fix: bump klauspost/compress and grpc to patch GO-2026-5841 and GO-2026-6061

[claude]

Requested by Saifur Rahman · Slack thread

Description 📣

Before: The Go Vulnerability Scan CI job (govulncheck) fails on every push to main with:

Non-allowlisted vulnerabilities found: GO-2026-5841 GO-2026-6061

After: govulncheck's module scan clears both advisories, so the job passes.

What changed: Bumped two indirect dependencies to the versions that patch the flagged advisories:

• github.com/klauspost/compress v1.17.8 → v1.18.7 (fixes GO-2026-5841)
• google.golang.org/grpc v1.79.3 → v1.82.1 (fixes GO-2026-6061)

The grpc bump pulls in three unavoidable transitive updates required to compile (golang.org/x/oauth2 v0.35.0→v0.36.0 and two google.golang.org/genproto/googleapis/{api,rpc} timestamps). The diff is limited to go.mod and go.sum (+29/-5); the workflow allowlist was intentionally NOT touched, since the workflow reserves it for advisories with no available fix.

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests 🛠️

go build ./... passes locally.

go build ./...

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

---

Generated by Claude Code

[greptile-apps]

Greptile Summary

Updates indirect dependencies to patched versions.

• Bumps github.com/klauspost/compress from v1.17.8 to v1.18.7.
• Bumps google.golang.org/grpc from v1.79.3 to v1.82.1.
• Updates the required OAuth2, Genproto, and transitive module checksums.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete dependency compatibility, security, or SSRF regression identified.

The changed modules are indirect dependencies, repository code does not directly consume their APIs, and the unrelated DTLS and OpenPGP advisories were neither introduced nor made newly reachable by this update.

Important Files Changed

Filename	Overview
go.mod	Updates the targeted indirect dependencies and compatible transitive requirements; no concrete changed-code failure was identified.
go.sum	Adds checksums corresponding to the upgraded dependency graph without altering application behavior directly.

_{Reviews (1): Last reviewed commit: "fix: bump klauspost/compress and grpc to..." | Re-trigger Greptile}