Upgrade gun to 2.4.1 to fix security vulnerabilities

grpc/lib/grpc/client/resolver/dns.ex

@@ -76,6 +76,14 @@ defmodule GRPC.Client.Resolver.DNS do
   def update(state, _event), do: {:ok, state}
 
   @impl GRPC.Client.Resolver
+  def shutdown(%{worker_pid: pid}) when is_pid(pid) do
+    try do
+      GenServer.stop(pid)
+    catch
+      :exit, _ -> :ok
+    end
+  end
+
   def shutdown(_state), do: :ok
 
   defp lookup_addresses(host) do

grpc/mix.exs

@@ -31,7 +31,7 @@ defmodule GRPC.MixProject do
     [
       # {:grpc_core, path: "../grpc_core"},
       {:grpc_core, "~> 1.0.0"},
-      {:gun, "~> 2.2.0", optional: true},
+      {:gun, "~> 2.4.0", optional: true},
       {:mint, "~> 1.9", optional: true},
       {:castore, "~> 1.0", optional: true},
       {:ex_doc, "~> 0.40", only: [:dev, :docs], runtime: false},

grpc/mix.lock

@@ -9,7 +9,7 @@
   "gen_stage": {:hex, :gen_stage, "1.3.2", "7c77e5d1e97de2c6c2f78f306f463bca64bf2f4c3cdd606affc0100b89743b7b", [:mix], [], "hexpm", "0ffae547fa777b3ed889a6b9e1e64566217413d018cabd825f786e843ffe63e7"},
   "googleapis": {:hex, :googleapis, "0.1.0", "13770f3f75f5b863fb9acf41633c7bc71bad788f3f553b66481a096d083ee20e", [:mix], [{:protobuf, "~> 0.12", [hex: :protobuf, repo: "hexpm", optional: false]}], "hexpm", "1989a7244fd17d3eb5f3de311a022b656c3736b39740db46506157c4604bd212"},
   "grpc_core": {:hex, :grpc_core, "1.0.0", "58a6446dfa7cb96c1d2a4da2aa630a728a63d6a8252812aa5e6d51ce79e8c1c8", [:mix], [{:googleapis, "~> 0.1.0", [hex: :googleapis, repo: "hexpm", optional: false]}, {:jason, ">= 0.0.0", [hex: :jason, repo: "hexpm", optional: false]}, {:protobuf, "~> 0.17", [hex: :protobuf, repo: "hexpm", optional: false]}, {:telemetry, "~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "181c84e6fcd6ed456711503f47c238d4aa6fc2bdc5d1cf5851c779062b224a6a"},
-  "gun": {:hex, :gun, "2.2.0", "b8f6b7d417e277d4c2b0dc3c07dfdf892447b087f1cc1caff9c0f556b884e33d", [:make, :rebar3], [{:cowlib, ">= 2.15.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}], "hexpm", "76022700c64287feb4df93a1795cff6741b83fb37415c40c34c38d2a4645261a"},
+  "gun": {:hex, :gun, "2.4.1", "c3a8bff8e155e1fc8e499216599bb7effbd27bc1985662a8b25016090dc18428", [:make, :rebar3], [{:cowlib, ">= 2.15.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}], "hexpm", "1450575b4d393aa0811322727b90ad1dd94b5c10026f54a1641785bcbd250384"},
   "hpax": {:hex, :hpax, "1.0.3", "ed67ef51ad4df91e75cc6a1494f851850c0bd98ebc0be6e81b026e765ee535aa", [:mix], [], "hexpm", "8eab6e1cfa8d5918c2ce4ba43588e894af35dbd8e91e6e55c817bca5847df34a"},
   "jason": {:hex, :jason, "1.4.5", "2e3a008590b0b8d7388c20293e9dcc9cf3e5d642fd2a114e4cbbb52e595d940a", [:mix], [{:decimal, "~> 1.0 or ~> 2.0 or ~> 3.0", [hex: :decimal, repo: "hexpm", optional: true]}], "hexpm", "b0c823996102bcd0239b3c2444eb00409b72f6a140c1950bc8b457d836b30684"},
   "makeup": {:hex, :makeup, "1.2.1", "e90ac1c65589ef354378def3ba19d401e739ee7ee06fb47f94c687016e3713d1", [:mix], [{:nimble_parsec, "~> 1.4", [hex: :nimble_parsec, repo: "hexpm", optional: false]}], "hexpm", "d36484867b0bae0fea568d10131197a4c2e47056a6fbe84922bf6ba71c8d17ce"},

