Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 8, 2023

Bumps google.golang.org/grpc from 1.44.0 to 1.53.0.

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.53.0

API Changes

  • balancer: support injection of per-call metadata from LB policies (#5853)
  • resolver: remove deprecated field resolver.Target.Endpoint and replace with resolver.Target.Endpoint() (#5852)

New Features

  • xds/ringhash: introduce GRPC_RING_HASH_CAP environment variable to override the maximum ring size. (#5884)
  • rls: propagate headers received in RLS response to backends (#5883)

Bug Fixes

  • transport: drain client transport when streamID approaches MaxStreamID (#5889)
  • server: after GracefulStop, ensure connections are closed when final RPC completes (#5968)
  • server: fix a few issues where grpc server uses RST_STREAM for non-HTTP/2 errors (#5893)
  • xdsclient: fix race which can happen when multiple load reporting calls are made at the same time. (#5927)
  • rls: fix a data race involving the LRU cache (#5925)
  • xds: fix panic involving double close of channel in xDS transport (#5959)
  • gcp/observability: update method name validation (#5951)

Documentation

  • credentials/oauth: mark NewOauthAccess as deprecated (#5882)

Release 1.52.3

Bug Fixes

  • Fix user-agent version

Release 1.52.2

Bug Fixes

  • xds: fix panic involving double close of channel in xDS transport (#5959)

Release 1.52.1

Bug Fixes

  • grpclb: rename grpclbstate package back to state (#5963)

Release 1.52.0

New Features

  • xdsclient: log node ID with verbosity INFO (#5860)
  • ringhash: impose cap on max_ring_size to reduce possibility of OOMs (#5801)

Behavior Changes

... (truncated)

Commits
  • dba26e1 Change version to 1.53.0 (#5983)
  • 2a1e934 server: after GracefulStop, ensure connections are closed when final RPC comp...
  • e2d69aa tests: fix spelling of variable (#5966)
  • a6376c9 xds/resolver: cleanup tests to use real xDS client 3/n (#5953)
  • bf8fc46 xds/resolver: cleanup tests to use real xDS client 5/n (#5955)
  • 3930549 resolver: replace resolver.Target.Endpoint field with Endpoint() method (#5852)
  • 894816c grpclb: rename grpclbstate package back to state (#5962)
  • e5a0237 encoding: fix duplicate compressor names (#5958)
  • 4adb2a7 xds/resolver: cleanup tests to use real xDS client 2/n (#5952)
  • 52a8392 gcp/observability: update method name validation (#5951)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.44.0 to 1.53.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.44.0...v1.53.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested a review from a team as a code owner February 8, 2023 14:06
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Feb 8, 2023
@trafico-bot trafico-bot bot added the 🔍 Ready for Review Pull Request is not reviewed yet label Feb 8, 2023
@guardrails
Copy link

guardrails bot commented Feb 8, 2023

⚠️ We detected 42 security issues in this pull request:

Vulnerable Libraries (42)
Severity Details
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20220227234510-4e6760a101f9 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
High pkg:golang/golang.org/x/[email protected]@v0.0.0-20210421170649-83a5a9bb288b - no patch available
Medium pkg:golang/golang.org/x/[email protected]@v0.0.0-20190820162420-60c769a6c586 - no patch available
Medium pkg:golang/github.com/pkg/[email protected]@v1.10.1 - no patch available
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20221012135044-0b7e1fb9d458 upgrade to: 1.18.9,1.19.4,0.4.0
High pkg:golang/golang.org/x/[email protected]@v0.0.0-20210503060351-7fd8e65b6420 - no patch available
High pkg:golang/golang.org/x/[email protected]@v0.0.0-20201224014010-6772e930b67b - no patch available
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20211210111614-af8b64212486 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20220328115105-d36c6a25d886 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20220722155237-a158d28d115b upgrade to: 1.18.6,1.19.1,0.0.0-20220906165146-f3363e06e74c
High pkg:golang/golang.org/x/[email protected]@v0.3.5 - no patch available
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20221014081412-f15817d10f9b upgrade to: 0.1.1-0.20221104162952-702349b0e862
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20220607020251-c690dde0001d upgrade to: 0.1.1-0.20221104162952-702349b0e862
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20210908233432-aa78b53d3365 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20210104204734-6f8348627aad upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
N/A pkg:golang/golang.org/x/[email protected] @v0.0.0-20211108221036-ceb1ce70b4fa upgrade to: 0.0.0-20211202192323-5770296d904e
High pkg:golang/golang.org/x/[email protected]@v0.0.0-20220225172249-27dd8689420f - no patch available
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20210823070655-63515b42dcdf upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20210603125802-9665404d3644 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
High pkg:golang/golang.org/x/[email protected]@v0.0.0-20211108221036-ceb1ce70b4fa - no patch available
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20210423185535-09eb48e85fd7 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20210220050731-9a76102bfb43 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
High pkg:golang/golang.org/x/[email protected]@v0.3.4 - no patch available
High pkg:golang/golang.org/x/[email protected]@v0.0.0-20201209123823-ac852fbbde11 - no patch available
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20211124211545-fe61309f8881 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20210806184541-e5e7981a1069 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
High pkg:golang/golang.org/x/[email protected]@v0.0.0-20220127200216-cd36cc0744dd - no patch available
High pkg:golang/golang.org/x/[email protected]@v0.0.0-20220425223048-2871e0cb64e4 - no patch available
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20210320140829-1e4c9ba3b0c4 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
High pkg:golang/golang.org/x/[email protected]@v0.0.0-20220412020605-290c469a71a5 - no patch available
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20200905004654-be1d3432aa8f upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
High pkg:golang/golang.org/x/[email protected]@v0.0.0-20201031054903-ff519b6c9102 - no patch available
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20220624214902-1bab6f366d9e upgrade to: 1.18.6,1.19.1,0.0.0-20220906165146-f3363e06e74c
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20220209214540-3681064d5158 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20220617184016-355a448f1bc9 upgrade to: 1.18.6,1.19.1,0.0.0-20220906165146-f3363e06e74c
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20210616094352-59db8d763f22 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20220909164309-bea034e7d591 upgrade to: 0.1.1-0.20221104162952-702349b0e862
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20210225134936-a50acf3fe073 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
High pkg:golang/golang.org/x/[email protected]@v0.0.0-20220325170049-de3da57026de - no patch available
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20201201145000-ef89a241ccb3 upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
N/A pkg:golang/golang.org/x/[email protected]@v0.0.0-20210305230114-8fe3ee5dd75b upgrade to: 1.17.10,1.18.2,0.0.0-20220412211240-33da011f77ad
High pkg:golang/github.com/hashicorp/consul/[email protected]@v1.3.0 - no patch available

More info on how to fix Vulnerable Libraries in Go.


👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code 🔍 Ready for Review Pull Request is not reviewed yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant