fix: [FL-30189] Pin grpc v1.82.1 and otel v1.44.0 via replace directives by josue · Pull Request #104 · flume/enthistory

josue · 2026-07-30T08:11:07Z

Description

Adds replace google.golang.org/grpc => google.golang.org/grpc v1.82.1 to _examples/go.mod and updates _examples/go.sum accordingly. grpc is a module-graph ghost dependency of the examples module (nothing in _examples imports it — it arrives via entgo.io/contrib), so the replace-pin pattern already used for x/crypto, x/net, x/sys, and goldmark (ghost-vuln patches #98/#100/#101) is applied here, matching the v1.82.1 the root module adopted in #103.

Motivation and Context

Clears the last two open Snyk High findings in the org attributed to this repo — "Incorrect Authorization" in google.golang.org/grpc internal/transport and internal/xds/rbac (SNYK-GOLANG-GOOGLEGOLANGORGGRPCINTERNALTRANSPORT-18172578, SNYK-GOLANG-GOOGLEGOLANGORGGRPCINTERNALXDSRBAC-18172577), both against _examples/go.mod at grpc v1.81.1. Part of the FL-30189 vulnerability patch sweep (FL-30189).

How Has This Been Tested?

go mod tidy in _examples — go.sum now resolves grpc v1.82.1 (v1.81.1 gone)
go list -m google.golang.org/grpc → v1.82.1 => v1.82.1
go build ./... and go vet ./... in _examples — clean
make test (full _examples integration suite) — passing locally

Screenshots (if appropriate):

N/A — dependency pin only.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation (update or addition to documentation for this project)

Checklist:

My code follows the code style of this project.
I have updated the documentation accordingly. (N/A — dependency pin)
I have added tests to cover my changes. (N/A — no code change; existing integration suite covers the module)
All new and existing tests passed.

Addition (same day): otel v1.44.0 pin

Second commit c92bc59 clears the two Snyk Medium CVE-2026-41178 findings (otel baggage + propagation) the FL-30126 report had written off as "not upgradeable" — otel is another module-graph ghost arriving via grpc v1.82.1's requirements, so the same replace-pin pattern applies. Pinned in both go.mod and _examples/go.mod (the grpc pin would otherwise surface the finding in _examples on the next scan). Effective selection verified: v1.43.0 => v1.44.0 in both modules; root build + unit tests + full integration suite green.

Clears the two remaining Snyk High "Incorrect Authorization" findings (SNYK-GOLANG-GOOGLEGOLANGORGGRPCINTERNALTRANSPORT-18172578 and ...XDSRBAC-18172577) against _examples/go.mod. grpc is a module-graph ghost dependency here (not imported by any _examples package), so the fix uses the same replace-pin pattern as the existing x/crypto, x/net, x/sys, and goldmark pins from earlier ghost-vuln patches (#98, #100, #101), matching the v1.82.1 the root module moved to in #103.

flume-bot · 2026-07-30T08:12:55Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Copilot

Pull request overview

This pull request updates the _examples module’s dependency graph to ensure google.golang.org/grpc resolves to a patched version (v1.82.1) during example builds/tests, addressing Snyk findings for a transitive “ghost” dependency.

Changes:

Add a replace directive in _examples/go.mod to pin google.golang.org/grpc to v1.82.1.
Refresh _examples/go.sum to reflect the pinned grpc version and its resolved transitive module versions.
Update the indirect google.golang.org/genproto/googleapis/rpc version in _examples/go.mod consistent with the new resolution.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
`_examples/go.mod`	Pins grpc via `replace` and updates an indirect genproto version to match the resolved graph.
`_examples/go.sum`	Updates checksum entries to reflect grpc v1.82.1 (and related resolved versions).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Clears the two Snyk Medium "Memory Allocation with Excessive Size Value" findings (CVE-2026-41178; SNYK-GOLANG-GOOPENTELEMETRYIOOTELBAGGAGE-17054906, ...OTELPROPAGATION-17054905) against go.mod. otel is a module-graph ghost that arrives solely through grpc v1.82.1's requirements — it is not in go.sum and nothing imports it — so Snyk's "not upgradeable" verdict only means auto-upgrade can't reach it; the established replace-pin pattern can. Pinned in _examples/go.mod as well, since the grpc pin there would surface the same finding on the next scan. Root build, unit tests, and the full _examples integration suite all pass.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

_examples/go.mod:63

replace go.opentelemetry.io/otel => ... v1.44.0 does not appear to take effect for _examples as-is: _examples/go.sum contains no go.opentelemetry.io/otel entries at all. If this pin is meant to address Snyk findings via grpc’s transitive requirements, please confirm otel is actually present in the module graph for _examples (and update go.sum), or drop/adjust the pin to the module path that’s actually being pulled in.

