Skip to content

Bump google.golang.org/grpc from 1.40.0 to 1.56.3 in /supply_chain_security#7

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/supply_chain_security/google.golang.org/grpc-1.56.3
Open

Bump google.golang.org/grpc from 1.40.0 to 1.56.3 in /supply_chain_security#7
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/supply_chain_security/google.golang.org/grpc-1.56.3

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Oct 25, 2023

Bumps google.golang.org/grpc from 1.40.0 to 1.56.3.

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.56.3

Security

  • server: prohibit more than MaxConcurrentStreams handlers from running at once (CVE-2023-44487)

    In addition to this change, applications should ensure they do not leave running tasks behind related to the RPC before returning from method handlers, or should enforce appropriate limits on any such work.

Release 1.56.2

  • status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.56.1

  • client: handle empty address lists correctly in addrConn.updateAddrs

Release 1.56.0

New Features

  • client: support channel idleness using WithIdleTimeout dial option (#6263)
    • This feature is currently disabled by default, but will be enabled with a 30 minute default in the future.
  • client: when using pickfirst, keep channel state in TRANSIENT_FAILURE until it becomes READY (gRFC A62) (#6306)
  • xds: Add support for Custom LB Policies (gRFC A52) (#6224)
  • xds: support pick_first Custom LB policy (gRFC A62) (#6314) (#6317)
  • client: add support for pickfirst address shuffling (gRFC A62) (#6311)
  • xds: Add support for String Matcher Header Matcher in RDS (#6313)
  • xds/outlierdetection: Add Channelz Logger to Outlier Detection LB (#6145)
  • xds: enable RLS in xDS by default (#6343)
  • orca: add support for application_utilization field and missing range checks on several metrics setters
  • balancer/weightedroundrobin: add new LB policy for balancing between backends based on their load reports (gRFC A58) (#6241)
  • authz: add conversion of json to RBAC Audit Logging config (#6192)
  • authz: add support for stdout logger (#6230 and #6298)
  • authz: support customizable audit functionality for authorization policy (#6192 #6230 #6298 #6158 #6304 and #6225)

Bug Fixes

  • orca: fix a race at startup of out-of-band metric subscriptions that would cause the report interval to request 0 (#6245)
  • xds/xdsresource: Fix Outlier Detection Config Handling and correctly set xDS Defaults (#6361)
  • xds/outlierdetection: Fix Outlier Detection Config Handling by setting defaults in ParseConfig() (#6361)

API Changes

  • orca: allow a ServerMetricsProvider to be passed to the ORCA service and ServerOption (#6223)

Release 1.55.1

  • status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

Release 1.55.0

Behavior Changes

  • xds: enable federation support by default (#6151)
  • status: status.Code and status.FromError handle wrapped errors (#6031 and #6150)

... (truncated)

Commits
  • 1055b48 Update version.go to 1.56.3 (#6713)
  • 5efd7bd server: prohibit more than MaxConcurrentStreams handlers from running at once...
  • bd1f038 Upgrade version.go to 1.56.3-dev (#6434)
  • faab873 Update version.go to v1.56.2 (#6432)
  • 6b0b291 status: fix panic when servers return a wrapped error with status OK (#6374) ...
  • ed56401 [PSM interop] Don't fail target if sub-target already failed (#6390) (#6405)
  • cd6a794 Update version.go to v1.56.2-dev (#6387)
  • 5b67e5e Update version.go to v1.56.1 (#6386)
  • d0f5150 client: handle empty address lists correctly in addrConn.updateAddrs (#6354) ...
  • 997c1ea Change version to 1.56.1-dev (#6345)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.40.0 to 1.56.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.40.0...v1.56.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Oct 25, 2023
@PauloSilvaNova8
Copy link
Copy Markdown

