fix(deps): bump grpc to 1.82.1 and refresh OS packages

[hannavigil]

The scheduled Trivy scan on main has been red since 2026-07-21 on unchanged code (47cb6c85 the whole time). What moved is the CVE feed, not axon.

Counts drift daily — the 07-29 run had 17 findings, the 07-30 run has 23 (six new linux-libc-dev CVEs overnight). So this is stated per group:

Group	07-30 run	Fixed here
linux-libc-dev	16	✅ all of them, one apt refresh
google.golang.org/grpc	1	✅
brace-expansion	4	❌ not in this repo
axios	1	❌
engine.io	1	❌
	23	17 covered · 6 left

OS packages — the fix was already in the archive

The APT_CACHE_BUST ARG documents this exact remedy; the layer had been cache-served since 2026-07-14. Verified rather than assumed:

$ docker run --rm debian:stable-slim apt-cache policy linux-libc-dev
  Candidate: 6.12.96-1
     6.12.96-1 500 http://deb.debian.org/debian-security stable-security/main
     6.12.95-1 500 http://deb.debian.org/debian-security stable-security/main   ← shipping

and after a real upgrade in a fresh layer:

$ apt-get update && apt-get upgrade -y && apt-get install -y build-essential
$ dpkg-query -W linux-libc-dev
linux-libc-dev  6.12.96-1

One refresh covers every one of them. I checked the fixed version on all ~190 currently-open linux-libc-dev alerts, not just the 16 that gate CI: every single one reports installed 6.12.95-1 → fixed 6.12.96-1, including the six that appeared on 07-30. None needs a version beyond what stable-security already has.

Also confirmed docker.yml passes only BUILD_VERSION in build-args, so the Dockerfile default is what buildx keys the layer on — editing it does invalidate the cache.

Worth flagging: these are kernel headers, pulled in by build-essential in the runtime stage. Containers use the host kernel, so they aren't exploitable in the shipped image. The durable fix is to stop shipping build-essential at runtime — but scaffold apps build on top of this image, so that's a larger change than a vuln pass should make.

grpc — the previous fix aged into the affected range

GHSA-hrxh-6v49-42gf affects grpc through 1.82.0. agent/go.mod sat at v1.79.3 — the version #92 moved to in March to clear CVE-2026-33186.

I bumped every module that declares grpc, not only the one Trivy sees, because #92 fixed agent alone and left scaffold/go/axon_client behind for dependabot to catch in #93.

Module	Was	Now	Verified by
agent	v1.79.3	1.82.1	make setup proto + make test → 176 PASS / 0 FAIL, 12 packages
sdks/go	v1.68.0	1.82.1	make test → 8 PASS / 0 FAIL
scaffold/go/axon_client	v1.79.3	1.82.1	go build ./... + go vet ./... clean
examples/go/axon-ev-sync	v1.68.0 (indirect)	1.82.1	go build ./... + go vet ./... clean

This also clears two dependabot CRITICALs the image scan never surfaced — GHSA-p77j-4mvh-x3m3 (grpc < 1.79.3) was open against sdks/go and examples/go/axon-ev-sync. Trivy only sees the compiled agent binary, so neither showed up there. That's the reason for going wider than the one flagged module.

go mod tidy also carried protobuf 1.36.10 → 1.36.11 and genproto forward as grpc 1.82.1 requires, and pulled sdks/go off x/net v0.33.0 → v0.53.0.

Verification

Everything ran in golang:1.26.5, matching agent/go.mod.

sdks/go was additionally checked against a pristine origin/main worktree with only the go.mod/go.sum change patched in, to confirm the result wasn't an artifact of my local tree — baseline RC=0 / 8 PASS, patched RC=0 / 8 PASS, identical.

Not verified locally: the Trivy scan itself and make docker-build, both of which need the full image build. That's CI's job, and the scan result after merge is the real confirmation.

Not in scope

The other 6 findings are npm packages not in this repo — there's no package.json here. They live in the snyk-broker clone: git clone cortexapps/snyk-broker @ v1.0.16-axon. Clearing them needs a dependency change plus a new tag in that fork, then a SNYK_BROKER_VERSION bump here.

Package	Installed	Fixed in
axios	1.16.0	1.18.0
engine.io	6.6.6	6.6.7
brace-expansion ×2	1.1.13, 2.0.3	CVE-2026-13149 → 1.1.16 / 2.1.2 · CVE-2026-14257 → 5.0.8 only

brace-expansion is the awkward one: CVE-2026-14257 has no 1.x or 2.x backport, so both copies would have to jump to 5.x via npm overrides.

Because the gate fails on any finding at all (COUNT -gt 0 → exit 1), this PR will not turn the scan green on its own. It takes it from 23 to 6.

Also left alone: scaffold/go/go.mod is a Go text template (module github.com/cortexapps/axon_apps/{{.ProjectName}}), so it isn't a resolvable module and go get can't run there. It still pins grpc v1.68.0 for generated apps. Separately, dependabot has a HIGH on protobuf < 5.29.6 in sdks/python/poetry.lock — different ecosystem, not part of this pass.

🤖 Generated with Claude Code