fix: upgrade extras/dagger grpc to v1.83.2

Merged
CH
1mo ago
+3-3

Summary

Bump the auxiliary extras/dagger module from google.golang.org/grpc v1.82.1 to v1.83.2 to remove the vulnerable gRPC-Go release from that submodule. The assessment hint suggested v1.83.1, but the current vulnerability database also flags v1.83.1, so this remediation uses the next fixed release.

Vulnerability Fixed

GHSA-vp52-pcj8-j9qc (HIGH): gRPC-Go heap memory exhaustion (OOM) via HTTP/2 DATA frame fragmentation.

Changes Made

  • Updated extras/dagger/go.mod to require google.golang.org/grpc v1.83.2 instead of the vulnerable v1.82.1.
  • Updated extras/dagger/go.sum with the matching checksums for google.golang.org/grpc v1.83.2.
  • Chose v1.83.2 rather than the hinted v1.83.1 because the current Grype database reports a separate high-severity gRPC advisory against v1.83.1.

Verification

Ran syft dir:extras/dagger -o cyclonedx-json=/workspace/run/.scan/dagger-sbom-fixed.json followed by GRYPE_DB_AUTO_UPDATE=false grype sbom:/workspace/run/.scan/dagger-sbom-fixed.json --only-fixed -o json. Outcome: resolved. The scan no longer reports GHSA-vp52-pcj8-j9qc for google.golang.org/grpc in extras/dagger after the bump to v1.83.2.

Risk Assessment

View the risk assessment in Chainloop