chore(all): update deps

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/openconfig/ygot	v0.34.0 → v0.35.0			require	minor
go (source)	1.26.5 → 1.27.0			toolchain	minor
google.golang.org/grpc	v1.82.1 → v1.83.1			require	minor
google.golang.org/protobuf	v1.36.11 → v1.36.12			require	patch

---

Release Notes

openconfig/ygot (github.com/openconfig/ygot)

v0.35.0

Compare Source

What's Changed

• Adding renovate config by @​prinikasn in #​1051
• chore(all): update deps by @​renovate-bot in #​1052
• chore(all): update deps by @​renovate-bot in #​1056
• Bump arduino/setup-protoc from 1 to 3 by @​dependabot[bot] in #​952
• chore(all): update deps (major) by @​renovate-bot in #​1053
• Fix README.md CI build badge link by @​bstoll in #​1058
• Add generated file comment at top of files. by @​bstoll in #​1057
• fixing link by @​Oliver-Mustoe in #​1072
• escape backslash in key values in elemToString by @​jmestwa-coder in #​1084
• Bump golang.org/x/net from 0.42.0 to 0.55.0 by @​dependabot[bot] in #​1090
• Bump actions/checkout from 5 to 7 by @​dependabot[bot] in #​1089
• gnmidiff: remove trie dependency by @​adonovan in #​1092

New Contributors

• @​prinikasn made their first contribution in #​1051
• @​renovate-bot made their first contribution in #​1052
• @​bstoll made their first contribution in #​1058
• @​Oliver-Mustoe made their first contribution in #​1072
• @​jmestwa-coder made their first contribution in #​1084
• @​adonovan made their first contribution in #​1092

Full Changelog: openconfig/ygot@v0.34.0...v0.35.0

golang/go (go)

v1.26.6

grpc/grpc-go (google.golang.org/grpc)

v1.83.1: Release 1.83.1

Compare Source

Security

• xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#​9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#​9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#​9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#​9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#​9332)
  • Special Thanks: @​alimony

Performance

• transport: Restrict memory overhead of buffering small data frames. (#​9331)

v1.83.0: Release 1.83.0

Compare Source

Security

• server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
• xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#​9223)

New Features

• xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#​9133)
• xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#​9145)
• authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#​9142)
  • Special Thanks: @​hnefatl
• xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#​9119)
• xds: Add support for xDS-based HTTP CONNECT proxies.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#​9151)
• xds: Add support for contains_match in route header matchers. (#​9223)

Bug Fixes

• credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#​9197)
• grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#​9255)
  • Special Thanks: @​Yusufihsangorgel

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Monday through Friday (* * * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260414002931-afd174a4e478 -> v0.0.0-20260526163538-3dc84a4a5aaa