Repository navigation
build(deps): Bump Go example gRPC client dependencies (#919) - #920
Merged
mc-nv merged 1 commit intoSep 2, 2026
Conversation
* build(deps): Bump Go example gRPC client dependencies (TRI-1683) Clears every open advisory reported by OSV against the resolved build list of src/grpc_generated/go: - google.golang.org/grpc v1.80.0 -> v1.83.2 GHSA-hrxh-6v49-42gf / GO-2026-6061 (xDS RBAC + HTTP/2 server), fixed in 1.82.1. This was the only advisory govulncheck found reachable from the example. - golang.org/x/net v0.49.0 -> v0.58.0 CVE-2026-33814, CVE-2026-42506, CVE-2026-39821, CVE-2026-42502, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-46600. - golang.org/x/sys v0.40.0 -> v0.47.0 (CVE-2026-39824) - golang.org/x/text v0.33.0 -> v0.41.0 (CVE-2026-56852) - google.golang.org/protobuf v1.36.11 -> v1.36.12 - google.golang.org/genproto/googleapis/rpc bumped to match grpc v1.83.2 CVE-2026-33186 (gRPC-Go authorization bypass via a missing leading slash in :path, fixed in 1.79.3) was already covered by the previous v1.80.0 pin; it is re-confirmed clear here. The go directive moves 1.25.0 -> 1.25.14 so the module requires a Go toolchain that carries the patched standard library; 46 stdlib advisories apply to 1.25.0, the newest fixed in 1.25.13. Verified in a golang:1.25 container (go1.25.14) against stubs generated from common/protobuf: go mod tidy is a no-op, go build, go vet and staticcheck are clean, and govulncheck reports 'No vulnerabilities found' (it reported GO-2026-6061 as reachable before the bump). * fix: Replace deprecated grpc.Dial/WithInsecure in Go example (TRI-1683) grpc.Dial and grpc.WithInsecure are deprecated in gRPC-Go (staticcheck SA1019, and some SCA tools flag WithInsecure as an insecure-transport pattern). Switch to grpc.NewClient with an explicit insecure.NewCredentials() transport. The example still connects in plaintext -- it targets a local Triton instance -- but the choice is now explicit rather than implied by a deprecated helper, and a comment points at credentials.NewTLS for remote endpoints. Note one deliberate behaviour change: grpc.Dial defaulted to the passthrough resolver, grpc.NewClient defaults to dns. With the documented default target (-u localhost:8001) the address now goes through the system resolver, which can return ::1 ahead of 127.0.0.1. Both forms remain lazy, and every RPC in the example already carries its own 10s context deadline. This was not exercised against a live server. Verified in a golang:1.25 container (go1.25.14): gofmt clean, go build, go vet and staticcheck clean, govulncheck reports no vulnerabilities. The client repo has no Go CI job (.github/workflows runs pre-commit and a Python-only CodeQL), so nothing in CI builds this module. (cherry picked from commit 77e666d)
This was referenced Sep 1, 2026
mc-nv
marked this pull request as ready for review
September 1, 2026 19:19
Greptile SummaryThe PR updates the generated Go gRPC example’s Go, gRPC, protobuf, and transitive dependency versions while migrating the example from deprecated plaintext dialing APIs.
Confidence Score: 5/5The PR appears safe to merge, with no concrete changed-code failure identified. The dependency refresh and gRPC API migration preserve the example’s existing transport behavior, and the investigated compatibility and connection concerns did not establish an actionable regression. Important Files Changed
Reviews (1): Last reviewed commit: "build(deps): Bump Go example gRPC client..." | Re-trigger Greptile |
yinggeh
approved these changes
Sep 1, 2026
mc-nv
deleted the
mchornyi/TRI-1691/before-ngc-release-advance-master-branch-to-next-upstream-release
branch
September 2, 2026 01:53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does the PR do?
r26.08ontomain.77e666d5; no edits beyond the original.Checklist
<commit_type>: <Title>Commit Type:
Check the conventional commit type
box here and add the label to the github PR.
Related PRs:
Where should the reviewer start?
src/grpc_generated/go/go.mod— the dependency set being bumped.Test plan:
Full CI run on the internal pipeline at
TRITON_CONTAINER_VERSION=26.09dev_user, withTRITON_NIGHTLY=1andTRITON_SBSA=1.Local verification: per-repo
pre-commit run --files <changed>passes with no auto-fixes.CI Pipeline ID:
Caveats:
TRITON_SERVER_MODEL_REPO_VERSIONderives fromTRITON_CONTAINER_VERSION, so26.09devmust exist on the share first.Background
Post-release step of the 26.08 train: the default branches move onto the same upstream containers as the just-released
r26.08, and pick up the fixes that landed only on the release branch while it stabilised.Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)