Logo
Checkmarx One – Scan Summary & Details4b5bd144-d4b1-44be-a3ff-27690b9b233b

New Issues

Severity Issue Source File / Package Checkmarx Insight
HIGH CVE-2017-1000048 Npm-qs-6.0.0 Vulnerable Package
HIGH CVE-2019-10744 Npm-lodash-4.17.11 Vulnerable Package
HIGH CVE-2020-7212 Python-urllib3-1.25.7 Vulnerable Package
HIGH CVE-2020-8203 Npm-lodash-4.17.11 Vulnerable Package
HIGH CVE-2021-23337 Npm-lodash-4.17.11 Vulnerable Package
HIGH CVE-2021-33503 Python-urllib3-1.25.7 Vulnerable Package
HIGH CVE-2021-4229 Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH CVE-2022-24999 Npm-qs-6.0.0 Vulnerable Package
HIGH CVE-2022-25927 Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH CVE-2023-30861 Python-Flask-2.0.2 Vulnerable Package
HIGH CVE-2023-43804 Python-urllib3-1.25.7 Vulnerable Package
HIGH Cx0a21eeca-49b1 Npm-scs-0.0.1 Vulnerable Package
HIGH Cx0b414307-5d4b Npm-lodash-4.17.11 Vulnerable Package
HIGH Cx0b915a4a-2d97 Npm-scs-0.0.1 Vulnerable Package
HIGH Cx0eb7d3da-c52e Python-azure-powerbiembedded-6969.99.99 Vulnerable Package
HIGH Cx18e041aa-8a63 Npm-node-ipc-9.2.2 Vulnerable Package
HIGH Cx21f588f7-f9cb Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH Cx4ca27ec0-0c96 Npm-scs-0.0.1 Vulnerable Package
HIGH Cx4d89cd75-1e27 Python-azure-powerbiembedded-6969.99.99 Vulnerable Package
HIGH Cx68e4da20-b53a Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH Cx6bee2138-4df0 Npm-flow-dev-tools-99.10.9 Vulnerable Package
HIGH Cx6eb8ff4e-c9cf Npm-flow-dev-tools-99.10.9 Vulnerable Package
HIGH Cx7401d0a9-2786 Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH Cx8079a3fb-ff1f Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH Cx8147ddef-ae09 Python-azure-powerbiembedded-6969.99.99 Vulnerable Package
HIGH Cx86e7ca06-a018 Python-not-particularly-2.5.0 Vulnerable Package
HIGH Cx9f739bef-35bb Npm-flow-dev-tools-99.10.9 Vulnerable Package
HIGH Cxa45b0853-bee2 Npm-momnet-2.29.1 Vulnerable Package
HIGH Cxae9d1b09-2adb Npm-scs-0.0.1 Vulnerable Package
HIGH Cxb52dba53-66d2 Python-not-particularly-2.5.0 Vulnerable Package
HIGH Cxb667b900-bec1 Python-azure-powerbiembedded-6969.99.99 Vulnerable Package
HIGH Cxba94c01e-a95d Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH Cxbec87a55-fe55 Npm-node-ipc-9.2.2 Vulnerable Package
HIGH Cxc73fdf59-ac18 Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH Cxcc09496a-59c8 Npm-js-yaml-3.6.1 Vulnerable Package
HIGH Cxccd8b30c-808c Npm-scs-0.0.1 Vulnerable Package
HIGH Cxd55dbf56-4d06 Npm-scs-0.0.1 Vulnerable Package
HIGH Cxdca8e59f-8bfe Npm-inflight-1.0.6 Vulnerable Package
HIGH Cxec49316b-56df Npm-js-yaml-3.6.1 Vulnerable Package
HIGH Cxfd197ca1-b64b Npm-momnet-2.29.1 Vulnerable Package
MEDIUM CVE-2020-26137 Python-urllib3-1.25.7 Vulnerable Package
MEDIUM CVE-2020-28500 Npm-lodash-4.17.11 Vulnerable Package
MEDIUM CVE-2023-45803 Python-urllib3-1.25.7 Vulnerable Package
MEDIUM Cx3bb8deb1-b4c0 Npm-scs-0.0.1 Vulnerable Package
MEDIUM Cx3cf24ca3-dd23 Npm-ua-parser-js-0.7.29 Vulnerable Package
MEDIUM Cx65afcea4-5e85 Npm-event-pubsub-5.0.3 Vulnerable Package
MEDIUM Cx743605c8-a95e Npm-momnet-2.29.1 Vulnerable Package
MEDIUM Cxa29f6cb5-3c84 Python-azure-powerbiembedded-6969.99.99 Vulnerable Package
MEDIUM Cxba768ce4-aa4e Npm-node-ipc-9.2.2 Vulnerable Package
MEDIUM Cxc09edd5e-4a9e Npm-strong-type-0.1.6 Vulnerable Package
MEDIUM Cxf7a33198-8ff8 Npm-node-ipc-9.2.2 Vulnerable Package

Fixed Issues

Severity Issue Source File / Package
HIGH CVE-2021-28235 Go-go.etcd.io/etcd/server/v3-v3.5.0
HIGH CVE-2022-1996 Go-github.com/emicklei/go-restful-v2.9.5
HIGH CVE-2022-21698 Go-github.com/prometheus/client_golang-v1.11.0
HIGH CVE-2022-27191 Go-golang.org/x/crypto-v0.0.0-20211202192323-5770296d904e
HIGH CVE-2022-28948 Go-gopkg.in/yaml.v3-v3.0.0-20210107192922-496545a6307b
HIGH CVE-2022-32149 Go-golang.org/x/text-v0.3.7
HIGH CVE-2022-34038 Go-go.etcd.io/etcd/pkg/v3-v3.5.0
HIGH CVE-2022-41723 Go-golang.org/x/net-v0.0.0-20220225172249-27dd8689420f
HIGH CVE-2023-37788 Go-github.com/elazarl/goproxy-v0.0.0-20180725130230-947c36da3153
MEDIUM CVE-2020-8554 Go-k8s.io/api-v0.23.5
MEDIUM CVE-2022-29526 Go-golang.org/x/sys-v0.0.0-20211216021012-1d35b9e2eb4e
MEDIUM CVE-2022-41717 Go-golang.org/x/net-v0.0.0-20220225172249-27dd8689420f
MEDIUM CVE-2023-2253 Go-github.com/docker/distribution-v0.0.0-20180920194744-16128bbac47f
MEDIUM CVE-2023-32082 Go-go.etcd.io/etcd/server/v3-v3.5.0
MEDIUM CVE-2023-3978 Go-golang.org/x/net-v0.0.0-20220225172249-27dd8689420f
MEDIUM CVE-2023-44487 Go-golang.org/x/net-v0.0.0-20220225172249-27dd8689420f
LOW Cx786c6ee9-1022 Go-github.com/opencontainers/image-spec-v1.0.1
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 111
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 109
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 108
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 106
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 101
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 99
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 97
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 96
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 95
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 94
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 93
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 92
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 66
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 65
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 63
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 61
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 60
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 47
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 30
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 22
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 11
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 10
LOW TruffleHog_HighEntropy_Strings /supply_chain_security/go.mod: 9
LOW TruffleHog_Regex_Matches /.cxsca-results.json: 1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant