Bump google.golang.org/grpc to v1.82.1 to fix GHSA-hrxh-6v49-42gf - #786
Bump google.golang.org/grpc to v1.82.1 to fix GHSA-hrxh-6v49-42gf#786plural-copilot[bot] wants to merge 1 commit into
Conversation
![plural-copilot[bot]](https://avatars.githubusercontent.com/in/916369?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:
| Name | Details |
|---|---|
| 💬 Prompt | ... |
| 🔗 Run history | View run history |
Greptile SummaryThis PR bumps
Confidence Score: 5/5Safe to merge — the change is a single-line version bump of one dependency to a published patch release. Only two files change: the grpc version pin in go.mod and the matching hash in go.sum. The go.sum hashes are consistent with a real patch release (module-content hash updated, go.mod hash unchanged, no other entries disturbed). No application code is touched. No files require special attention.
|
| Filename | Overview |
|---|---|
| go.mod | Bumps google.golang.org/grpc from v1.82.0 to v1.82.1 to address GHSA-hrxh-6v49-42gf; change is minimal and correct. |
| go.sum | go.sum updated with correct h1 hash for grpc v1.82.1; go.mod hash is unchanged (expected for a patch release that doesn't alter go.mod), and all other entries are untouched. |
Reviews (1): Last reviewed commit: "fix: bump google.golang.org/grpc to v1.8..." | Re-trigger Greptile
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Summary
google.golang.org/grpcfromv1.82.0tov1.82.1go.sumThis fixes a vulnerability surfaced by Trivy scanning of the
pluralCLI binary bundled in thepluralsh/consolecontainer image (ghcr.io/pluralsh/console).Plural Service: mgmt/console
Verification
go get google.golang.org/grpc@v1.82.1go mod tidygo build -buildvcs=false ./...in a Go 1.26.5 Docker environmentNotes
After merge, a new plural-cli release and console image rebuild will be needed to actually deploy the fix. That follow-up (image rebuild / GitOps tag bump) is out of scope for this PR and will be handled separately once the new CLI binary is released.