Patch release including the grpc bump from #3093

Is your feature request related to a problem?

The latest release (v0.16.1, 2026-05-27) predates the grpc bump in #3093, so the released images still ship google.golang.org/grpc v1.72.1 and report CVE-2026-33186 as a fixable CRITICAL. The fix has been on main since 2026-07-14, but there's no released tag carrying it yet.

Describe the solution you'd like

Would it be possible to cut a patch release (and chart) including #3093? That would let those of us pinned to released tags pick the fix up without moving to main.

Additional context

The main image already confirms the fix works, scanning both with Trivy 0.71.1 (--ignore-unfixed, HIGH+CRITICAL):

• quay.io/metallb/speaker:v0.16.1 Critical: 2 High: 38
• quay.io/metallb/speaker:main (rebuilt 2026-08-05) Critical: 0 High: 8

So it looks like a release would clear the CRITICAL and most of the HIGHs.

O run MetalLB on a small k3s cluster and it's been rock solid. The only reason this is awkward for me is that main isn't something I want to depend on for the component that owns every LoadBalancer VIP, so I'd rather wait for a tag than pin a rolling one.

No urgency implied, and thanks very much for maintaining this.

I've read and agree with the following

• I've checked all open and closed issues and my request is not there.
• I've checked all open and closed pull requests and my request is not there.