KannanandGitHub d2789d2365 Bump grpc to v1.79.3 and upgrade zlib to address security CVEs (#9611) ...

## Summary

Bumps dependencies to address security CVEs on `main`:

- **CVE-2026-33186 (CRITICAL)**: `google.golang.org/grpc` v1.72.2 →
v1.79.3 — authorization bypass via missing leading `/` in `:path` header
- **CVE-2026-22184 (HIGH)**: Alpine `zlib` 1.3.1-r2 → 1.3.2-r0 — global
buffer overflow in `untgz` utility

Note: The other two CVEs from the v1.30.2 security review are already
addressed on `main`:
- otel/sdk v1.40.0 — already landed via #9442
- Go stdlib — `main` is on Go 1.26.0 (separate release series)

## Risk assessment

- **grpc v1.72.2 → v1.79.3**: 7 minor version jump with ~23 transitive
dependency upgrades. Builds cleanly. Same bump successfully applied to
`release/v1.30.x` in #9610.
- **zlib**: Alpine package upgrade via `apk upgrade --no-cache zlib` in
both server and admin-tools Dockerfiles.

## Test plan

- [ ] CI passes


Made with [Cursor]()

2026-03-20 22:31:18 -07:00

..

scripts/sh

New Docker Build GH Actions (#8825)

2025-12-18 20:30:58 +00:00

targets

Bump grpc to v1.79.3 and upgrade zlib to address security CVEs (#9611)

2026-03-20 22:31:18 -07:00

config_template.yaml

Update Configuration Loading (#8477)

2025-11-18 16:23:25 +00:00

docker-bake.hcl

Add full SHA OSS image tags (#9448)

2026-03-16 16:39:25 -05:00