gsadmin/pad
1
0
Fork 0
mirror of https://github.com/PerpetualSoftware/pad.git synced 2026-09-10 23:15:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(deps): bump google.golang.org/grpc 1.83.0 -> 1.83.2 (BUG-2986)

Browse Source 
Clears three advisories, all indirect:

  GHSA-2v4p-qf9q-27wj  high    xDS servers: DoS crash on missing
                               :authority/Host  (patched 1.83.2)
  GHSA-vp52-pcj8-j9qc  high    Heap exhaustion via HTTP/2 DATA frame
                               fragmentation  (patched 1.83.1)
  GHSA-qc2q-p7wx-3px3  medium  xDS RBAC filter bypass via mixed-case
                               header matching  (patched 1.83.1)

grpc arrives through internal/oauth -> ory/fosite -> ory/x/otelx ->
otlptracehttp; pad names it nowhere. Reachability, measured with
go list -deps ./cmd/pad rather than assumed — that reports dependency
GRAPH membership, not final linker inclusion, which is enough for the
question here and is not the same claim:

  - xDS: ZERO packages in the graph, so both xDS advisories are absent
    from this build rather than merely unexercised.
  - grpc/internal/transport IS in the graph (4 packages), which is where
    the DATA-frame advisory lives. That package is the SHARED client and
    server transport, so its presence says nothing either way; what
    settles it is the advisory's attack model, which needs an inbound
    gRPC server stream. pad starts only its HTTP server, constructs no
    gRPC server, contains no grpc.* call in internal/ or cmd/, and wires
    no OTel exporter — the transport is in the graph because
    otlptracehttp compiles grpc configuration types.

So this bump changes no behaviour pad can exercise TODAY, which is a
statement about the current call graph and not a promise about the next
caller. It is worth taking anyway: one line, and it clears three alerts
that would otherwise sit open beside a real one, which is how a real one
gets missed.

Minimal diff by construction: one line of go.mod, two of go.sum;
go mod tidy -diff is empty. Gates: build, go test ./..., go vet,
golangci-lint all clean. Codex CLEAN (CONVE-735), and the two precision
corrections it made are folded into the wording above.
This commit is contained in:
xarmian
2026-09-10 17:25:55 +00:00
parent 524469b7a3
commit 72510d40f7
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+1 -1
View File
@@ -137,7 +137,7 @@ require (
golang.org/x/tools v0.48.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
google.golang.org/grpc v1.83.0 // indirect
google.golang.org/grpc v1.83.2 // indirect
google.golang.org/protobuf v1.36.12 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
go.sum
+2 -2
View File
@@ -937,8 +937,8 @@ google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM
google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=
google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=