Skip to content

Fix/2026 03 19 grpc CVE#759

Merged
hallyn merged 2 commits intoproject-stacker:mainfrom
raharper:fix/2026-03-19-grpc-cve
Mar 20, 2026
Merged

Fix/2026 03 19 grpc CVE#759
hallyn merged 2 commits intoproject-stacker:mainfrom
raharper:fix/2026-03-19-grpc-cve

Conversation

@raharper
Copy link
Contributor

What type of PR is this?

bug

Which issue does this PR fix:

Dependabot Alert on gprc: CVE-2026-33186

GHSA-p77j-4mvh-x3m3

What does this PR do / Why do we need it:

Bump grpc to v1.79.3 which includes fix for CVE-2026-33186

If an issue # is not available please add repro steps and logs showing the issue:

1. $ git log --pretty=oneline -1
8e9e9d688687e737e68c888699fddb16da85e43a (HEAD -> main, origin/main, origin/HEAD) fix: Add warning for stacker files with bom: set
2. $ grype --version
grype 0.110.0
3. 

$ grype stacker
 ✔ Indexed file system                   stacker
 ✔ Cataloged contents                    57b8f1fe1e1d380b8c82ecb19ec6bcabcf4a24a6e8be79a14a8a1cf85b4f2dde
   ├── ✔ Packages                        [134 packages]
   ├── ✔ Executables                     [1 executables]
   ├── ✔ File digests                    [1 files]
   └── ✔ File metadata                   [1 locations]
 ✔ Scanned for vulnerabilities     [1 vulnerability matches]
   ├── by severity: 1 critical, 0 high, 0 medium, 0 low, 0 negligible
   └── by status:   1 fixed, 0 not-fixed, 0 ignored
NAME                    INSTALLED  FIXED IN  TYPE       VULNERABILITY        SEVERITY  EPSS  RISK
google.golang.org/grpc  v1.76.0    1.79.3    go-module  GHSA-p77j-4mvh-x3m3  Critical  N/A   N/A

Testing done on this change:

Automation added to e2e:

None

Will this break upgrades or downgrades?

No

Does this PR introduce any user-facing change?:

No

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@raharper raharper added the dependencies Pull requests that update a dependency file label Mar 19, 2026
@codecov
Copy link

codecov bot commented Mar 19, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.22%. Comparing base (551b30d) to head (62576ca).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #759   +/-   ##
=======================================
  Coverage   54.22%   54.22%           
=======================================
  Files          55       55           
  Lines        5909     5909           
=======================================
  Hits         3204     3204           
  Misses       2126     2126           
  Partials      579      579           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@raharper raharper force-pushed the fix/2026-03-19-grpc-cve branch from 1dbbbd5 to aa4b57f Compare March 20, 2026 14:24
Copy link
Contributor

@hallyn hallyn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, Ryan!

Should we just have github squash-merge, or were you going to rebase -i?

@raharper
Copy link
Contributor Author

Thanks, Ryan!

Should we just have github squash-merge, or were you going to rebase -i?

#760

Let's merge this (just the fix) and I'll rebase this PR

CVE in grpc requires bump to v1.79.3 which requires newer x/net
and other friends.

The older x/net 0.38.0 was incompatible with newer grpc HTTP2 and
running latest allows us to use v1.79.3

Signed-off-by: Ryan Harper <rharper@woxford.com>
Signed-off-by: Ryan Harper <rharper@woxford.com>
@raharper raharper force-pushed the fix/2026-03-19-grpc-cve branch from aa4b57f to 62576ca Compare March 20, 2026 17:27
@hallyn hallyn merged commit 259ff7b into project-stacker:main Mar 20, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants