Skip to content

chore: upgrade grpc to 1.83.2 to resolve Dependabot alert - #9873

Open
himadrisingh wants to merge 1 commit into
mainfrom
hsingh/dependabot-grpc
Open

himadrisingh wants to merge 1 commit into
mainfrom
hsingh/dependabot-grpc

Conversation

@himadrisingh

@himadrisingh himadrisingh commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Resolves one open Dependabot security alert:

  • google.golang.org/grpc 1.82.1 → 1.83.2 — GHSA-vp52-pcj8-j9qc (high): heap memory exhaustion (OOM) via HTTP/2 DATA frame fragmentation

Split out from the other Dependabot upgrades because this bump cascades ~28 transitive upgrades via MVS, notably google.golang.org/api 0.230 → 0.264 and cloud.google.com/go/bigquery 1.66 → 1.72. The cascade is inherent to grpc 1.83.2's module graph, not an artifact of go mod tidy — I verified this by applying the bump in isolation. The BigQuery and GCS driver paths are worth extra attention in CI.

Verified go build ./... passes. Overlaps with #9874 on go.mod, so whichever merges second needs a rebase.

Checklist:

  • Covered by tests
  • Ran it and it works as intended
  • Reviewed the diff before requesting a review
  • Checked for unhandled edge cases
  • Linked the issues it closes
  • Checked if the docs need to be updated. If so, create a separate Linear DOCS issue
  • Intend to cherry-pick into the release branch
  • I'm proud of this work!

Developed in collaboration with Claude Code

🤖 Generated with Claude Code

`google.golang.org/grpc` 1.82.1 -> 1.83.2 (GHSA-vp52-pcj8-j9qc: heap memory exhaustion via HTTP/2 DATA frame fragmentation)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

@nishantmonu51 nishantmonu51 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 , LGTM post CI failures are fixed.

@nishantmonu51 nishantmonu51 added dependencies Pull requests that update a dependency file Size:M Medium change: 100-499 lines labels Sep 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file Size:M Medium change: 100-499 lines

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants