chore(deps): bump grpc to v1.82.1 and otel to v1.44.0 for GO-2026-6061 (BUG-2361) - #1050
Open
xarmian wants to merge 1 commit into
Open
chore(deps): bump grpc to v1.82.1 and otel to v1.44.0 for GO-2026-6061 (BUG-2361)#1050xarmian wants to merge 1 commit into
xarmian wants to merge 1 commit into
Conversation
…(BUG-2361) grpc v1.79.3 is affected by GO-2026-6061 (xDS RBAC authorization engine and HTTP/2 transport server). It reaches us indirectly via internal/oauth -> ory/fosite -> ory/x/otelx -> otlptracehttp -> grpc. The bump pulls otel v1.42.0 -> v1.43.0 as grpc's required floor, which re-exposes GO-2026-5158 (uncapped baggage header parsing). Per the otel lockstep policy, otel/metric/trace/sdk all move together to v1.44.0, which clears it. make vuln is now completely clean (0 call-reachable vulnerabilities). Claude-Session: https://claude.ai/code/session_01E2fRi12n8rARczvdEa2LYT
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes BUG-2361.
make vuln(and CI's Go job) was failing on every branch includingmain:Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation.
grpcis indirect here:internal/oauth → ory/fosite → ory/x/otelx → otel otlptracehttp → grpc.The two-hop trap fired
go get google.golang.org/grpc@v1.82.1alone dragged otel v1.42.0 → v1.43.0 (grpc's own floor), which re-exposed GO-2026-5158 — uncapped baggage header parsing, call-reachable viabaggage.New/baggage.Parse/propagation.Baggage.Extract. This is the same shape as the 2026-07-24 otel bump, which also needed two hops.Second hop: otel core / metric / trace / sdk → v1.44.0 in lockstep, per the project's otel policy.
Version changes
google.golang.org/grpcgo.opentelemetry.io/otelgo.opentelemetry.io/otel/metricgo.opentelemetry.io/otel/tracego.opentelemetry.io/otel/sdkgolang.org/x/oauth2google.golang.org/genproto/googleapis/apigoogle.golang.org/genproto/googleapis/rpcgoogle.golang.org/protobufEverything below the otel quartet is grpc v1.82.1's own requirement floor. No
godirective ortoolchainchange, no code changes, all otel exporter/contrib packages left at their existing pins.go.mod+go.sumonly.Remaining advisories are pre-existing and not call-reachable
make vulnexits 0 — "Your code is affected by 0 vulnerabilities." The trailing "4 vulnerabilities in packages you import and 1 in modules you require" line is not a failure and is unchanged frommain: GO-2026-5777 / -5775 / -5774 (go-chi/chi/v5v5.2.5, fixed in v5.3.0), GO-2026-4985 (otlptracehttpv1.21.0), GO-2026-5932 (golang.org/x/cryptov0.53.0, no fix available). The chi bump is a plausible follow-up if it ever becomes reachable; out of scope for this narrow fix.Test plan
make vuln→ clean, exit 0golangci-lint run --timeout=5m ./...→ 0 issuesgo test ./...→ greenmake test-pg→ greenCodex reviewed twice, both CLEAN. The second round ran with
workspace-writeso it could executegodirectly, and specifically probed intra-family otel version skew (core at v1.44.0 while exporters sit at v1.21.0/v1.17.0 and contrib at v0.46.1): MVS resolves a single otel API family, so the older exporters compile against v1.44.0 with no separately-linked v1.21 interface to mismatch.go mod verifypasses. It also confirmed fosite does callory/x/otelx.End, but this repo configures no tracer or exporter, so it takes the no-op path.Found while running the gate of record for PLAN-2357; kept out of that feature PR (#1048) deliberately so a feature merge isn't coupled to a dependency bump. This unblocks #1048 and every other open PR.
🤖 Generated with Claude Code
https://claude.ai/code/session_01E2fRi12n8rARczvdEa2LYT