Skip to content

sec: bump grpc lib - #163

Merged
JoshVanL merged 1 commit into
dapr:mainfrom
mikeee:sec/grpc
Jul 29, 2026
Merged

sec: bump grpc lib#163
JoshVanL merged 1 commit into
dapr:mainfrom
mikeee:sec/grpc

Conversation

@mikeee

@mikeee mikeee commented Jul 27, 2026

Copy link
Copy Markdown
Member

Addresses GHSA-hrxh-6v49-42gf

Description

Please explain the changes you've made

Issue reference

We strive to have all PR being opened based on an issue, where the problem or feature have been discussed prior to implementation.

Please reference the issue this PR will close: #[issue number]

Checklist

Please make sure you've completed the relevant tasks for this PR, out of the following list:

  • Code compiles correctly
  • Created/updated tests

Addresses GHSA-hrxh-6v49-42gf

Signed-off-by: Mike Nguyen <hey@mike.ee>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates Go module dependencies to address GHSA-hrxh-6v49-42gf, primarily by bumping google.golang.org/grpc and related dependency versions.

Changes:

  • Bump google.golang.org/grpc from v1.79.3 to v1.82.1 and update google.golang.org/genproto/googleapis/rpc.
  • Refresh several other direct and indirect Go dependencies (golang.org/x/*, github.com/go-jose/go-jose/v4, etc.).
  • Update go.sum with new module checksums corresponding to the dependency changes.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File Description
go.mod Updates direct and indirect dependency versions, including the gRPC bump tied to the security advisory.
go.sum Adds checksum entries for the updated modules and transitive dependency changes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread go.mod
@JoshVanL
JoshVanL merged commit cbbf65a into dapr:main Jul 29, 2026
6 checks passed
@mikeee
mikeee deleted the sec/grpc branch July 29, 2026 17:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants