Skip to content

chore(deps): bump the go_modules group across 3 directories with 1 update - #251

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/examples/cost-optimization/go_modules-a13224087d
Closed

chore(deps): bump the go_modules group across 3 directories with 1 update#251
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/examples/cost-optimization/go_modules-a13224087d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the go_modules group with 1 update in the /examples/cost-optimization directory: google.golang.org/grpc.
Bumps the go_modules group with 1 update in the /examples/deterministic-aggregation directory: google.golang.org/grpc.
Bumps the go_modules group with 1 update in the /examples/multi-phase-workflow directory: google.golang.org/grpc.

Updates google.golang.org/grpc from 1.83.0 to 1.83.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.1

Security

  • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
  • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
  • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
  • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
  • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)

Performance

  • transport: Restrict memory overhead of buffering small data frames. (#9331)
Commits

Updates google.golang.org/grpc from 1.83.0 to 1.83.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.1

Security

  • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
  • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
  • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
  • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
  • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)

Performance

  • transport: Restrict memory overhead of buffering small data frames. (#9331)
Commits

Updates google.golang.org/grpc from 1.83.0 to 1.83.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.1

Security

  • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
  • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
  • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
  • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
  • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)

Performance

  • transport: Restrict memory overhead of buffering small data frames. (#9331)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the go_modules group across 3 directories with 1 up…
1419d09 
…date

Bumps the go_modules group with 1 update in the /examples/cost-optimization directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).
Bumps the go_modules group with 1 update in the /examples/deterministic-aggregation directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).
Bumps the go_modules group with 1 update in the /examples/multi-phase-workflow directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).


Updates `google.golang.org/grpc` from 1.83.0 to 1.83.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.83.0...v1.83.1)

Updates `google.golang.org/grpc` from 1.83.0 to 1.83.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.83.0...v1.83.1)

Updates `google.golang.org/grpc` from 1.83.0 to 1.83.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.83.0...v1.83.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.1
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.1
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.1
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 2, 2026
@charlesgreen charlesgreen mentioned this pull request Sep 9, 2026
Merged
5 tasks done
charlesgreen added a commit that referenced this pull request Sep 10, 2026
@charlesgreen
chore(deps): bulk dependabot + security updates (#254)
5f374f2 
* chore(deps): bulk dependabot + security updates, close 6 open PRs

Fixes two HIGH-severity grpc-go DoS advisories (missing :authority/Host
header crash, HTTP/2 DATA frame heap exhaustion) that affected the
v1.83.0 pin in the root module and all 5 grpc-dependent examples, by
bumping to v1.83.2 everywhere. Bumps the Go toolchain 1.26.5 -> 1.26.6,
clearing 8 stdlib govulncheck findings. govulncheck reports 0 reachable
vulnerabilities across the root module and every example module.

Applied (closes #253, #252, #251, #249, #244, #243):
- google.golang.org/grpc -> v1.83.2 (root + 5 example modules)
- cloud.google.com/go/firestore -> v1.25.0
- github.com/alicebob/miniredis/v2 -> v2.39.0
- github.com/aws/aws-sdk-go-v2 -> v1.45.1
- github.com/aws/aws-sdk-go-v2/config -> v1.33.2
- github.com/aws/aws-sdk-go-v2/service/bedrock -> v1.70.0
- github.com/aws/aws-sdk-go-v2/service/bedrockruntime -> v1.60.0
- github.com/stretchr/testify -> v1.12.1
- go.opentelemetry.io/otel{,/sdk,/trace,/metric} -> v1.46.0
- go.opentelemetry.io/otel/exporters/otlp/otlptrace{,/otlptracehttp} -> v1.46.0
- go.opentelemetry.io/otel/exporters/stdout/stdouttrace -> v1.46.0
- google.golang.org/api -> v0.297.0
- google.golang.org/genai -> v1.71.0
- actions/checkout -> v7.0.1
- actions/setup-go -> v7.0.0
- docker/setup-buildx-action -> v4.3.0
- github/codeql-action/upload-sarif -> v4.37.9
- securego/gosec -> v2.29.0
- anchore/sbom-action/download-syft -> v0.24.2

Not fixable by dependency bump: 6 Trivy code-scanning alerts (rule
GO-2026-5932) flag golang.org/x/crypto/openpgp as unmaintained. It's
an unremovable transitive dep of grpc/otel with no reachable call site
in this repo's source and no patched version exists. Filed dismissal
requests (delegated approval required by org policy) rather than
force through.

~110 remaining open Dependabot alerts (grpc <1.79.3/1.82.1, x/crypto,
x/net, otel) are stale duplicates against versions already satisfied
by this bump; they'll auto-resolve once the dependency graph rescans
this branch.

* fix(lint): resolve staticcheck SA1019 deprecation findings

golangci-lint-action installs 'latest' unpinned, so an upstream release
started flagging two long-standing deprecated-API uses that weren't
caught before (main's last CI run passed Lint cleanly):
- ChatCompletionRequest.MaxTokens -> MaxCompletionTokens (go-openai);
  the replacement is a direct drop-in and also works with o1-series
  models, unlike MaxTokens.
- tls.Config.PreferServerCipherSuites has been a no-op since Go 1.18;
  dropped from the reference "secure config" in the test rather than
  keep asserting on a field that does nothing.

golangci-lint run --timeout=5m: 0 issues (was 2).
@charlesgreen

charlesgreen commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Superseded by #254, which bumped this (and 5 other open Dependabot PRs) to an equal or newer version in one bulk update, merged to main at 5f374f2.

@dependabot @github

dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/go_modules/examples/cost-optimization/go_modules-a13224087d branch September 10, 2026 01:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@charlesgreen