fix(deps): bump grpc to v1.82.1 - #787
Conversation
![plural-copilot[bot]](https://avatars.githubusercontent.com/in/916369?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:
| Name | Details |
|---|---|
| 💬 Prompt | Investigate and, if possible, create a remediation PR in pluralsh/plural-cli for the actionable vulnerability affecting the ghcr.io/pluralsh/console:sha-08f96c1 image.... |
| 🔗 Run history | View run history |
Greptile SummaryThis PR bumps the direct
Confidence Score: 5/5Minimal, targeted security patch with no logic changes; safe to merge. The change is a single-line version bump in go.mod plus the corresponding go.sum additions. The new go.sum h1: hash for v1.82.1 differs from v1.82.0's (as expected for a different release), and the shared go.mod hash across both versions is consistent with an unchanged module descriptor. No indirect dependencies, no code changes, no risky refactoring. No files require special attention.
|
| Filename | Overview |
|---|---|
| go.mod | Bumps google.golang.org/grpc from v1.82.0 to v1.82.1 to remediate GHSA-hrxh-6v49-42gf; no other changes. |
| go.sum | Adds go.sum hash entries for grpc v1.82.1 while retaining v1.82.0 entries as expected for a Go module lockfile; hashes look consistent. |
Reviews (1): Last reviewed commit: "fix(deps): bump grpc to v1.82.1" | Re-trigger Greptile
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Summary
google.golang.org/grpcdependency fromv1.82.0tov1.82.1go.sumentries onlyv1.82.1Why
This remediates GHSA-hrxh-6v49-42gf for the
pluralCLI binary that is bundled into theghcr.io/pluralsh/consoleimage.Validation
docker run --rm --entrypoint /usr/local/go/bin/go -v "$PWD":/src -w /src golang:1.26.5 list -m google.golang.org/grpcdocker run --rm --entrypoint /usr/local/go/bin/go -v "$PWD":/src -w /src golang:1.26.5 build -buildvcs=false ./cmd/pluralNote: the build uses
-buildvcs=falsein this sandbox because the checkout environment lacks git metadata required for default Go VCS stamping.