fix: upgrade grpc-go to v1.82.1 for GHSA-hrxh-6v49-42gf

Merged
CH
3mo ago
+12-6

Summary

Upgraded google.golang.org/grpc to v1.82.1 in the root module and the nested extras/dagger module so the repo no longer includes vulnerable grpc-go releases affected by GHSA-hrxh-6v49-42gf. The extras/dagger module also picked up the matching google.golang.org/genproto/googleapis/{api,rpc} indirect versions required by the patched grpc-go release.

Vulnerability Fixed

GHSA-hrxh-6v49-42gf, severity HIGH: grpc-go before v1.82.1 is affected by xDS RBAC and HTTP/2 vulnerabilities, including a server-side HTTP/2 rapid-reset denial-of-service condition.

Changes Made

  • Bumped the root module dependency google.golang.org/grpc from v1.82.0 to v1.82.1 in go.mod and refreshed go.sum.
  • Bumped the nested extras/dagger module dependency google.golang.org/grpc from v1.80.0 to v1.82.1 and refreshed extras/dagger/go.sum.
  • Accepted the minimal indirect google.golang.org/genproto/googleapis/api and google.golang.org/genproto/googleapis/rpc updates in extras/dagger/go.mod required by the patched grpc-go version.

Verification

Ran syft dir:. -o cyclonedx-json=<tmpfile> && grype sbom:<tmpfile> --only-fixed -o json against the patched repository. Outcome: resolved — grype no longer reports GHSA-hrxh-6v49-42gf anywhere in the generated SBOM.

Risk Assessment

View the risk assessment in Chainloop