OCPBUGS-80562: Bump google.golang.org/grpc to v1.79.3#304
Open
ocp-sustaining-admins wants to merge 1 commit intoopenshift:release-4.20from
Open
OCPBUGS-80562: Bump google.golang.org/grpc to v1.79.3#304ocp-sustaining-admins wants to merge 1 commit intoopenshift:release-4.20from
ocp-sustaining-admins wants to merge 1 commit intoopenshift:release-4.20from
Conversation
openshift-ci-robot
added
jira/severity-important
|
@ocp-sustaining-admins: This pull request references Jira Issue OCPBUGS-80562, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughThis pull request updates multiple Go module dependencies in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
bot
added
the
needs-ok-to-test
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ocp-sustaining-admins The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @ocp-sustaining-admins. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Member
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 24: Update the OpenTelemetry SDK version reference in go.mod from
go.opentelemetry.io/otel/sdk v1.39.0 to v1.40.0 (or later) to address
CVE-2026-24051, then run module update commands (e.g., go get
go.opentelemetry.io/otel/sdk@v1.40.0 and go mod tidy) to refresh go.sum and
vendor files; verify by running the test/build to ensure no breaking changes
from the sdk module update.
- Line 26: Upgrade to google.golang.org/grpc v1.79.3 requires targeted
compatibility validation: update module/go toolchain to Go 1.24+, then run full
build/tests; specifically inspect pkg/driver/driver.go server setup (e.g.,
NewDriver / RegisterGRPCServer or where grpc.NewServer and
grpc.DialOptions/interceptors/balancer are configured) to ensure custom
balancers implement the new ExitIdle() method, MetricsRecorder embeds
UnimplementedMetricsRecorder, mem.Reader usage is updated for struct changes,
and target URL validation/xDS behavior and authority selection still work; also
run integration tests against common clients/proxies to verify they do not send
non-canonical HTTP/2 :path values (CVE fix) and adjust any interceptor/option
usage accordingly before merging.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 71c25116-773b-4e9b-8aa8-d51362742429
⛔ Files ignored due to path filters (287)
go.sumis excluded by!**/*.sumvendor/github.com/stretchr/testify/assert/assertion_compare.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/assertion_format.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/assertion_forward.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/assertion_order.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/assertions.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/http_assertions.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/yaml/yaml_custom.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/yaml/yaml_default.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/assert/yaml/yaml_fail.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/require/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/require/require.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/stretchr/testify/require/require_forward.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/id.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/number.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/status.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/traces.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/value.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/auto/sdk/tracer.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.clomonitor.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.codespellignoreis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.golangci.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/.lycheeignoreis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CODEOWNERSis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/CONTRIBUTING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/Makefileis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/RELEASING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/SECURITY-INSIGHTS.ymlis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/VERSIONING.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/encoder.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/filter.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/hash.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/internal/attribute.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/internal/xxhash/xxhash.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/iterator.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/key.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/kv.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/set.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/type_string.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/attribute/value.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/baggage/baggage.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/codes/codes.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/dependencies.Dockerfileis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/internal_logging.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/meter.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/internal/global/trace.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/metric/config.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/baggage.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/propagation.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/propagation/trace_context.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/x/features.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/internal/x/x.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/builtin.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/container.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/env.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_bsd.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_linux.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_unsupported.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/host_id_windows.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_release_unix.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_unix.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/os_unsupported.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/process.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/resource/resource.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/id_generator.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/env/env.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/batch_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/simple_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/internal/observ/tracer.