Skip to content

chore(deps): bump grpc and x/net to patch dependabot alerts - #100

Merged
robbycochran merged 1 commit into
mainfrom
rc-dep-bumps-grpc-net
Aug 25, 2026
Merged

chore(deps): bump grpc and x/net to patch dependabot alerts#100
robbycochran merged 1 commit into
mainfrom
rc-dep-bumps-grpc-net

Conversation

@robbycochran

@robbycochranrobbycochran commented Aug 25, 2026

Copy link
Copy Markdown
Collaborator

Resolves the two open dependabot alerts on main:

  • HIGHgoogle.golang.org/grpc 1.81.1 → 1.82.1 — xDS RBAC and HTTP/2 vulnerabilities.
  • MEDIUMgolang.org/x/net 0.51.0 → 0.55.0 — HTML parser DoS.

Both are indirect deps. go mod tidy also pulled the matching x/sys 0.42.0→0.45.0, x/text 0.34.0→0.37.0, and genproto/googleapis/rpc.

Test plan

go build ./..., go vet ./..., go test ./..., golangci-lint run ./... — all green locally.

Summary by CodeRabbit

  • Chores
    • Updated several underlying Go module dependencies to newer versions.
    • No user-facing features or behavioral changes were introduced.

Resolves two dependabot alerts on main:
- HIGH google.golang.org/grpc: xDS RBAC and HTTP/2 vulnerabilities (fixed 1.82.1)
- MEDIUM golang.org/x/net: HTML parser DoS (fixed 0.55.0)
Both are indirect deps; go mod tidy also pulled x/sys 0.42.0->0.45.0,
x/text 0.34.0->0.37.0, and the matching genproto/googleapis/rpc. build/vet/
test/lint all green.
@coderabbitai

coderabbitaiBot commented Aug 25, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 410609cf-7243-42dc-9382-c1fc518f01b5

📥 Commits

Reviewing files that changed from the base of the PR and between 7a1265a and 3a2a5b5.

⛔ Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
📒 Files selected for processing (1)
  • go.mod

Included review availability: Your plan provides up to 12 included reviews per hour; 7 remain after this review.


Walkthrough

The pull request updates selected indirect Go dependencies in go.mod. The oauth2 and x/sync versions remain unchanged.

Changes

Go dependency updates

Layer / File(s)Summary
Indirect dependency version updates
go.mod
Updates x/net, x/sys, x/text, genproto, and grpc. Retains the existing oauth2 and x/sync versions.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk:⚪ Minimal · up to 3a2a5

This change updates indirect Go dependencies to patched versions and adjusts their checksums; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly identifies the dependency updates for grpc and x/net and states that they address Dependabot alerts. It accurately reflects the main change.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch rc-dep-bumps-grpc-net

Comment @coderabbitai help to get the list of available commands.

@robbycochran
robbycochran merged commit 8f025ff into mainAug 25, 2026
7 checks passed
@robbycochran
robbycochran deleted the rc-dep-bumps-grpc-net branch August 25, 2026 21:45
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@robbycochran