Skip to content

chore: upgrade grpc to 1.83.2 to resolve Dependabot alert - #9873

Open
himadrisingh wants to merge 1 commit into
mainfrom
hsingh/dependabot-grpc
Open

chore: upgrade grpc to 1.83.2 to resolve Dependabot alert#9873
himadrisingh wants to merge 1 commit into
mainfrom
hsingh/dependabot-grpc

Conversation

@himadrisingh

@himadrisingh himadrisingh commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Resolves one open Dependabot security alert:

  • google.golang.org/grpc 1.82.1 → 1.83.2 — GHSA-vp52-pcj8-j9qc (high): heap memory exhaustion (OOM) via HTTP/2 DATA frame fragmentation

Split out from the other Dependabot upgrades because this bump cascades ~28 transitive upgrades via MVS, notably google.golang.org/api 0.230 → 0.264 and cloud.google.com/go/bigquery 1.66 → 1.72. The cascade is inherent to grpc 1.83.2's module graph, not an artifact of go mod tidy — I verified this by applying the bump in isolation. The BigQuery and GCS driver paths are worth extra attention in CI.

Verified go build ./... passes. Overlaps with #9874 on go.mod, so whichever merges second needs a rebase.

Checklist:

  • Covered by tests
  • Ran it and it works as intended
  • Reviewed the diff before requesting a review
  • Checked for unhandled edge cases
  • Linked the issues it closes
  • Checked if the docs need to be updated. If so, create a separate Linear DOCS issue
  • Intend to cherry-pick into the release branch
  • I'm proud of this work!

Developed in collaboration with Claude Code

🤖 Generated with Claude Code

`google.golang.org/grpc` 1.82.1 -> 1.83.2 (GHSA-vp52-pcj8-j9qc: heap memory exhaustion via HTTP/2 DATA frame fragmentation)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

@nishantmonu51 nishantmonu51 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 , LGTM post CI failures are fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants