govulncheck fails on dev-v3: google.golang.org/grpc v1.82.1 affected by GO-2026-6348

What's happening

govulncheck fails on every Go PR targeting dev-v3, reporting one affecting vulnerability:

Vulnerability #1: GO-2026-6348
    Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in
    google.golang.org/grpc
  More info: https://pkg.go.dev/vuln/GO-2026-6348
  Module: google.golang.org/grpc
    Found in: google.golang.org/[email protected]
    Fixed in: google.golang.org/[email protected]

Example traces reported by the scan:

• pkg/repo/repotest/server.go:130 — repotest.NewOCIServer → registry.NewRegistry → mem.BufferSlice.MaterializeToBuffer
• pkg/action/lazyclient.go:49 — action.lazyClient.init → sync.Once.Do → mem.NewBuffer
• pkg/chartutil/save.go:141 — chartutil.Save → gzip.Writer.Close → mem.writer.Write

Why it only affects dev-v3

main has already moved past the advisory — it is on google.golang.org/grpc v1.83.2, via Dependabot PRs #32614 (1.82.1 → 1.83.1) and #32636 (1.83.1 → 1.83.2). Neither bump got a dev-v3 counterpart, so dev-v3 is still pinned at the vulnerable v1.82.1:

.github/dependabot.yml does configure the gomod ecosystem for target-branch: dev-v3, but no grpc PR has ever been opened against that branch.

Impact

Every Go dependency PR to dev-v3 lands with a red govulncheck. Most recent example: #32653 (bump github.com/mattn/go-shellwords from 1.0.14 to 1.0.15) — all other checks green, govulncheck failing on a vulnerability entirely unrelated to that bump. govulncheck is not a required status check on dev-v3, so this does not hard-block merges, but it does mean reviewers have to eyeball and dismiss a red X on every dependency PR, which is exactly how a real finding gets waved through.

Proposed fix

Bump the indirect requirement on dev-v3 to at least v1.83.1, matching main:

git checkout dev-v3
go get google.golang.org/[email protected]
go mod tidy

Note on #32361

#32361 tracks an earlier dev-v3 govulncheck failure (GO-2026-5932, x/crypto/openpgp, no fixed release). That one is already resolved: #32463 migrated pkg/provenance from x/crypto/openpgp to github.com/ProtonMail/go-crypto (commit bd392c6a6, merged 2026-07-24), and dev-v3 no longer imports x/crypto/openpgp anywhere. The advisory correspondingly no longer appears in the scan output above, which reports only GO-2026-6348.

So GO-2026-6348 is now the sole remaining govulncheck blocker on dev-v3, and unlike #32361 it is fixable by a dependency bump — doing so should get the branch back to a green govulncheck.