Skip to content

Commit 5550e7a

Browse files
authored
Upgrade grpc-go to 1.82.1 for GHSA-hrxh-6v49-42gf (#1083)
## Summary - Upgrade indirect dependency `google.golang.org/grpc` from 1.81.1 to 1.82.1, clearing Dependabot alert #3 (GHSA-hrxh-6v49-42gf, high severity: xDS RBAC authorization bypass and two server-side denial-of-service issues). - roborev uses grpc only as an OTLP telemetry export client via `go.kenn.io/kit/telemetry`, so the vulnerable server-side paths are not reachable; the bump keeps the dependency off the vulnerable range. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Wes McKinney <wesm@users.noreply.github.com>
1 parent a35d7ea commit 5550e7a

3 files changed

Lines changed: 4 additions & 4 deletions

File tree

flake.nix

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737

3838
src = ./.;
3939

40-
vendorHash = "sha256-w632Je66dG5MFzcTKXchZQJRi89W7HrEj1rtvVUFKEg=";
40+
vendorHash = "sha256-A5ZcODNZyjMTTFI8QZqaYn0Wddr8+899R+C1n27TI1U=";
4141

4242
subPackages = [ "cmd/roborev" ];
4343

go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ require (
156156
golang.org/x/time v0.15.0 // indirect
157157
google.golang.org/genproto/googleapis/api v0.0.0-20260706201446-f0a921348800 // indirect
158158
google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
159-
google.golang.org/grpc v1.81.1 // indirect
159+
google.golang.org/grpc v1.82.1 // indirect
160160
google.golang.org/protobuf v1.36.11 // indirect
161161
gopkg.in/warnings.v0 v0.1.2 // indirect
162162
modernc.org/libc v1.74.4 // indirect

go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -396,8 +396,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260706201446-f0a921348800 h1:
396396
google.golang.org/genproto/googleapis/api v0.0.0-20260706201446-f0a921348800/go.mod h1:FPk7EXUKMtImne7AmknoYjT4QXqKIzzRbeQIXzLk6fQ=
397397
google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 h1:qEHAMpSaUhtD0p3NbEEI83HwNGFxEwaSJ1G9PLnCBZE=
398398
google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
399-
google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
400-
google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
399+
google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
400+
google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
401401
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
402402
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
403403
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

0 commit comments

Comments
 (0)