replace go.opentelemetry.io/otel => go.opentelemetry.io/otel v1.44.0

go.mod:58

The new replace go.opentelemetry.io/otel => ... v1.44.0 appears to be a no-op in the current module graph: there are no go.opentelemetry.io/otel entries in go.sum. If the intent is to pin a transitive/ghost otel dependency (per PR description), please ensure it actually resolves in the build list (e.g., go list -m all shows otel) and that go.sum is updated accordingly; otherwise this replace directive is misleading and should be removed or adjusted to the correct otel submodule(s).

replace go.opentelemetry.io/otel => go.opentelemetry.io/otel v1.44.0

josue · 2026-07-30T08:55:16Z

Re: the two low-confidence review notes ("the otel replace may be a no-op — go.sum has no otel entries"):

The premise conflates go.sum with the module graph. go.sum records verification hashes for build-relevant modules, not dependency edges — under Go module graph pruning, a module that nothing imports contributes no go.sum entries even while sitting in the module graph. otel is exactly that: go mod graph shows the google.golang.org/grpc@v1.82.1 → go.opentelemetry.io/otel@v1.43.0 requirement edge in both modules.

The pin provably takes effect — go list -m go.opentelemetry.io/otel (the toolchain's authoritative MVS selection) in both modules:

go.opentelemetry.io/otel v1.43.0 => go.opentelemetry.io/otel v1.44.0

If otel weren't in the module graph, that command would error instead.

Exact in-repo precedent: the goldmark replace pin from the earlier ghost-vuln patch (#100) also has zero _examples/go.sum entries, and its Snyk finding cleared after merge — same class, same scan pipeline, proven outcome. Snyk documents replace-directive support for Go modules projects.

Skipping the "update go.sum" suggestion deliberately: go mod tidy prunes non-build modules from go.sum by design, so forcing entries would fight the toolchain for no effect. Worst case if Snyk ever disagreed, the finding simply persists on the post-merge rescan and we'd see it — the fix is self-evidencing, not silently wrong.

andrecastillo

Review — 2 finding(s).

The go.opentelemetry.io/otel replace in _examples/go.mod was a no-op: otel is not in the _examples module graph (`GOWORK=off go list -m go.opentelemetry.io/otel` -> "not a known dependency"; absent from `go list -m all`). The v1.43->v1.44 selection was only observable in workspace mode, where go.work leaks the root module's graph. The real _examples pin is the grpc v1.82.1 replace two lines up (present in _examples/go.sum). The root go.mod otel replace is kept — it governs the workspace build and is what makes enthistory's own Snyk scan green. Addresses review feedback on PR #104.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

_examples/go.mod:61

PR description says OpenTelemetry is pinned to v1.44.0 in both the root module and _examples, but _examples/go.mod only adds a grpc replace. If Snyk scans _examples/go.mod separately, the otel findings may still appear there when grpc pulls it into the module graph. Add the same otel replace directive here to match the stated intent.

replace google.golang.org/grpc => google.golang.org/grpc v1.82.1

josue requested a review from caseyh as a code owner July 30, 2026 08:11

Copilot AI review requested due to automatic review settings July 30, 2026 08:11

Copilot started reviewing on behalf of josue July 30, 2026 08:11 View session

Copilot AI reviewed Jul 30, 2026

View reviewed changes

josue changed the title ~~fix: [FL-30189] Pin grpc v1.82.1 in _examples via replace directive~~ fix: [FL-30189] Pin grpc v1.82.1 and otel v1.44.0 via replace directives Jul 30, 2026

Copilot AI review requested due to automatic review settings July 30, 2026 08:37

Copilot started reviewing on behalf of josue July 30, 2026 08:38 View session

Copilot AI reviewed Jul 30, 2026

View reviewed changes

andrecastillo reviewed Jul 30, 2026

View reviewed changes

Comment thread _examples/go.mod Outdated

Comment thread go.mod

Copilot AI review requested due to automatic review settings July 30, 2026 14:02

Copilot started reviewing on behalf of josue July 30, 2026 14:03 View session

Copilot AI reviewed Jul 30, 2026

View reviewed changes

andrecastillo approved these changes Jul 30, 2026

View reviewed changes

josue merged commit 424da64 into main Jul 30, 2026
9 checks passed

josue deleted the fix/snyk-grpc-examples-2026-07-30 branch July 30, 2026 14:47

Navigation Menu

Uh oh!

fix: [FL-30189] Pin grpc v1.82.1 and otel v1.44.0 via replace directives - #104

fix: [FL-30189] Pin grpc v1.82.1 and otel v1.44.0 via replace directives#104
josue merged 3 commits into
mainfrom
fix/snyk-grpc-examples-2026-07-30

josue commented Jul 30, 2026 •

edited

Loading

Uh oh!

flume-bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

josue commented Jul 30, 2026

Uh oh!

andrecastillo left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

josue commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

Checklist:

Addition (same day): otel v1.44.0 pin

Uh oh!

flume-bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

josue commented Jul 30, 2026

Uh oh!

andrecastillo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

josue commented Jul 30, 2026 •

edited

Loading

flume-bot commented Jul 30, 2026 •

edited

Loading