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/provider.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/sampling.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/simple_span_processor.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/snapshot.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/span_limits.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/trace/tracer.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/sdk/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/MIGRATION.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/README.mdis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/attribute_group.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/doc.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/error_type.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/exception.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/otelconv/metric.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/semconv/v1.37.0/schema.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/auto.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/config.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/hex.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/attr.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/id.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/internal/telemetry/value.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/noop.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/noop/noop.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/span.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/trace.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/trace/tracestate.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.opentelemetry.io/otel/versions.yamlis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/escape.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/parse.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/render.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/config.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/config_go125.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/config_go126.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/frame.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/gotrack.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/http2.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/server.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/transport.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_priority_rfc7540.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_priority_rfc9218.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_roundrobin.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/internal/httpcommon/request.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/trace/events.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/deviceauth.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/oauth2.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/pkce.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/token.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/oauth2/transport.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/plan9/pwd_plan9.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/affinity_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/fdset.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ifreq_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/mkall.shis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_darwin.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_netbsd.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_solaris.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_386.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_s390x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_386.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_386.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_s390x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/registry/zsyscall_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/types_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/term/term_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/term/terminal.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/encoding/japanese/eucjp.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/encoding/japanese/iso2022jp.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/encoding/japanese/shiftjis.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/encoding/korean/euckr.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/encoding/simplifiedchinese/gbk.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/encoding/simplifiedchinese/hzgb2312.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/encoding/traditionalchinese/big5.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/encoding/unicode/unicode.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/bidi/core.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/tools/go/ast/inspector/cursor.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/tools/go/ast/inspector/inspector.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/tools/go/ast/inspector/typeof.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/CONTRIBUTING.mdis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/MAINTAINERS.mdis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/balancer.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/endpointsharding/endpointsharding.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/internal/internal.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer/subconn.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/balancer_wrapper.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/clientconn.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/credentials/credentials.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/credentials/tls.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/dialoptions.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/encoding/encoding.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/encoding/gzip/gzip.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/encoding/internal/internal.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/encoding/proto/proto.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/experimental/stats/metricregistry.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/experimental/stats/metrics.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/interceptor.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/balancer/weight/weight.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/buffer/unbounded.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/channelz/trace.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/envconfig/envconfig.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/envconfig/xds.