grpc/test/grpc/client/dns_resolver_test.exs

@@ -56,7 +56,18 @@ defmodule GRPC.Client.ReResolveTest do
     end)
 
     stub(resolver, :update, fn state, _event -> {:ok, state} end)
-    stub(resolver, :shutdown, fn _state -> :ok end)
+
+    stub(resolver, :shutdown, fn
+      %{worker_pid: pid} when is_pid(pid) ->
+        try do
+          GenServer.stop(pid)
+        catch
+          :exit, _ -> :ok
+        end
+
+      _ ->
+        :ok
+    end)
 
     %{
       ref: ref,
@@ -127,7 +138,18 @@ defmodule GRPC.Client.ReResolveTest do
     end)
 
     stub(resolver, :update, fn state, _event -> {:ok, state} end)
-    stub(resolver, :shutdown, fn _state -> :ok end)
+
+    stub(resolver, :shutdown, fn
+      %{worker_pid: pid} when is_pid(pid) ->
+        try do
+          GenServer.stop(pid)
+        catch
+          :exit, _ -> :ok
+        end
+
+      _ ->
+        :ok
+    end)
 
     Connection.connect(
       "dns://my-service.local:50051",

grpc/test/grpc/integration/server_test.exs

@@ -327,7 +327,7 @@ defmodule GRPC.Integration.ServerTest do
     def filter(exception) do
       data = exception.adapter_extra[:req][:headers]["test-data"]
 
-      {pid, ref} = :erlang.binary_to_term(data)
+      {pid, ref} = data |> Base.decode64!() |> :erlang.binary_to_term()
       send(pid, {:exception_log_filter, ref, exception})
 
       true
@@ -343,7 +343,9 @@ defmodule GRPC.Integration.ServerTest do
       fn port ->
         {:ok, channel} =
           GRPC.Stub.connect("localhost:#{port}",
-            headers: [{"test-data", :erlang.term_to_binary({test_pid, ref})}]
+            headers: [
+              {"test-data", Base.encode64(:erlang.term_to_binary({test_pid, ref}))}
+            ]
           )
 
         req = %Helloworld.HelloRequest{name: "world"}
@@ -361,7 +363,7 @@ defmodule GRPC.Integration.ServerTest do
     def filter(exception) do
       data = exception.adapter_extra[:req][:headers]["test-data"]
 
-      {pid, ref} = :erlang.binary_to_term(data)
+      {pid, ref} = data |> Base.decode64!() |> :erlang.binary_to_term()
       send(pid, {:exception_log_filter, ref, exception})
 
       true
@@ -377,7 +379,9 @@ defmodule GRPC.Integration.ServerTest do
       fn port ->
         {:ok, channel} =
           GRPC.Stub.connect("localhost:#{port}",
-            headers: [{"test-data", :erlang.term_to_binary({test_pid, ref})}]
+            headers: [
+              {"test-data", Base.encode64(:erlang.term_to_binary({test_pid, ref}))}
+            ]
           )
 
         req = %Helloworld.HelloRequest{name: "unknown error", duration: 0}
@@ -478,7 +482,7 @@ defmodule GRPC.Integration.ServerTest do
 
   test "gracefully handles server shutdown disconnects" do
     logs =
-      ExUnit.CaptureLog.capture_log(fn ->
+      ExUnit.CaptureLog.capture_log([level: :error], fn ->
         run_server(FeatureServer, fn port ->
           {:ok, channel} = GRPC.Stub.connect("localhost:#{port}")
           client_stream = Routeguide.RouteGuide.Stub.route_chat(channel)

