chore(deps): weekly safe go updates · 1 package

[mendral-app]

Packages bumped

Package	Old	New	Published
google.golang.org/grpc	v1.80.0	v1.82.0	2026-06-30

Per-package detail

google.golang.org/grpc v1.80.0 → v1.82.0

Changelog highlights (v1.81.0 → v1.82.0):

• Telemetry callback API: NewContextWithLabelCallback for per-call metric labels
• Better HTTP error debugging: response body portion included in error messages for non-gRPC HTTP responses
• Server goroutine labels for pprof (GRPC_GO_SERVER_GOROUTINE_LABELS)
• Removed GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING env var (strict path validation is now always on)
• Case-sensitive balancer registry (revertible via env var)
• Memory leak fix in xds/server for HTTP filter instances during RDS updates
• Enforced MaxRecvMsgSize on decompressed message buffers
• Fixed retry attempts recording in stats/opentelemetry

Contextualized impact: This repo is an API definition library generating gRPC stubs. It doesn't implement gRPC servers, use custom balancers, or rely on xDS features. The behavioral changes (strict path enforcement, case-sensitive balancer registry) are irrelevant here. The upgrade is purely a transport/runtime improvement for downstream consumers. Go 1.25.5 meets the minimum Go 1.25 requirement. No code changes needed.

Files modified

• go.mod
• go.sum

Skipped this ecosystem

Package	Current	Reason
github.com/envoyproxy/protoc-gen-validate	v1.3.3	Already at latest
google.golang.org/protobuf	v1.36.11	Already at latest
go.uber.org/mock	v0.6.0	Already at latest
golang.org/x/net	v0.53.0	Updated transitively via grpc bump
golang.org/x/sys	v0.43.0	Updated transitively via grpc bump
golang.org/x/text	v0.36.0	Updated transitively via grpc bump

Note: Supersedes PR #2 (grpc v1.81.1) which can be closed once this merges.

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session

[cploujoux]

Closing this and every other open mendral dependency PR on the org.

These had accumulated to ~425 across 50+ repos, most of them superseded by a later run of the same weekly job, and a large share already in merge conflict. As a queue they were never going to be merged, and they were burying the alerts that actually matter under review noise.

Nothing is lost by closing them: the open Dependabot alerts remain the source of truth, and remediation is being done through dedicated, tested PRs per repo instead of bulk updates. Anything still genuinely vulnerable will be fixed there.