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/experimental.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/idle/idle.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/internal.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/delegatingresolver.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/stats/metrics_recorder_list.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/stats/stats.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/client_stream.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/controlbuf.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/flowcontrol.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/handler_server.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/http2_client.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/http2_server.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/http_util.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/server_stream.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/internal/transport/transport.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/mem/buffer_pool.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/mem/buffer_slice.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/mem/buffers.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/picker_wrapper.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/preloader.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/resolver/resolver.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/resolver_wrapper.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/rpc_util.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/server.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/stats/stats.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/stream.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/grpc/version.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/encoding/protowire/wire.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/editiondefaults/editions_defaults.binpbis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc_init.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/editions.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/filedesc/presence.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/genid/api_gen.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/genid/descriptor_gen.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/impl/codec_message_opaque.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/impl/message_opaque.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/impl/presence.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/internal/version/version.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/reflect/protoreflect/source_gen.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/protobuf/types/descriptorpb/descriptor.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/modules.txtis excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (1)
go.mod
| golang.org/x/sys v0.33.0 | ||
| google.golang.org/grpc v1.73.0 | ||
| google.golang.org/protobuf v1.36.6 | ||
| go.opentelemetry.io/otel/sdk v1.39.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify the OTel SDK vulnerability and check for secure versions
# Check the vulnerability details from GitHub Security Advisory
echo "=== Checking GHSA-9h8m-3fm2-qjrq details ==="
gh api graphql -f query='
{
securityAdvisory(ghsaId: "GHSA-9h8m-3fm2-qjrq") {
summary
description
severity
publishedAt
withdrawnAt
vulnerabilities(first: 5) {
nodes {
package {
name
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}
}'
echo ""
echo "=== Checking available go.opentelemetry.io/otel/sdk versions ==="
curl -s 'https://proxy.golang.org/go.opentelemetry.io/otel/sdk/@v/list' | tail -20
echo ""
echo "=== Checking Go vulnerability database for GO-2026-4394 ==="
curl -s 'https://vuln.go.dev/ID/GO-2026-4394.json' || echo "Vulnerability entry not found or not accessible"Repository: openshift/aws-ebs-csi-driver
Length of output: 1817
🌐 Web query:
GO-2026-4394 OpenTelemetry vulnerability
💡 Result:
GO-2026-4394 (CVE-2026-24051 / GHSA-9h8m-3fm2-qjrq) is a local arbitrary code execution issue in the OpenTelemetry Go SDK on macOS/Darwin: the SDK’s Darwin host ID resource detection runs the ioreg command via PATH lookup, so an attacker who can influence PATH can cause execution of a malicious ioreg. (github.com)
- Affected module / versions:
go.opentelemetry.io/otel/sdk>= 1.21.0 and <= 1.39.0. (pkg.go.dev) - Fix: upgrade to v1.40.0 or later (the patch changes the code to use a full path for
ioreg). (github.com)
What to do
- In your Go module, upgrade:
go get go.opentelemetry.io/otel/sdk@v1.40.0(or newer), thengo mod tidy. (pkg.go.dev)
Citations:
- 1: GHSA-9h8m-3fm2-qjrq
- 2: https://pkg.go.dev/vuln/GO-2026-4394
- 3: GHSA-9h8m-3fm2-qjrq
- 4: https://pkg.go.dev/vuln/GO-2026-4394
🌐 Web query:
GHSA-9h8m-3fm2-qjrq security advisory
💡 Result:
GHSA-9h8m-3fm2-qjrq is a GitHub Security Advisory for OpenTelemetry Go SDK (go.opentelemetry.io/otel/sdk) tracked as CVE-2026-24051: on macOS/Darwin, host resource detection executes the ioreg command using the system PATH, enabling PATH hijacking that can lead to local arbitrary code execution in the application’s context. (nvd.nist.gov)
- Affected versions:
go.opentelemetry.io/otel/sdk>= 1.21.0 and < 1.40.0 (NVD describes the vulnerable range asv1.20.0–1.39.0). (test.osv.dev) - Fixed version: 1.40.0 (upgrade to >= 1.40.0). (test.osv.dev)
- Severity (GitHub CNA CVSS v3.1): 7.0 HIGH (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). (nvd.nist.gov)
Sources:
[1] (test.osv.dev) (GO-2026-4394 / OSV entry; affected & fixed versions)
[2] (nvd.nist.gov) (NVD CVE-2026-24051 details; description & CVSS)
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2026-24051
- 2: https://test.osv.dev/vulnerability/GO-2026-4394
- 3: https://test.osv.dev/vulnerability/GO-2026-4394
- 4: https://nvd.nist.gov/vuln/detail/CVE-2026-24051
- 5: https://test.osv.dev/vulnerability/GO-2026-4394
- 6: https://nvd.nist.gov/vuln/detail/CVE-2026-24051
🌐 Web query:
go.opentelemetry.io/otel/sdk v1.39.0 security vulnerability
💡 Result:
go.opentelemetry.io/otel/sdk v1.39.0 is vulnerable: it falls in the affected range for CVE-2026-24051 (aka GHSA-9h8m-3fm2-qjrq, GO-2026-4394) >= 1.21.0 and < 1.40.0. The issue is a PATH hijacking / untrusted search path problem on macOS/Darwin, where resource detection runs the ioreg command via the system search path; a local attacker who can influence PATH may achieve arbitrary code execution in the app’s context. [1][2]
Fix: upgrade to v1.40.0 or later (patched in 1.40.0). Example:
go get go.opentelemetry.io/otel/sdk@v1.40.0[1][2][3]
Sources: [1] GitHub Advisory (GHSA) [2] Go vuln database report (pkg.go.dev) [3] GitLab advisory database entry.
