Repository navigation
build(deps): update gRPC to 1.83.1 - #100
Merged
jglogan merged 1 commit intoOct 22, 2026
Merged
Conversation
stephenlclarke
force-pushed
the
upstream/grpc-http2-fragmentation
branch
from
September 28, 2026 08:03
b8ba887 to
68b576f
Compare
stephenlclarke
force-pushed
the
upstream/grpc-http2-fragmentation
branch
from
October 21, 2026 17:30
68b576f to
093f3df
Compare
jglogan
approved these changes
Oct 22, 2026
jglogan
left a comment
jglogan
left a comment
Contributor
There was a problem hiding this comment.
@stephenlclarke Thank you for this update!
Validated integrity of go.mod, go.sum, and vendored file changes manually.
I'll add an automated check and workflow update in a follow-on.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update
google.golang.org/grpcfrom 1.80.0 to 1.83.1 and regenerate the checked-in module metadata and vendor tree with the repository's Go 1.25.5 toolchain.This resolves GHSA-vp52-pcj8-j9qc / CVE-2026-84304, a heap-exhaustion issue caused by HTTP/2 DATA-frame fragmentation. Version 1.83.1 is the first patched release.
The Go module solver also raises the companion OpenTelemetry,
x/*, andgenprotoversions required by gRPC 1.83.1. No application source or public API changes are included.Testing
GOTOOLCHAIN=go1.25.5 go mod verifyGOTOOLCHAIN=go1.25.5 go test -mod=vendor ./pkg/api ./pkg/build/... ./pkg/fssync ./pkg/server ./pkg/streamgo mod tidy && go mod vendorunder Go 1.25.5;git diff --exit-coderemained clean.The focused
go vetinvocation reports two existingprotoimpl.MessageStatelock-copy warnings inpkg/fssync/diffcopy_test.go; the same warnings reproduce unchanged at base commite18d2182fd060dbf1c68113a74e7564d563dde27.Risk
The change is dependency-only. The vendored delta is larger than the direct version line because gRPC 1.83.1 advances minimum transitive versions; it is generated deterministically by the dependency command already enforced by CI.