fix(deps): bump grpc to v1.83.0 for CVE-2026-33186 - #711
Merged
Merged
Conversation
## Summary ### Why? Dependabot alert #6 (CVE-2026-33186 / GHSA-p77j-4mvh-x3m3) is a critical gRPC-Go authorization bypass on `:path` values without a leading slash. We were pinned to v1.68.1 (vulnerable: < 1.79.3) so Dependabot would not bump grpc, because an earlier security bump to v1.79.3 pulled `google.golang.org/genproto/googleapis/rpc` past what go-code could absorb. go-code `main` now requires `google.golang.org/grpc v1.83.0` (and the matching genproto/rpc pseudo-version), so staying on v1.68.x no longer matches the monorepo and no longer avoids that bump. ### What? Bumps `google.golang.org/grpc` from v1.68.1 to v1.83.0 to match go-code and clear the advisory. Transitive updates from that bump: `google.golang.org/protobuf` v1.36.11, `google.golang.org/genproto/googleapis/rpc` `v0.0.0-20260526163538-3dc84a4a5aaa` (same as go-code), and `golang.org/x/oauth2` v0.36.0. Removes the Dependabot ignore for grpc so future security advisories are not silently dropped. ## Test Plan Ran `make tidy` and `make gazelle`. Unit tests that executed passed (56/56); a full `make test` analysis failed once on a transient `proxy.golang.org` TLS timeout fetching `go.uber.org/multierr`. ## Issue Closes https://github.com/uber/submitqueue/security/dependabot/6 Co-authored-by: Cursor <cursoragent@cursor.com>
behinddwalls
marked this pull request as ready for review
September 15, 2026 19:17
behinddwalls
enabled auto-merge
September 15, 2026 19:20
behinddwalls
disabled auto-merge
September 15, 2026 19:21
mnoah1
approved these changes
Sep 15, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why?
Dependabot alert #6 (CVE-2026-33186 / GHSA-p77j-4mvh-x3m3) is a critical gRPC-Go authorization bypass on
:pathvalues without a leading slash. We were pinned to v1.68.1 (vulnerable: < 1.79.3) so Dependabot would not bump grpc, because an earlier security bump to v1.79.3 pulledgoogle.golang.org/genproto/googleapis/rpcpast what go-code could absorb.go-code
mainnow requiresgoogle.golang.org/grpc v1.83.0(and the matching genproto/rpc pseudo-version), so staying on v1.68.x no longer matches the monorepo and no longer avoids that bump.What?
Bumps
google.golang.org/grpcfrom v1.68.1 to v1.83.0 to match go-code and clear the advisory. Transitive updates from that bump:google.golang.org/protobufv1.36.11,google.golang.org/genproto/googleapis/rpcv0.0.0-20260526163538-3dc84a4a5aaa(same as go-code), andgolang.org/x/oauth2v0.36.0. Removes the Dependabot ignore for grpc so future security advisories are not silently dropped.Test Plan
Ran
make tidyandmake gazelle. Unit tests that executed passed (56/56); a fullmake testanalysis failed once on a transientproxy.golang.orgTLS timeout fetchinggo.uber.org/multierr.Issue
Closes https://github.com/uber/submitqueue/security/dependabot/6