🌐 Web query:
CVE-2026-33186 gRPC vulnerability
💡 Result:
CVE-2026-33186 (gRPC-Go / google.golang.org/grpc) is a critical authorization-bypass caused by improper validation of the HTTP/2 :path pseudo-header: gRPC-Go would route requests whose :path omits the required leading / (e.g., Service/Method), but path-based authorization interceptors could evaluate the non-canonical method string—so canonical “deny” rules (that start with /) may not match, enabling bypass when a fallback allow exists. CVSS v3.1: 9.1 (Critical). [1][2]
- Affected: gRPC-Go versions
< 1.79.3[1][2] - Exploitation requires: an attacker able to send raw HTTP/2 frames with a malformed
:pathdirectly to the gRPC server (i.e., not all client paths can produce this). [1][3] - Fix: upgrade to gRPC-Go
v1.79.3or newer; the patch rejects:pathvalues not starting with/(returnscodes.Unimplemented). [1][2] - Workarounds (if you can’t upgrade immediately): add an outermost interceptor to validate
info.FullMethodstarts with/, enforce strict HTTP/2 pseudo-header handling in proxies/LBs, and prefer default-deny authz policies. [1][3]
Key dates: GitHub advisory published March 17, 2026; Ubuntu lists CVE publication March 20, 2026. [1][3]
Sources:
[1] GitHub Security Advisory (GHSA-p77j-4mvh-x3m3) for grpc-go
[2] OSV / Go vuln entry (GO-2026-4762)
[3] Ubuntu CVE page for CVE-2026-33186
Upgrade OpenTelemetry SDK to v1.40.0 to fix CVE-2026-24051.
The PR introduces go.opentelemetry.io/otel/sdk v1.39.0, which contains CVE-2026-24051 (GHSA-9h8m-3fm2-qjrq, GO-2026-4394)—a HIGH severity local arbitrary code execution vulnerability on macOS/Darwin via PATH hijacking in host resource detection. Upgrade to v1.40.0 or later, where this vulnerability is patched.
🧰 Tools
🪛 OSV Scanner (2.3.5)
[HIGH] 24-24: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
(GO-2026-4394)
[HIGH] 24-24: go.opentelemetry.io/otel/sdk 1.39.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 24, Update the OpenTelemetry SDK version reference in go.mod
from go.opentelemetry.io/otel/sdk v1.39.0 to v1.40.0 (or later) to address
CVE-2026-24051, then run module update commands (e.g., go get
go.opentelemetry.io/otel/sdk@v1.40.0 and go mod tidy) to refresh go.sum and
vendor files; verify by running the test/build to ensure no breaking changes
from the sdk module update.
| google.golang.org/protobuf v1.36.6 | ||
| go.opentelemetry.io/otel/sdk v1.39.0 | ||
| golang.org/x/sys v0.39.0 | ||
| google.golang.org/grpc v1.79.3 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify CVE-2026-33186 and check for gRPC breaking changes
echo "=== Checking CVE-2026-33186 in NVD ==="
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33186" | jq -r '.vulnerabilities[0].cve | {id: .id, description: .descriptions[0].value, published: .published, references: .references[].url}' || echo "CVE not found or not accessible"
echo ""
echo "=== Checking GitHub Security Advisories for google.golang.org/grpc ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "google.golang.org/grpc") {
nodes {
advisory {
ghsaId
summary
severity
publishedAt
identifiers {
type
value
}
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}' | jq '.data.securityVulnerabilities.nodes[] | select(.advisory.identifiers[]? | select(.type == "CVE" and .value == "CVE-2026-33186"))'
echo ""
echo "=== Checking gRPC release notes for breaking changes v1.73.0 to v1.79.3 ==="
for version in 1.74.0 1.75.0 1.76.0 1.77.0 1.78.0 1.79.0 1.79.1 1.79.2 1.79.3; do
echo "--- v${version} ---"
curl -s "https://api.github.com/repos/grpc/grpc-go/releases/tags/v${version}" | jq -r '.body' | grep -iE "(breaking|deprecat|remov|incompatib)" | head -5 || echo "No breaking changes mentioned"
doneRepository: openshift/aws-ebs-csi-driver
Length of output: 1817
🌐 Web query:
CVE-2026-33186 google grpc vulnerability
💡 Result:
