fix(deps): update all non-major (gomod)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
google.golang.org/api	v0.290.0 → v0.291.0
google.golang.org/grpc	v1.82.1 → v1.83.0

---

Release Notes

googleapis/google-api-go-client (google.golang.org/api)

v0.291.0

Compare Source

Features

• all: Auto-regenerate discovery clients (#​3666) (e3721ba)
• all: Auto-regenerate discovery clients (#​3670) (4067374)
• all: Auto-regenerate discovery clients (#​3674) (432658c)
• all: Auto-regenerate discovery clients (#​3676) (9998a11)
• all: Auto-regenerate discovery clients (#​3678) (b5c5526)
• all: Auto-regenerate discovery clients (#​3679) (499d9b1)

Bug Fixes

• transport: Use ds.GetUniverseDomain() instead of raw ds.UniverseDomain field (#​3660) (6bad358)

grpc/grpc-go (google.golang.org/grpc)

v1.83.0: Release 1.83.0

Compare Source

Security

• server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
• xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#​9223)

New Features

• xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#​9133)
• xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#​9145)
• authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#​9142)
  • Special Thanks: @​hnefatl
• xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#​9119)
• xds: Add support for xDS-based HTTP CONNECT proxies.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#​9151)
• xds: Add support for contains_match in route header matchers. (#​9223)

Bug Fixes

• credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#​9197)
• grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#​9255)
  • Special Thanks: @​Yusufihsangorgel

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: packages/apigateway/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp	v1.32.0 -> v1.33.0
github.com/spiffe/go-spiffe/v2	v2.6.0 -> v2.7.0

File name: packages/dispatcher/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated

Details:

Package	Change
cloud.google.com/go/auth	v0.20.0 -> v0.22.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp	v1.32.0 -> v1.33.0
github.com/googleapis/enterprise-certificate-proxy	v0.3.18 -> v0.3.19
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260706201446-f0a921348800 -> v0.0.0-20260724162435-b2f20204f0df

File name: packages/shared/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp	v1.32.0 -> v1.33.0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.95%. Comparing base (ce934aa) to head (80b0cb0).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #897      +/-   ##
==========================================
- Coverage   81.99%   81.95%   -0.04%     
==========================================
  Files         309      309              
  Lines       15010    15010              
  Branches     3381     3382       +1     
==========================================
- Hits        12307    12301       -6     
- Misses       2544     2549       +5     
- Partials      159      160       +1     

Flag	Coverage Δ
go-apigateway	59.78% <ø> (ø)
go-apigateway-integration	91.52% <ø> (ø)
go-dispatcher	73.48% <ø> (-0.22%)	⬇️
go-firestore-integration	23.58% <ø> (ø)
go-shared	86.62% <ø> (ø)
python	93.70% <ø> (ø)
python-integration	44.29% <ø> (ø)
web	80.78% <ø> (-0.05%)	⬇️
web-integration	29.43% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.