Possible fix(deps): 11 vulnerable dependencies in go.mod

[begininvoke]

Spotted what might be an issue in go.mod around line 1.

CRITICAL: CVE-2026-33186 — authorization bypass in gRPC-Go. The installed version v1.67.3 accepts HTTP/2 requests whose :path pseudo-header omits the mandatory leading slash (e.g., 'Service/Method' instead of '/Service/Method'). These non-canonical paths are routed to the handler, but path-based authorization interceptors (including the official grpc/authz RBAC package and any custom interceptor using info.FullMethod) compare the raw path against policy rules. Deny rules defined with canonical paths fail to match, so requests slip through any fallback 'allow' rule. Impact: attackers able to send raw HTTP/2 frames with malformed :path can bypass deny-based access controls on protected methods. Risk is CRITICAL for servers using path-based authz with deny rules and a default-allow posture; low/no impact for servers without such policies.

Something like this might fix it:

Upgrade the dependency to the fixed version in go.mod:

--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/example/yourapp
 
 require (
-    google.golang.org/grpc v1.67.3
+    google.golang.org/grpc v1.79.3
     ... // other deps unchanged
 )

Then run:
  go get google.golang.org/grpc@v1.79.3 && go mod tidy && go build ./...

If immediate upgrade is not possible, add a validating interceptor that rejects non-canonical paths before authz is evaluated:

+ func pathValidationInterceptor() grpc.UnaryServerInterceptor {
+     return func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+         if !strings.HasPrefix(info.FullMethod, "/") {
+             return nil, status.Error(codes.Unimplemented, "invalid method path")
+         }
+         return handler(ctx, req)
+     }
+ }
+ // In server setup, register it first:
+ grpc.NewServer(grpc.ChainUnaryInterceptor(pathValidationInterceptor(), authzInterceptor))

Apply the equivalent StreamServerInterceptor for streaming RPCs as well.

For reference: rule CVE-2026-33186. Rated critical.

If I have misread how this is used, sorry for the noise — feel free to close.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.