CVE-2026-33186 (Google gRPC / gRPC-Go) is a critical authorization-bypass bug in gRPC-Go (google.golang.org/grpc) affecting versions < 1.79.3. It stems from improper validation of the HTTP/2 :path pseudo-header: the server could route requests whose :path omits the required leading slash (e.g., Service/Method instead of /Service/Method), but path-based authorization interceptors (including google.golang.org/grpc/authz) may evaluate the non-canonical path string—so deny rules written for canonical paths don’t match, and a fallback allow rule can let the request through. An attacker needs the ability to send raw/malformed HTTP/2 frames to the gRPC server. [1][2]
Who is vulnerable (key conditions):
- You run a gRPC-Go server using path-based auth (e.g.,
grpc/authzRBAC, or custom logic relying oninfo.FullMethod/grpc.Method(ctx)), and - Your policy uses specific deny rules for canonical paths (with
/...) but otherwise defaults to allow. [1][2]
Fix:
- Upgrade to gRPC-Go v1.79.3 or newer (patched version). The fix rejects any request whose
:pathdoesn’t start with/(returnscodes.Unimplemented). [1][2][3]
Mitigations if you can’t upgrade immediately:
- Add an outer validating interceptor that rejects malformed
info.FullMethodvalues (missing leading/). - Enforce/normalize strict HTTP/2 pseudo-header handling at a proxy/LB.
- Move to a default-deny authorization posture. [1][3]
Severity (commonly reported): CVSS v3.1 base 9.1 (Critical). [1][2]
References: GitHub Security Advisory for grpc-go [1], Ubuntu CVE entry (includes impact and fixed version) [2], Snyk advisory summary and remediation [3].
[1] (github.com)
[2] (ubuntu.com)
[3] (security.snyk.io)
Citations:
- 1: GHSA-p77j-4mvh-x3m3
- 2: https://ubuntu.com/security/CVE-2026-33186
- 3: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGRPCGRPCGO-15691171
🌐 Web query:
gRPC v1.79.3 release notes breaking changes
💡 Result:
gRPC-Go v1.79.3 release notes list no explicit API-breaking changes; the release is a security/behavioral change:
- Server now strictly validates incoming HTTP/2
:path: requests with a non-canonical path (notably missing the leading/) are immediately rejected withUnimplemented. This closes an authorization-bypass where malformed:pathcould bypass path-based “deny” rules in interceptors such asgrpc/authz. This can be a breaking behavioral change if any client/proxy in your environment sends such malformed:pathheaders. [1][2]
Sources: [1] gRPC-Go v1.79.3 GitHub release notes, [2] PR #8981 (details of the change).
🌐 Web query:
google.golang.org/grpc v1.73.0 to v1.79.3 compatibility breaking changes
💡 Result:
Notable compatibility / potentially breaking changes when upgrading google.golang.org/grpc from v1.73.0 → v1.79.3 (grouped by release):
-
v1.74.2
balancer.Balancerinterface change: addsExitIdle()as a required method (previously optional), which can break custom balancer implementations. [1]- xDS env var removed:
GRPC_EXPERIMENTAL_ENABLE_LEAST_REQUESTremoval means least-request can no longer be disabled via that env var. [1] - Server behavior:
grpc-timeout: 0is allowed again (restores pre-v1.73.0 behavior). If you relied on v1.73.0 rejecting it, behavior changes. [1]
-
v1.75.0
- xDS env var removed:
GRPC_EXPERIMENTAL_XDS_FALLBACKremoved; fallback can no longer be disabled. [2] - Stats API/behavior: introduces
DelayedPickComplete(alias ofPickerUpdated) and changes emission semantics; notesPickerUpdatedwill be deleted in a future release (risk for code referencing it). [2] - Authority selection behavior:
grpc.WithAuthoritynow has highest priority over credentials’ authority override. [2]
- xDS env var removed:
-
v1.76.0
- Build-breaking dependency change: minimum supported Go version is now 1.24. [3]
-
v1.77.0
- API change:
mem.Readerchanged from an interface to a struct (can break code that implemented/depended on the interface type). [4] - Behavior change: removal of the env var that enabled switching back to the old
