Skip to content

build(deps): Bump Go example gRPC client dependencies (#919) - #920

Merged
mc-nv merged 1 commit into
mainfrom
mchornyi/TRI-1691/before-ngc-release-advance-master-branch-to-next-upstream-release
Sep 2, 2026
Merged

mc-nv merged 1 commit into
mainfrom
mchornyi/TRI-1691/before-ngc-release-advance-master-branch-to-next-upstream-release

Conversation

@mc-nv

@mc-nv mc-nv commented Sep 1, 2026 •

Copy link
Copy Markdown
Contributor

What does the PR do?

  • Carries the Go example gRPC client dependency bump forward from r26.08 onto main.
  • Straight cherry-pick of 77e666d5; no edits beyond the original.

Checklist

  • PR title reflects the change and is of format <commit_type>: <Title>
  • Changes are described in the pull request.
  • Related issues are referenced.
  • Populated github labels field
  • Added test plan and verified test passes.
  • Verified that the PR passes existing CI.
  • Verified copyright is correct on all changed files.
  • Added succinct git squash message before merging ref.
  • All template sections are filled out.
  • Optional: Additional screenshots for behavior/output changes with before/after.

Commit Type:

Check the conventional commit type
box here and add the label to the github PR.

  • build
  • ci
  • docs
  • feat
  • fix
  • perf
  • refactor
  • revert
  • style
  • test

Related PRs:

Where should the reviewer start?

src/grpc_generated/go/go.mod — the dependency set being bumped.

Test plan:

  • Full CI run on the internal pipeline at TRITON_CONTAINER_VERSION=26.09dev_user, with TRITON_NIGHTLY=1 and TRITON_SBSA=1.

  • Local verification: per-repo pre-commit run --files <changed> passes with no auto-fixes.

  • CI Pipeline ID:

Caveats:

  • Do not merge before the model-repository mount point is rotated: TRITON_SERVER_MODEL_REPO_VERSION derives from TRITON_CONTAINER_VERSION, so 26.09dev must exist on the share first.

Background

Post-release step of the 26.08 train: the default branches move onto the same upstream containers as the just-released r26.08, and pick up the fixes that landed only on the release branch while it stabilised.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

  • Relates to: TRI-1691

* build(deps): Bump Go example gRPC client dependencies (TRI-1683)

Clears every open advisory reported by OSV against the resolved build
list of src/grpc_generated/go:

- google.golang.org/grpc v1.80.0 -> v1.83.2
  GHSA-hrxh-6v49-42gf / GO-2026-6061 (xDS RBAC + HTTP/2 server), fixed
  in 1.82.1. This was the only advisory govulncheck found reachable from
  the example.
- golang.org/x/net v0.49.0 -> v0.58.0
  CVE-2026-33814, CVE-2026-42506, CVE-2026-39821, CVE-2026-42502,
  CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-46600.
- golang.org/x/sys v0.40.0 -> v0.47.0 (CVE-2026-39824)
- golang.org/x/text v0.33.0 -> v0.41.0 (CVE-2026-56852)
- google.golang.org/protobuf v1.36.11 -> v1.36.12
- google.golang.org/genproto/googleapis/rpc bumped to match grpc v1.83.2

CVE-2026-33186 (gRPC-Go authorization bypass via a missing leading slash
in :path, fixed in 1.79.3) was already covered by the previous v1.80.0
pin; it is re-confirmed clear here.

The go directive moves 1.25.0 -> 1.25.14 so the module requires a Go
toolchain that carries the patched standard library; 46 stdlib
advisories apply to 1.25.0, the newest fixed in 1.25.13.

Verified in a golang:1.25 container (go1.25.14) against stubs generated
from common/protobuf: go mod tidy is a no-op, go build, go vet and
staticcheck are clean, and govulncheck reports 'No vulnerabilities
found' (it reported GO-2026-6061 as reachable before the bump).

* fix: Replace deprecated grpc.Dial/WithInsecure in Go example (TRI-1683)

grpc.Dial and grpc.WithInsecure are deprecated in gRPC-Go (staticcheck
SA1019, and some SCA tools flag WithInsecure as an insecure-transport
pattern). Switch to grpc.NewClient with an explicit
insecure.NewCredentials() transport.

The example still connects in plaintext -- it targets a local Triton
instance -- but the choice is now explicit rather than implied by a
deprecated helper, and a comment points at credentials.NewTLS for
remote endpoints.

Note one deliberate behaviour change: grpc.Dial defaulted to the
passthrough resolver, grpc.NewClient defaults to dns. With the
documented default target (-u localhost:8001) the address now goes
through the system resolver, which can return ::1 ahead of 127.0.0.1.
Both forms remain lazy, and every RPC in the example already carries its
own 10s context deadline. This was not exercised against a live server.

Verified in a golang:1.25 container (go1.25.14): gofmt clean, go build,
go vet and staticcheck clean, govulncheck reports no vulnerabilities.
The client repo has no Go CI job (.github/workflows runs pre-commit and
a Python-only CodeQL), so nothing in CI builds this module.

(cherry picked from commit 77e666d)
@greptile-apps

greptile-apps Bot commented Sep 1, 2026

Copy link
Copy Markdown

Greptile Summary

The PR updates the generated Go gRPC example’s Go, gRPC, protobuf, and transitive dependency versions while migrating the example from deprecated plaintext dialing APIs.

  • Raises the module’s Go directive and refreshes dependency checksums.
  • Replaces grpc.Dial and grpc.WithInsecure with grpc.NewClient and explicit insecure transport credentials.
  • Updates the example’s copyright year.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure identified.

The dependency refresh and gRPC API migration preserve the example’s existing transport behavior, and the investigated compatibility and connection concerns did not establish an actionable regression.

Important Files Changed

Filename Overview
src/grpc_generated/go/go.mod Updates the Go toolchain floor and direct and indirect gRPC-related dependencies without an established compatibility defect.
src/grpc_generated/go/go.sum Refreshes module checksums consistently with the dependency updates.
src/grpc_generated/go/grpc_simple_client.go Migrates the example to the current gRPC client-construction API while preserving plaintext transport semantics.

Reviews (1): Last reviewed commit: "build(deps): Bump Go example gRPC client..." | Re-trigger Greptile

@mc-nv
mc-nv merged commit ff9250e into main Sep 2, 2026
4 checks passed
@mc-nv
mc-nv deleted the mchornyi/TRI-1691/before-ngc-release-advance-master-branch-to-next-upstream-release branch September 2, 2026 01:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

build Build system or external dependencies (build: PRs) cherry-pick Cherry-picked from another branch

Development

Successfully merging this pull request may close these issues.

2 participants