fix: update google.golang.org/grpc to v1.82.1 (#27928) · coder/coder@877fbeb · GitHub
Skip to content

Commit 877fbeb

Browse files
denisradenisra
authored
fix: update google.golang.org/grpc to v1.82.1 (#27928)
## What Updates `google.golang.org/grpc` from `v1.81.1` → `v1.82.1` on `release/2.34`. ## Why `google.golang.org/grpc v1.81.1` is vulnerable to **GHSA-hrxh-6v49-42gf** (GO-2026-6061) — the relevant exposure is the HTTP/2 Rapid Reset-style DoS (the xDS RBAC auth-bypass half of the advisory isn't used by Coder). Flagged by the IronBank scan of Coder v2.35.3; `release/2.34` ships the same vulnerable version. Fixed in **v1.82.1** (matches `v2.36.0`; `main` is on v1.83.0). Companion to #27925 (the `release/2.35` backport). ## Change - `go.mod`: `google.golang.org/grpc v1.81.1` → `v1.82.1` (direct), plus the minimal indirect bumps grpc 1.82.1 requires on this branch: - `google.golang.org/genproto/googleapis/api` 20260319 → 20260414 - `GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp` v1.31.0 → v1.32.0 - `go.opentelemetry.io/contrib/detectors/gcp` v1.42.0 → v1.43.0 - `go.sum`: corresponding hashes (These three indirect bumps weren't needed on the 2.35 backport because that branch already had newer pins; on 2.34 they're pulled up by grpc 1.82.1's minimum-version requirements. All `// indirect`, all `go mod verify`-clean.) ## Validation (local; `golangci-lint` at the CI-pinned v1.64.8) - `go build ./...` — clean - `go vet ./tailnet/... ./codersdk/...` — clean - `golangci-lint run` (full repo) — 0 issues - `go run ./scripts/intxcheck ./...` — clean - `go mod tidy` stable; `go mod verify` OK DB-backed suites (`make test-postgres`) run in CI. Linear: ENT-144
1 parent d6ea2bd commit 877fbeb

2 files changed

Lines changed: 12 additions & 12 deletions

File tree

‎go.mod‎

Lines changed: 4 additions & 4 deletions

‎go.sum‎

Lines changed: 8 additions & 8 deletions

0 commit comments

Comments
 (0)