fix: bump grpc to v1.80.0

[ysmolski]

To address CVE and match the router:
https://www.mend.io/vulnerability-database/CVE-2026-33186/

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

Two Go modules update dependency pins: execution/go.mod bumps grpc to v1.80.0 and protobuf to v1.36.11 and refreshes several indirect golang.org/x and genproto packages; v2/go.mod similarly updates direct golang.org/x, gonum, grpc/protobuf pins and refreshes OpenTelemetry and tooling indirect deps.

Changes

Go Module Dependency Updates

Layer / File(s)	Summary
execution module dependencies execution/go.mod	Direct requirements for google.golang.org/grpc (bumped to v1.80.0) and google.golang.org/protobuf (bumped to v1.36.11); multiple indirect golang.org/x/* modules and google.golang.org/genproto/googleapis/rpc refreshed.
v2 module dependencies v2/go.mod	Direct requirements for golang.org/x/sync, golang.org/x/sys, golang.org/x/text, gonum.org/v1/gonum, google.golang.org/grpc, and google.golang.org/protobuf are updated; indirect dependencies including OpenTelemetry (go.opentelemetry.io/otel and .../sdk/metric), several golang.org/x/* modules, and google.golang.org/genproto/googleapis/rpc are refreshed.

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: bumping gRPC to v1.80.0, which is the primary and most significant change in both go.mod files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The PR description references a CVE and links to a vulnerability database, clearly indicating the purpose is to address security concerns through dependency updates.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch yury/bump_grpc

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@execution/go.mod`:
- Around line 21-22: The PR text incorrectly states grpc-go was upgraded to
v1.79.3 while the module actually uses google.golang.org/grpc v1.80.0; update
the PR title and description to explicitly say v1.80.0 (and mention that this
includes the CVE-2026-33186 fix), and verify any other modules/components that
should match (e.g., any "router" dependency) are using the same grpc version or
document why they differ; also double-check the go.mod line
"google.golang.org/grpc v1.80.0" and update any release notes/changelog entries
to reference v1.80.0 instead of v1.79.3.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8bf5e213-7176-4b9e-b9a2-45a4c414f8f6

📥 Commits

Reviewing files that changed from the base of the PR and between e5bd746 and 59844fd.

⛔ Files ignored due to path filters (3)

• execution/go.sum is excluded by !**/*.sum
• go.work.sum is excluded by !**/*.sum
• v2/go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• execution/go.mod
• v2/go.mod

✅ Files skipped from review due to trivial changes (1)

• v2/go.mod