chore(deps): fix critical/high Dependabot alerts in toolkit

[devin-ai-integration]

Summary

Closes all 3 open critical/high Dependabot alerts in this repo: 3 alerts closed, 0 skipped, 0 blocked. Every alert is the same package — google.golang.org/grpc, an indirect dependency pulled in only by github.com/google/goexpect (used by test/integration/cli_create_tty_test.go). Nothing in the repo imports gRPC directly.

Bumping grpc from v1.31.0 (pre-protobuf-APIv2 era) to v1.82.1 forces two companion bumps, because grpc ≥ v1.62 requires APIv2 protoreflect-capable generated code:

• google.golang.org/protobuf v1.31.0 → v1.36.11
• google.golang.org/genproto v0.0.0-2019… (monolith) → split module google.golang.org/genproto/googleapis/rpc v0.0.0-20260729…

The genproto split matters: with only the 2019 monolith in the build list, grpc/internal/status failed to compile (*genproto/googleapis/rpc/status.Status does not implement protoreflect.ProtoMessage); adding the split module alone produced ambiguous import. Both had to move, after which go mod tidy dropped the monolith and the now-unused github.com/golang/protobuf. spf13/pflag lost its // indirect marker — it is genuinely direct (cli/core/sentry.go).

Alerts fixed

package	ecosystem	manifest	old → new	severity	GHSA / CVE	semver bump	breaking changes found	validation
google.golang.org/grpc (indirect)	Go	go.mod	v1.31.0 → v1.82.1	critical	GHSA-p77j-4mvh-x3m3 / CVE-2026-33186 (< 1.79.3)	minor (same major, 51 minors)	none affecting used APIs — goexpect only imports grpc/codes + grpc/status	go build ./..., go vet ./..., go test -count=1 ./..., make lint all pass
google.golang.org/grpc (indirect)	Go	go.mod	v1.31.0 → v1.82.1	high	GHSA-hrxh-6v49-42gf (< 1.82.1)	same as above	—	same
google.golang.org/grpc (indirect)	Go	go.mod	v1.31.0 → v1.82.1	high	GHSA-m425-mq94-257g (< 1.56.3)	same as above	—	same

Companion (non-alert) bumps required to compile: google.golang.org/protobuf v1.31.0 → v1.36.11, google.golang.org/genproto/googleapis/rpc added at v0.0.0-20260729162451-8efbd57d26e0, google.golang.org/genproto (monolith) and github.com/golang/protobuf removed.

v1.82.1 is the smallest version clearing all three advisories (max of the three first_patched_version values: 1.56.3, 1.79.3, 1.82.1).

Validation

1. Advisory check — v1.82.1 >= 1.82.1 > 1.79.3 > 1.56.3; outside every vulnerable_version_range. ✅
2. Semver — minor-series bump within major v1; no import-path change (/v2 not involved), so no code edits needed. ✅
3. Changelog review — pulled all 195 grpc-go releases (gh api /repos/grpc/grpc-go/releases --paginate) and scanned the bodies of all 112 releases in the (v1.31.0, v1.82.1] range for BREAKING|API Change|Behavior Change|removed|deprecat|renamed|no longer|migration|minimum version. Relevant findings:
   • v1.81.0: "Minimum supported Go version is now 1.25." — repo go.mod declares go 1.25.11, CI uses go-version: 1.25.x with check-latest: true. ✅
   • API removals: grpc.WithBalancerName (v1.46), grpc.WithServiceConfig (v1.60), resolver.ClientConn.NewServiceConfig (v1.60), resolver.Target.Endpoint field (v1.53), resolver.AddressType (v1.58), resolver.Target.Scheme/Authority (v1.57), Balancer.BuildOptions.MetricsRecorder (v1.71). None of these packages are imported anywhere in this repo or in goexpect.
   • v1.62.0: proto library switch — "github.com/golang/protobuf would error if given a nil message to Marshal" behavior change. Only reachable via proto marshalling, which this repo does not do.
   • v1.82.0: strict incoming RPC path validation can no longer be disabled; v1.67.0: TLS connections without ALPN rejected. Both are server/client-transport behaviors — the repo runs no gRPC client or server.
4. Static usage check — grep -rn "google.golang.org/grpc" --include=*.go . → zero hits in repo code. The only consumer is goexpect, which imports exactly google.golang.org/grpc/codes and google.golang.org/grpc/status (expect.go:24-25) — both untouched by any removal above. The repo's single goexpect call site uses expect.SpawnWithArgs(...) + expect.SetEnv(...), no gRPC surface at all.
5. Compile / vet — go build ./... ✅ ; go vet ./... ✅ (both clean; go mod tidy run afterwards).
6. Tests / lint — go test -count=1 ./... (the exact command from .github/workflows/unit-tests.yaml and make test): all unit packages ok. make lint (golangci-lint run): clean, no findings.
   • ./test/integration/... fails, but identically on unmodified origin/main — verified by running the same suite in a clean git worktree of origin/main: same 7 failures (TestCreateCommands_TTYAndNoTTY, TestCLIWorkflow_*), caused by permission denied for workspace "main" and missing --template / create-mcp-server CLI surface. Pre-existing and unrelated to this bump; these need live platform credentials (.github/workflows/integration-tests.yaml).
7. CI — monitored after opening this PR.

Not fixed

Nothing. All 3 open critical/high alerts are closed by this single bump. No alert lacked a patched version, no major bump was required, and no source-code changes were needed.

Notes for reviewers

Although semver-wise this is a minor bump, it spans 51 minor releases and drags protobuf runtime + genproto with it, so it is not being self-merged — gRPC/protobuf sit under a networking-adjacent dependency, so a human sign-off is requested even though the affected code path is confined to one integration test's process-spawning helper.

Link to Devin session: https://app.devin.ai/sessions/479cfb5d5091456295159c4f6c5c6608
Requested by: @cploujoux

---

Note

Bumps google.golang.org/grpc from v1.31.0 to v1.82.1 to resolve 3 critical/high Dependabot alerts, along with required companion bumps to google.golang.org/protobuf and the genproto split module. Removes the now-unused github.com/golang/protobuf and corrects spf13/pflag from indirect to direct.

^{Written by Mendral for commit 90fa1f5.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[mendral-app]

LGTM

Pure dependency bump with no application code changes. The spf13/pflag indirect→direct correction is verified (directly imported in cli/core/sentry.go). The genproto monolith→split-module migration and protobuf bump are the expected companions for grpc ≥1.62. No concerns.

_{Tag @mendral-app with feedback or questions. View session}