fix: bump extras/dagger grpc-go to v1.79.3
Closed
CH
3mo ago+42+42+01234567890123456789-14-14-01234567890123456789
Summary
Bumped the nested extras/dagger Go module off the vulnerable indirect google.golang.org/grpc v1.76.0 to v1.79.3, the first patched release identified by the assessment. The change is limited to that module's dependency manifests and the transitive versions Go resolved alongside the grpc-go upgrade.
Vulnerability Fixed
GHSA-p77j-4mvh-x3m3, severity CRITICAL: gRPC-Go has an authorization bypass via missing leading slash in :path.
Changes Made
- Updated
extras/dagger/go.modto requiregoogle.golang.org/grpc v1.79.3instead of the vulnerablev1.76.0. - Refreshed
extras/dagger/go.sumand the transitive dependency versions that Go module resolution advanced with the grpc-go bump. - Left the root module unchanged because it already depends on
google.golang.org/grpc v1.81.1; the remediation is scoped to the affected nested module only.
Verification
Ran syft dir:. -o cyclonedx-json > /tmp/extras-dagger-sbom.json && grype sbom:/tmp/extras-dagger-sbom.json --only-fixed -o json from repo/extras/dagger and checked the results for GHSA-p77j-4mvh-x3m3. Outcome: resolved — the advisory is absent from the post-change grype results for the scanned module.