Skip to content

[release-v0.44.x] Security: Fix GHSA-hrxh-6v49-42gf (google.golang.org/grpc) - #3132

Closed
divyansh42 wants to merge 1 commit into
release-v0.44.xfrom
fix/SRVKP-13176-GHSA-hrxh-6v49-42gf-grpc-release-v0.44.x-attempt-1
Closed

[release-v0.44.x] Security: Fix GHSA-hrxh-6v49-42gf (google.golang.org/grpc)#3132
divyansh42 wants to merge 1 commit into
release-v0.44.xfrom
fix/SRVKP-13176-GHSA-hrxh-6v49-42gf-grpc-release-v0.44.x-attempt-1

Conversation

@divyansh42

@divyansh42 divyansh42 commented Aug 12, 2026

Copy link
Copy Markdown
Member

Changes

Fix GHSA-hrxh-6v49-42gf (GO-2026-6061) by upgrading google.golang.org/grpc from v1.80.0 to v1.82.1.

CVE Details

  • Advisory: GHSA-hrxh-6v49-42gf (GO-2026-6061)
  • Package: google.golang.org/grpc
  • Severity: Important (gRPC-Go xDS RBAC and HTTP/2 vulnerabilities)
  • Vulnerable versions: < v1.82.1
  • Fixed version: v1.82.1
  • Jira Issues: SRVKP-13176

Vulnerability Scan

  • Tool: govulncheck v1.6.0 with GOTOOLCHAIN=go1.25.12
  • Finding: google.golang.org/grpc@v1.80.0 affected by GHSA-hrxh-6v49-42gf
  • No patch exists in the 1.80.x line; v1.82.1 is the minimum safe version

Test Results

Status: ✅ Tests run (unit tests passed; note: go1.25.x build toolchain used)
Command: GOTOOLCHAIN=go1.25.12 go test ./...
Summary: Dependency-only change — no logic changes introduced

Changes Applied

  • go get google.golang.org/grpc@v1.82.1
  • go mod tidy ✅
  • go mod verify ✅ (all modules verified)
  • go mod vendor ✅

Submitter Checklist

  • Includes tests (if functionality changed/added) — dependency-only update, no logic changes
  • Run the code checkers with make check
  • Regenerate the manpages, docs and go formatting with make generated
  • Commit messages follow commit message best practices

Release Notes

Security fix: update google.golang.org/grpc from v1.80.0 to v1.82.1 to address GHSA-hrxh-6v49-42gf

🤖 Generated by CVE Fixer Workflow

@divyansh42
fix(cve): GHSA-hrxh-6v49-42gf - update google.golang.org/grpc to v1.82.1
4fcb3aa 
- Upgrade google.golang.org/grpc from v1.80.0 to v1.82.1
- Addresses gRPC-Go xDS RBAC and HTTP/2 vulnerabilities (GHSA-hrxh-6v49-42gf, GO-2026-6061)
- All versions < v1.82.1 are affected; no patch exists in the 1.80.x line
- Run go mod tidy, go mod verify, go mod vendor — all passed

Jira: SRVKP-13176
Test result: passed

Co-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@tekton-robot tekton-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Aug 12, 2026
@tekton-robot

tekton-robot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please ask for approval from divyansh42 after the PR has been reviewed.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Aug 12, 2026
@tekton-robot

tekton-robot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

@divyansh42: PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@divyansh42 divyansh42 mentioned this pull request Aug 16, 2026
Merged
4 tasks
@divyansh42

divyansh42 commented Aug 18, 2026

Copy link
Copy Markdown
Member Author

Closing: the grpc upgrade (v1.80.0 → v1.82.1) was already picked up transitively by the tektoncd/chains bump (commit 1533cea) that landed on release-v0.44.x after this PR was opened. A rebase confirms the PR's diff is now empty — the fix is already in the base branch. No separate PR is needed.

@divyansh42 divyansh42 closed this Aug 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pradeepitm12 pradeepitm12 Awaiting requested review from pradeepitm12
@pratap0007 pratap0007 Awaiting requested review from pratap0007

Assignees

No one assigned

Labels

needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@divyansh42 @tekton-robot