fix: bump grpc to v1.83.1 to clear CVE-2026-84304 - #203
Merged
Conversation
trivy-scan flagged google.golang.org/grpc v1.82.1 as HIGH -- CVE-2026-84304, fixed in 1.83.1 -- in both the gen/go and remote-worker modules. The gate runs `trivy fs .` with exit-code 1, and because the action builds its SARIF report with all severities it passes no --severity filter, so a single fixable advisory turns the required check red on every PR. The CVE published 2026-09-01T18:19Z, after the last green run, so this is not a regression from any particular change: the same finding reproduces on an unmodified `main` checkout. Same shape as rossoctl#162/rossoctl#163. Bump google.golang.org/grpc to v1.83.1 in both modules and re-run go mod tidy, which also moves the transitive genproto/googleapis/rpc pin that v1.83.1 requires. Verified: - `trivy fs . --scanners vuln --exit-code 1` now exits 0, with 0 vulnerabilities against gen/go/go.mod, remote-worker/go.mod and pnpm-lock.yaml (previously 1 HIGH against each go.mod) - gen/go: `go build ./...` and `go test ./...` pass - remote-worker: `gofmt -l .` clean, `go vet ./...` and `go test -race ./...` pass - `buf lint` and `buf generate` clean, no codegen drift Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Paolo Dettori <dettori@us.ibm.com>
pdettori
added a commit
to pdettori/serverless-harness
that referenced
this pull request
Sep 2, 2026
Mechanical output of `make fmt`, no hand edits. This is the backlog from the previous commit: the prettier hook aborted config validation, and its `types_or` never named a real TypeScript tag anyway, so `.ts` files were never formatted even when the config loaded. Kept as its own commit so the fix that unblocks it stays reviewable. Mostly quote style (`.prettierrc` sets singleQuote), trailing commas, comment alignment, markdown table padding and YAML flow-sequence reflow. Verified semantics-preserving: - all 31 changed YAML/JSON files parse to documents identical to their previous contents (compared as parsed structures, not text) - `make typecheck` clean - `pnpm -r test`: 851 passed, 15 skipped - `make test-deploy` passes - `pre-commit run --all-files` exits 0 with all nine hooks running Regenerated rather than replayed when rebasing onto main after rossoctl#203 and rossoctl#204, so it also covers the code rossoctl#204 added -- replaying the old diff would have conflicted with it on run-leaf.ts for no benefit, formatting being mechanical. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Paolo Dettori <dettori@us.ibm.com>
pdettori
added a commit
that referenced
this pull request
Sep 2, 2026
The github-actions, npm and docker ecosystems left the repo's two Go modules (gen/go, remote-worker) unwatched, so Go advisories reached us only as a red trivy-scan gate rather than as a PR. That is exactly how CVE-2026-84304 (google.golang.org/grpc heap exhaustion via HTTP/2 DATA frame fragmentation) landed: it published on 2026-09-01, entered Trivy's DB overnight, and turned the gate red on unrelated PRs until it was bumped by hand in #203. The same shape recurred a week earlier with GHSA-hrxh-6v49-42gf, fixed by hand in #163 -- grpc is a repeat offender. Dependabot has no recursive directory match, so each go.mod needs its own entry. grpc, protobuf and genproto are grouped per module because they are generated-code peers: bumping one without the others can break the buf-generated bindings. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Paolo Dettori <dettori@us.ibm.com>
This was referenced Sep 2, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks the
trivy-scanrequired check, which is currently red on every PR — including #202, where it surfaced.Why the gate is red
trivy-scanflaggedgoogle.golang.org/grpc v1.82.1as HIGH — CVE-2026-84304, fixed in1.83.1— in both thegen/goandremote-workermodules.The job runs with
exit-code: 1, and because the action builds its SARIF report with all severities it passes no--severityfilter (its log readsBuilding SARIF report with all severities/Running Trivy with options: trivy fs .). So one fixable advisory anywhere fails the check, and nothing prints to stdout because the output goes to SARIF — which is why the failure looks opaque in the log.Not a regression from any change. The CVE published
2026-09-01T18:19Z, after the last green run, and the same finding reproduces on an unmodifiedmaincheckout:main, untouchedCVE-2026-84304— grpcv1.82.1→1.83.1, in bothgo.modfilesSame shape as #162 / #163, handled the same way.
Change
google.golang.org/grpc→v1.83.1in both modules, plusgo mod tidy, which also moves the transitivegenproto/googleapis/rpcpin thatv1.83.1requires. Four files, dependency metadata only — no source changes:Verification
trivy fs . --scanners vuln --exit-code 1(the same all-severity gate CI applies) exits 0, reporting 0 vulnerabilities againstgen/go/go.mod,remote-worker/go.modandpnpm-lock.yaml— previously 1 HIGH against eachgo.mod.gen/go:go build ./...andgo test ./...pass.remote-worker:gofmt -l .clean,go vet ./...andgo test -race ./...pass — i.e. all three steps theprotojob runs.buf lintandbuf generateclean, no codegen drift.Assisted-By: Claude (Anthropic AI) noreply@anthropic.com