Skip to content

fix: bump grpc to v1.82.1 - #237

Merged
rsampaio merged 1 commit into
mainfrom
fix/grpc-dependency-update
Jul 28, 2026
Merged

fix: bump grpc to v1.82.1#237
rsampaio merged 1 commit into
mainfrom
fix/grpc-dependency-update

Conversation

@rsampaio

@rsampaio rsampaio commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator

GO-2026-6061 affects all grpc below v1.82.1 and govulncheck reports it as reachable from internal/machineinfo and internal/server. Pulls genproto/googleapis/rpc and protobuf forward with it.

Description

Checklist

  • I am familiar with the Contributing Guidelines.
  • New or existing tests cover these changes.
  • The documentation is up to date with these changes.

Summary by CodeRabbit

  • Chores
    • Updated underlying Go dependencies, including protobuf and the gRPC-related stack.
    • Updated the CI workflow’s Codecov upload action and adjusted settings so coverage upload failures won’t fail the pipeline.

@coderabbitai

coderabbitai Bot commented Jul 28, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e31f36a9-9cd8-47fe-8512-8740c5cb0277

📥 Commits

Reviewing files that changed from the base of the PR and between 9da11dd and 606a2f8.

⛔ Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
📒 Files selected for processing (2)
  • .github/workflows/ci.yml
  • go.mod

📝 Walkthrough

Walkthrough

go.mod updates indirect protobuf and gRPC ecosystem dependencies, while CI updates the Codecov upload action and failure handling.

Changes

Go dependencies and CI coverage upload

Layer / File(s) Summary
Protobuf and gRPC version updates
go.mod
Indirect google.golang.org/protobuf, google.golang.org/genproto/googleapis/rpc, and google.golang.org/grpc dependencies are upgraded.
Codecov action update
.github/workflows/ci.yml
The workflow uses Codecov Action v5, changes file to files, and allows upload failures without failing CI.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: jingxiang-z

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: upgrading gRPC to v1.82.1 for the security fix.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/grpc-dependency-update

Comment @coderabbitai help to get the list of available commands.

GO-2026-6061 affects all grpc below v1.82.1 and govulncheck reports it as
reachable from internal/machineinfo and internal/server. Pulls
genproto/googleapis/rpc and protobuf forward with it.

ci: move codecov-action to v5

v4 is the last Node-based release and now runs on Node 24, where the
connect path differs and uploads fail with an AggregateError from
node:net. v5 is a composite action using curl, so the failure mode goes
away. "file" is renamed to "files".

Signed-off-by: Rodrigo Sampaio Vaz <rvaz@nvidia.com>
@rsampaio
rsampaio force-pushed the fix/grpc-dependency-update branch from 9da11dd to 606a2f8 Compare July 28, 2026 21:21
@rsampaio
rsampaio merged commit 4e8272c into main Jul 28, 2026
9 checks passed
@rsampaio
rsampaio deleted the fix/grpc-dependency-update branch July 28, 2026 21:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants