Engineering report: groot v1.1.4

v1.1.4 (2026-09-28) is a security patch on the 1.1.x line: transitive google.golang.org/grpc v1.83.2, golang.org/x/crypto v0.56.0, and go.opentelemetry.io/otel v1.45.0 (Dependabot). No CLI or config contract changes.

What changed

  • Bump grpc to v1.83.2 (Dependabot / gRPC 1.83.x security fixes; transitive via GCS client — groot does not expose a gRPC server).
  • Bump golang.org/x/crypto to v0.56.0 (GO-2026-6354 / GO-2026-6355 — DoS in crypto/ssh; used by SFTP upload).
  • Bump OpenTelemetry (otel / metric / trace / sdk) to v1.45.0 — Dependabot #5.
  • Operator docs pin: groot-selfhosted v0.2.14 (image ghcr.io/hrodrig/groot:v1.1.4).

Product context

Functional contract is unchanged from v1.1.0 / v1.1.1. See the v1.1.1 engineering report for validate / collect / inspect / analyze, exit codes, and ecosystem map.