pick_first(GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=false). [4]
- API change:
-
v1.78.0
- Target URL validation tighter: rejects target URLs with unbracketed colons in the hostname (aligned with Go 1.26+ behavior). [5]
- Transport behavior: returns
Unknownon malformedgrpc-status. [5] - xDS resolver behavior changes around route resources / virtual host matching and error handling. [5]
-
v1.79.0
- API change (experimental/stats):
MetricsRecorderimplementations must embedUnimplementedMetricsRecorder(breaks existing implementations). [6] - Behavior change (balancer/weightedtarget): stops handling
Addressesand only handlesEndpointsin resolver updates (can break custom resolvers/balancers that relied onAddresses). [6]
- API change (experimental/stats):
-
v1.79.3
- Security hardening behavior: requests with a non-canonical
:path(e.g., missing leading/) are now rejected withUnimplemented(could break malformed/non-compliant clients/proxies). [7]
- Security hardening behavior: requests with a non-canonical
Sources (release notes):
[1] (github.com) (v1.74.2)
[2] (github.com) (v1.75.0)
[3] (github.com) (v1.76.0)
[4] (github.com) (v1.77.0)
[5] (github.com) (v1.78.0)
[6] (github.com) (v1.79.0)
[7] (github.com) (v1.79.3)
Citations:
- 1: https://github.com/grpc/grpc-go/releases/tag/v1.74.2
- 2: https://github.com/grpc/grpc-go/releases/tag/v1.75.0
- 3: https://github.com/grpc/grpc-go/releases/tag/v1.76.0
- 4: https://github.com/grpc/grpc-go/releases/tag/v1.77.0
- 5: https://github.com/grpc/grpc-go/releases/tag/v1.78.0
- 6: https://github.com/grpc/grpc-go/releases/tag/v1.79.0
- 7: https://github.com/grpc/grpc-go/releases/tag/v1.79.3
Ensure compatibility testing for gRPC v1.79.3 upgrade; multiple breaking changes between v1.73.0 and v1.79.3 require validation.
CVE-2026-33186 is confirmed (CVSS 9.1, critical authorization-bypass in HTTP/2 :path validation) and v1.79.3 is the fix. However, the upgrade spans multiple versions with significant breaking/behavioral changes that must be tested:
- v1.74.2:
balancer.Balancerinterface now requiresExitIdle()method (breaks custom balancer implementations) - v1.75.0: Stats API changes;
authorityselection behavior changes - v1.76.0: Go 1.24 minimum required (verify your build environment supports this)
- v1.77.0:
mem.Readerchanged from interface to struct - v1.78.0: Stricter target URL validation; xDS resolver behavior changes
- v1.79.0:
MetricsRecorderimplementations must now embedUnimplementedMetricsRecorder - v1.79.3: Rejects non-canonical HTTP/2
:path(security fix; verify clients/proxies don't send malformed paths)
Before merging, validate that custom gRPC server configuration in pkg/driver/driver.go (interceptors, options, balancers) works with all these changes, and confirm your build environment supports Go 1.24+.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 26, Upgrade to google.golang.org/grpc v1.79.3 requires
targeted compatibility validation: update module/go toolchain to Go 1.24+, then
run full build/tests; specifically inspect pkg/driver/driver.go server setup
(e.g., NewDriver / RegisterGRPCServer or where grpc.NewServer and
grpc.DialOptions/interceptors/balancer are configured) to ensure custom
balancers implement the new ExitIdle() method, MetricsRecorder embeds
UnimplementedMetricsRecorder, mem.Reader usage is updated for struct changes,
and target URL validation/xDS behavior and authority selection still work; also
run integration tests against common clients/proxies to verify they do not send
non-canonical HTTP/2 :path values (CVE fix) and adjust any interceptor/option
usage accordingly before merging.
|
/ok-to-test |
openshift-ci
bot
added
ok-to-test
|
@ocp-sustaining-admins: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is part of an automated process.
The commands used to generate this PR were:
A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.