• TLS gRPC client/server tests in pkg/auth and pkg/certs passed twice with shuffled ordering
• go mod verify, repeated go mod tidy, and git diff --check
• API compatibility check found no removed or incompatible APIs in the five gRPC packages imported directly by this repository
• Confirmed all 136 tracked Go source files are unchanged
• govulncheck no longer reports the external x/net or x/text findings present before the aligned dependency update

Pre-existing checks

• go vet ./... reports two existing malformed test struct tags in pkg/config/config_test.go on both main and this branch.
• GolangCI-Lint reports the existing SA9003 finding in pkg/logging/redirectstderr_windows.go:29 on both main and this branch.
• Remaining govulncheck symbol findings come from the locally installed Go 1.26.5 standard library and require Go 1.26.6; they are unrelated to this dependency change.

Runtime compatibility notes

• gRPC v1.83.2 rejects requests missing both :authority and Host; standard grpc-go clients set :authority, and this repository's TLS client/server tests pass. Downstream proxy and E2E validation remains a required merge gate. The resulting symptom would contain no host or :authority header present.
• gRPC v1.83.x enables receive-buffer compaction by default. Upstream provides GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false as a temporary rollback lever if an unforeseen runtime issue is observed.
• This PR fixes the root moc module only. The other CG-listed MOC repositories require their own dependency updates before all alerts close.

Work items

• AB#39555341
• AB#39557235
• AB#39611143
• AB#39614100

Copilot Context

• Skills used: moc-developer, container-image-cve, pr-creation, and team-workitems
• Prompt: Validate the gRPC security bump in microsoft/moc first, then open a PR and assign the corresponding CG work items.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[jonnguyen1]

Copilot self-review

The rubber-duck review found no dependency-resolution or generated-stub incompatibility, but flagged the following review gates:

• HIGH: gRPC v1.83.2 now rejects requests missing both :authority and Host. The PR body now documents the symptom and keeps downstream proxy/E2E validation as a merge gate.
• MEDIUM: The ADO microsoft.moc build, protobuf-generation, lint, and static-analysis result has not appeared yet. The PR remains draft until that remote evidence is green.
• MEDIUM: Existing x/crypto, x/net, and x/sys replace directives can hide future upgrades. They remain aligned rather than removed in this focused CVE PR, matching the repository's current dependency pattern; removing obsolete replaces should be a separate cleanup.
• MEDIUM: Other CG-listed MOC repositories need separate dependency bumps before all alerts close. This PR is intentionally scoped to the root moc repository.
• LOW: gRPC receive-buffer compaction is default-on in v1.83.x. The PR body records the upstream temporary rollback environment variable.

No code amendment was required after review; commit remains 136df330aab4a72b5b87f7f5cec138f89f0cb8f5. Human reviewers should focus on the :authority behavior through downstream relay/proxy paths and the remote ADO validation result.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[jonnguyen1]

/azp run microsoft.moc

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).