Bump gh CLI to >= v2.97.0 (grpc >= 1.82.1) and drop GHSA-hrxh-6v49-42gf grype ignore

[lpcox]

Summary

The agent and cli-proxy container images pin gh CLI 2.96.0, which embeds grpc v1.81.1 — flagged by GHSA-hrxh-6v49-42gf (google.golang.org/grpc, Critical / CVSS 9.1, fixed in v1.82.1). This finding is currently suppressed via a .grype.yaml ignore entry as a documented risk acceptance.

This issue tracks replacing that risk acceptance with a real fix once upstream gh ships the patched grpc.

Why it's currently accepted (not fixed)

GHSA-hrxh-6v49-42gf covers three server-side grpc-go issues:

• xDS RBAC authorization bypass (fail-open on unsupported matchers)
• HTTP/2 rapid-reset mitigation bypass (DoS)
• panic on crafted xDS RBAC policies

grpc is a transitive dependency compiled into the gh client binary. gh does not run a gRPC server, use xDS RBAC, or accept HTTP/2 from untrusted peers, so none of the vulnerable code paths are reachable in our usage. The finding is present but not exploitable here.

Why we can't fix it today

• gh 2.96.0 is the latest tagged release (2026-07-02) and still pins grpc v1.81.1 (confirmed in its go.mod).
• Building gh from unreleased trunk would ship an untagged, non-official binary — a worse supply-chain tradeoff than a non-reachable finding.
• The fix is already merged on gh trunk (go.sum on trunk shows grpc v1.82.1), so the next tagged release will carry it.

Action when gh >= v2.97.0 (grpc >= 1.82.1) is released

• Bump the gh=/GH_VERSION pin in containers/agent/Dockerfile (apt) — currently gh=2.96.0
• Bump the GH_VERSION pin + per-arch GH_SHA256 in containers/cli-proxy/Dockerfile — currently 2.96.0
• Verify the new gh release's go.mod pins grpc >= 1.82.1
• Delete the GHSA-hrxh-6v49-42gf entry from .grype.yaml
• Confirm the Supply Chain Scan blocking gate passes with the ignore removed

References

• Advisory: GHSA-hrxh-6v49-42gf
• gh v2.96.0 go.mod: https://github.com/cli/cli/blob/v2.96.0/go.mod (grpc v1.81.1)
• gh trunk go.sum: grpc v1.82.1 (fix merged, awaiting release)
• Suppression + full justification: .grype.yaml