interop/mix.lock

@@ -1,13 +1,13 @@
 %{
   "cowboy": {:hex, :cowboy, "2.14.2", "4008be1df6ade45e4f2a4e9e2d22b36d0b5aba4e20b0a0d7049e28d124e34847", [:make, :rebar3], [{:cowlib, ">= 2.16.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}, {:ranch, ">= 1.8.0 and < 3.0.0", [hex: :ranch, repo: "hexpm", optional: false]}], "hexpm", "569081da046e7b41b5df36aa359be71a0c8874e5b9cff6f747073fc57baf1ab9"},
-  "cowlib": {:hex, :cowlib, "2.16.0", "54592074ebbbb92ee4746c8a8846e5605052f29309d3a873468d76cdf932076f", [:make, :rebar3], [], "hexpm", "7f478d80d66b747344f0ea7708c187645cfcc08b11aa424632f78e25bf05db51"},
+  "cowlib": {:hex, :cowlib, "2.17.1", "3e6053016d1ab245730f0af688755476dcedb1c25ed8fb5751f59a2bfdc0c9af", [:make, :rebar3], [], "hexpm", "ff08bd17e6dd931445b18af77315b9b5fe052407110964ad2588c686b57b5e3f"},
   "extrace": {:hex, :extrace, "0.6.0", "83ddb14513b50eceadc9bc62cb322daffc0fcc13687c02a77d1f21e5a07f1cc9", [:mix], [{:recon, "~> 2.5", [hex: :recon, repo: "hexpm", optional: false]}], "hexpm", "499c416c363cda0c4a8523e0460d5a6f7a7cdaccf9e180022e4ec0d25735beca"},
   "flow": {:hex, :flow, "1.2.4", "1dd58918287eb286656008777cb32714b5123d3855956f29aa141ebae456922d", [:mix], [{:gen_stage, "~> 1.0", [hex: :gen_stage, repo: "hexpm", optional: false]}], "hexpm", "874adde96368e71870f3510b91e35bc31652291858c86c0e75359cbdd35eb211"},
   "gen_stage": {:hex, :gen_stage, "1.3.2", "7c77e5d1e97de2c6c2f78f306f463bca64bf2f4c3cdd606affc0100b89743b7b", [:mix], [], "hexpm", "0ffae547fa777b3ed889a6b9e1e64566217413d018cabd825f786e843ffe63e7"},
   "googleapis": {:hex, :googleapis, "0.1.0", "13770f3f75f5b863fb9acf41633c7bc71bad788f3f553b66481a096d083ee20e", [:mix], [{:protobuf, "~> 0.12", [hex: :protobuf, repo: "hexpm", optional: false]}], "hexpm", "1989a7244fd17d3eb5f3de311a022b656c3736b39740db46506157c4604bd212"},
-  "grpc_core": {:hex, :grpc_core, "1.0.0-rc.1", "d82957bca32937bb52df06596cca7550783acc139a06b70202a982ef8b59490e", [:mix], [{:googleapis, "~> 0.1.0", [hex: :googleapis, repo: "hexpm", optional: false]}, {:jason, ">= 0.0.0", [hex: :jason, repo: "hexpm", optional: false]}, {:protobuf, "~> 0.14", [hex: :protobuf, repo: "hexpm", optional: false]}, {:telemetry, "~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "c76233ea374421da562b5b022c22614e81f9cf862da93543cff93c37c085f136"},
+  "grpc_core": {:hex, :grpc_core, "1.0.1", "7484d6f016fa9956bac57a164473e651683bbb735a056c0e89db54d04c776266", [:mix], [{:googleapis, "~> 0.1.0", [hex: :googleapis, repo: "hexpm", optional: false]}, {:jason, ">= 0.0.0", [hex: :jason, repo: "hexpm", optional: false]}, {:protobuf, "~> 0.17", [hex: :protobuf, repo: "hexpm", optional: false]}, {:telemetry, "~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "caebb9c12bd963b1a7750ced1b95feebcec9a7b78f5c1ee8d6fab3f6ff288822"},
   "grpc_statsd": {:hex, :grpc_statsd, "0.1.0", "a95ae388188486043f92a3c5091c143f5a646d6af80c9da5ee616546c4d8f5ff", [:mix], [{:grpc, ">= 0.0.0", [hex: :grpc, repo: "hexpm", optional: true]}, {:statix, ">= 0.0.0", [hex: :statix, repo: "hexpm", optional: true]}], "hexpm", "de0c05db313c7b3ffeff345855d173fd82fec3de16591a126b673f7f698d9e74"},
-  "gun": {:hex, :gun, "2.2.0", "b8f6b7d417e277d4c2b0dc3c07dfdf892447b087f1cc1caff9c0f556b884e33d", [:make, :rebar3], [{:cowlib, ">= 2.15.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}], "hexpm", "76022700c64287feb4df93a1795cff6741b83fb37415c40c34c38d2a4645261a"},
+  "gun": {:hex, :gun, "2.4.1", "c3a8bff8e155e1fc8e499216599bb7effbd27bc1985662a8b25016090dc18428", [:make, :rebar3], [{:cowlib, ">= 2.15.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}], "hexpm", "1450575b4d393aa0811322727b90ad1dd94b5c10026f54a1641785bcbd250384"},
   "hpax": {:hex, :hpax, "1.0.3", "ed67ef51ad4df91e75cc6a1494f851850c0bd98ebc0be6e81b026e765ee535aa", [:mix], [], "hexpm", "8eab6e1cfa8d5918c2ce4ba43588e894af35dbd8e91e6e55c817bca5847df34a"},
   "jason": {:hex, :jason, "1.4.5", "2e3a008590b0b8d7388c20293e9dcc9cf3e5d642fd2a114e4cbbb52e595d940a", [:mix], [{:decimal, "~> 1.0 or ~> 2.0 or ~> 3.0", [hex: :decimal, repo: "hexpm", optional: true]}], "hexpm", "b0c823996102bcd0239b3c2444eb00409b72f6a140c1950bc8b457d836b30684"},
   "mint": {:hex, :mint, "1.9.0", "d6f534c2a3e98b2a8cc749b4796eb77e9e3af79a76f96e4c74035a827de0d318", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:hpax, "~> 0.1.1 or ~> 0.2.0 or ~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}], "hexpm", "007154c7d8c43916aed3c93afd1f11aebbaa9c5ff4b7ba55ebe0d17ee0296042"},

