Fix: upgrade grpc-go to v1.79.3 for CVE-2026-33186#5
Merged
cbullinger merged 2 commits intomainfrom Mar 19, 2026
Merged
Conversation
Updates the transitive grpc-go dependency from v1.78.0 to v1.79.3 to address a critical (CVSS 9.1) authorization bypass vulnerability via missing leading slash in the HTTP/2 :path pseudo-header. Resolves Dependabot alert #1. Made-with: Cursor
LogWarning already had the annotation; LogInfo and LogError use the same structured logging pattern but were missing it, causing gosec CI failures. Made-with: Cursor
dacharyc
approved these changes
Mar 19, 2026
Collaborator
dacharyc
left a comment
dacharyc
left a comment
There was a problem hiding this comment.
Thanks for fixing this up! 🙏 ✅
| // LogInfo writes an info-level log. | ||
| func LogInfo(message string, args ...any) { | ||
| slog.Info(message, args...) | ||
| slog.Info(message, args...) // #nosec G706 -- structured logging; args are key-value pairs, not user input |
cbullinger
added a commit
that referenced
this pull request
Apr 22, 2026
- handleRepoPermission: return {allowed, error?} per repo instead of a
raw bool map. The frontend now shows GitHub rate-limit / transient
errors in replay-button tooltips instead of generic "no access". UI
keeps boolean-shape compat for partial rollouts. (review #7)
- githubCreateVersionTag: apply the same ghUsernameRe / ghRepoNameRe
whitelist + url.PathEscape treatment ghAPIGetRepoPermission already
uses. Also add a ghBranchNameRe check. Env-vars only today, but keeps
the SSRF hardening story consistent across the package. (review #8)
- sharedGithubHTTPClient package var replaces per-call allocation in
githubHTTPClient(). (review minor)
- ReleaseAPIMode typed string with ReleaseAPIDisabled /
ReleaseAPITagCreateEnabled constants. (review minor)
- truncate() is now rune-aware so multi-byte LLM output isn't cut
mid-glyph in error logs. (review minor)
- Replay delivery IDs append a 3-byte random suffix so two replays in
the same millisecond can't collide on the trace ring. (review minor)
- Anthropic fallback model list trimmed to one stable alias
(claude-haiku-4-5). Listing rotating dated IDs here ships dead
dropdown options on every Claude release. (review #9)
- Normalize the Anthropic default model to the aliased form
("claude-haiku-4-5") in configs/environment.go and llm_anthropic.go
so every default path matches ci.yml and env-cloudrun.yaml. (review #10)
- AI settings UI hint calls out that settings are process-global,
affect all operators, and revert on restart. Fixes the "two operators
clobber each other silently" footgun. (review #5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
google.golang.org/grpcdependency from v1.78.0 to v1.79.3 to fix a critical authorization bypass vulnerability (CVSS 9.1)Security Issue Addressed
Critical Severity
:pathpseudo-headergrpc/authz) evaluated non-canonical paths, allowing "deny" rules to be bypassed when a fallback "allow" rule was presentChanges
google.golang.org/grpcfrom v1.78.0 to v1.79.3 ingo.mod(indirect dependency)go.sumchecksums accordinglyNotes
grpc-gois a transitive dependency in this project, pulled in by Google Cloud SDK libraries (secretmanager,logging) and OpenTelemetry gRPC instrumentationgrpc-godirectly in any.gosource filesDependabot Alerts Resolved
Resolves https://github.com/grove-platform/github-copier/security/dependabot/1
Test Plan
go get google.golang.org/grpc@v1.79.3succeededgo mod tidycompleted cleanlygo.modconfirms v1.79.3go build ./...passesMade with Cursor