Repository navigation
Bump google.golang.org/grpc from 1.83.0 to 1.83.2 - #16
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.0 to 1.83.2. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.83.0...v1.83.2) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
rachita-17
added a commit
that referenced
this pull request
Sep 28, 2026
Applies the security bumps across all 13 Go modules in the repo. Upstream gravitational/teleport has not picked these up yet, so this diverges from upstream until it does. google.golang.org/grpc v1.82.1 / v1.83.0 -> v1.83.2 go.opentelemetry.io/otel* v1.44.0 -> v1.45.0 Closes the largest remaining block of Dependabot alerts on master: grpc CVE-2026-84445, CVE-2026-84304, CVE-2026-84303 otel advisories published 2026-09-17 CVE-2026-84445 carries two vulnerable ranges: < 1.82.2 and >= 1.83.0 < 1.83.2. v1.83.1 satisfies only the first, so v1.83.2 is required to close it. Supersedes #9, #10, #14, #15, #16, #17, #18 and #19, which bump the same dependencies one module at a time. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
rachita-17
added a commit
that referenced
this pull request
Sep 29, 2026
…verrides (#20) * Bump google.golang.org/grpc to v1.83.2 and OpenTelemetry to v1.45.0 Applies the security bumps across all 13 Go modules in the repo. Upstream gravitational/teleport has not picked these up yet, so this diverges from upstream until it does. google.golang.org/grpc v1.82.1 / v1.83.0 -> v1.83.2 go.opentelemetry.io/otel* v1.44.0 -> v1.45.0 Closes the largest remaining block of Dependabot alerts on master: grpc CVE-2026-84445, CVE-2026-84304, CVE-2026-84303 otel advisories published 2026-09-17 CVE-2026-84445 carries two vulnerable ranges: < 1.82.2 and >= 1.83.0 < 1.83.2. v1.83.1 satisfies only the first, so v1.83.2 is required to close it. Supersedes #9, #10, #14, #15, #16, #17, #18 and #19, which bump the same dependencies one module at a time. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Close remaining Dependabot alerts: ebpf, thrift, and npm overrides Go: github.com/cilium/ebpf v0.20.0 -> v0.22.0 (root, terraform, terraform-mwi) github.com/apache/thrift v0.23.0 -> v0.24.0 (root) npm, via overrides in pnpm-workspace.yaml: @xmldom/xmldom 0.8.13 -> 0.8.15 fast-uri 3.1.5 -> 3.1.8 js-yaml 3.15.1 -> 3.15.2, 4.3.1 -> 4.3.2 browserslist 4.28.2 -> 4.29.1 baseline-browser-mapping 2.10.32 -> 2.11.26 esbuild 0.27.7 -> 0.28.1 All six npm packages are transitive, so they are pinned ahead of their parents rather than bumped directly. Each override should be dropped once the parent ships the fixed version on its own. Two details worth recording: - js-yaml is split by major because the lockfile carries both 3.x and 4.x and the advisory patches them separately. - The esbuild override is range-scoped to >=0.27.3 <0.28.1. The lockfile also holds 0.25.12, which is outside the vulnerable range, and a blanket bump would move it three minors for no security benefit. Overrides live in pnpm-workspace.yaml, not package.json: pnpm 11 no longer reads the "pnpm" field in package.json and ignores it silently. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Close undici alerts: bump e2e direct dep and pin the 6.x transitive e2e/package.json undici ^8.10.0 -> ^8.10.2 (resolves to 8.11.2) override undici@6 -> ^6.28.1 (resolves to 6.29.0) CVE-2026-85024 carries two ranges, >= 6.25.0 < 6.28.1 and >= 8.1.0 < 8.10.2. The lockfile holds both an 8.x line (declared in e2e/package.json) and a 6.x line pulled in transitively, so closing the alert takes a direct bump and an override. Dependabot #21 bumps only the declared 8.x dep and leaves the 6.x instance vulnerable. 7.29.0 is outside both ranges and is left alone. Supersedes #21. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Author
|
Looks like google.golang.org/grpc is up-to-date now, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/go_modules/google.golang.org/grpc-1.83.2
branch
September 29, 2026 08:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps google.golang.org/grpc from 1.83.0 to 1.83.2.
Release notes
Sourced from google.golang.org/grpc's releases.
Commits
030ee8bUpdate version to 1.83.2 (#9375)8668b69cherry-pick #9365 to v1.83.x (#9366)a3e952dcherry-pick #9346 to v1.83.x and update x/net dependency (#9369)58f8fd9Change version to 1.83.2-dev (#9337)1550d9eChange version to 1.83.1 (#9336)ebba6f3Cherry-pick #9258 and #9332 into v1.83.x (#9335)8cfeca0Cherry-pick #9331 to v1.83.x (#9333)dec6951Change version to 1.83.1-dev (#9229)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.