mix.lock

@@ -1,6 +1,6 @@
 %{
   "cowboy": {:hex, :cowboy, "2.14.2", "4008be1df6ade45e4f2a4e9e2d22b36d0b5aba4e20b0a0d7049e28d124e34847", [:make, :rebar3], [{:cowlib, ">= 2.16.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}, {:ranch, ">= 1.8.0 and < 3.0.0", [hex: :ranch, repo: "hexpm", optional: false]}], "hexpm", "569081da046e7b41b5df36aa359be71a0c8874e5b9cff6f747073fc57baf1ab9"},
-  "cowlib": {:hex, :cowlib, "2.16.0", "54592074ebbbb92ee4746c8a8846e5605052f29309d3a873468d76cdf932076f", [:make, :rebar3], [], "hexpm", "7f478d80d66b747344f0ea7708c187645cfcc08b11aa424632f78e25bf05db51"},
+  "cowlib": {:hex, :cowlib, "2.17.1", "3e6053016d1ab245730f0af688755476dcedb1c25ed8fb5751f59a2bfdc0c9af", [:make, :rebar3], [], "hexpm", "ff08bd17e6dd931445b18af77315b9b5fe052407110964ad2588c686b57b5e3f"},
   "flow": {:hex, :flow, "1.2.4", "1dd58918287eb286656008777cb32714b5123d3855956f29aa141ebae456922d", [:mix], [{:gen_stage, "~> 1.0", [hex: :gen_stage, repo: "hexpm", optional: false]}], "hexpm", "874adde96368e71870f3510b91e35bc31652291858c86c0e75359cbdd35eb211"},
   "gen_stage": {:hex, :gen_stage, "1.3.2", "7c77e5d1e97de2c6c2f78f306f463bca64bf2f4c3cdd606affc0100b89743b7b", [:mix], [], "hexpm", "0ffae547fa777b3ed889a6b9e1e64566217413d018cabd825f786e843ffe63e7"},
   "googleapis": {:hex, :googleapis, "0.1.0", "13770f3f75f5b863fb9acf41633c7bc71bad788f3f553b66481a096d083ee20e", [:mix], [{:protobuf, "~> 0.12", [hex: :protobuf, repo: "hexpm", optional: false]}], "hexpm", "1989a7244fd17d3eb5f3de311a022b656c3736b39740db46506157c4604bd212"},