chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3#256
chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3#256dependabot[bot] wants to merge 1 commit intomasterfrom
Conversation
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.78.0 to 1.79.3. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.78.0...v1.79.3) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
dependabot
bot
added
dependencies
Codacy's Analysis Summary0 new issues (≤ 1 medium issue)
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR updates google.golang.org/grpc from 1.78.0 to 1.79.3. Although the Codacy analysis is 'up to standards', this version includes a security fix (CVE-2025-24968) that introduces a breaking behavior change: requests with non-canonical paths (e.g., missing a leading slash) will now be rejected with an 'Unimplemented' error. This change, along with the transition from 'Address' handling to 'Endpoints' in load balancing, represents a significant regression risk for existing client implementations and custom balancing configurations.
About this PR
- The gRPC security fix introduces a breaking change where non-canonical paths are rejected. Verify that all client implementations (including those not using standard gRPC libraries) send valid, canonical paths to avoid service disruption.
Test suggestions
- Verify application compilation and initialization with gRPC 1.79.3.
- Verify that gRPC server interceptors/rules still function correctly given the new strict path checking (security fix #8981).
- Confirm that existing load balancing configurations (specifically weighted targets) are compatible with the removal of Address handling in favor of Endpoints.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify application compilation and initialization with gRPC 1.79.3.
2. Verify that gRPC server interceptors/rules still function correctly given the new strict path checking (security fix #8981).
3. Confirm that existing load balancing configurations (specifically weighted targets) are compatible with the removal of Address handling in favor of Endpoints.
Low confidence findings
- The update includes experimental API changes (e.g., mem.SetDefaultBufferPool) and shifts from Address to Endpoints in load balancing. Review any internal extensions or custom balancers to ensure compatibility with these removals.
🗒️ Improve review quality by adding custom instructions
1 participant
Bumps google.golang.org/grpc from 1.78.0 to 1.79.3.
Release notes
Sourced from google.golang.org/grpc's releases.
Commits
dda86dbChange version to 1.79.3 (#8983)72186f1grpc: enforce strict path checking for incoming requests on the server (#8981)97ca352Changing version to 1.79.3-dev (#8954)8902ab6Change the version to release 1.79.2 (#8947)a928670Cherry-pick #8874 to v1.79.x (#8904)06df363Change version to 1.79.2-dev (#8903)782f2deChange version to 1.79.1 (#8902)850eccbChange version to 1.79.1-dev (#8851)765ff05Change version to 1.79.0 (#8850)68804beCherry pick #8864 to v1.79.x (#8896)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.