chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /endpoints - #1721
Conversation
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.1 to 1.83.2. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.83.1...v1.83.2) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
The grpc 1.83.1 -> 1.83.2 bump pulls golang.org/x/net to v0.58.0 in endpoints/go.mod, but the server plugins only replace the local nhp module (not endpoints), so `go mod tidy` in each plugin has no path to pick up that higher version on its own. That left plugin=v0.57.0 vs endpoints=v0.58.0, which check-plugin-deps.sh (and Go's plugin fingerprinting) rejects. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VjXEEjEs1FwqQAukzsnTQb
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Looks Good - Code looks good
Reviewed both commits. This is a security patch bump plus a necessary cross-module alignment fix. No blocking issues found.
What I verified
1. Dependabot commit (01dc98e) — grpc 1.83.1 → 1.83.2
Upstream release is a security fix only (grpc/grpc-go 9365): the server now rejects requests missing both :authority and Host with HTTP 400. grpc is an indirect dep here (pulled in via the sigstore/cosign and etcd trees), and OpenNHP does not run a gRPC server, so behavioral risk is nil. The transitive golang.org/x/net v0.57.0 → v0.58.0 bump comes along with it.
2. Follow-up commit (79301c1) — plugin dep alignment
The rationale in the commit message is correct and important: plugin modules only replace the local nhp module, not endpoints, so go mod tidy inside examples/server_plugin/* has no path to observe the version endpoints selected. Without this commit scripts/check-plugin-deps.sh (gating make plugins → make) fails, and at runtime Go's plugin fingerprinting would reject plugin.Open with "plugin was built with a different version of package golang.org/x/net".
I walked every shared require entry in all three plugin go.mod files against endpoints/go.mod (the exact comparison check-plugin-deps.sh performs, minus the github.com/OpenNHP/opennhp/* exclusion). Post-PR every overlapping package matches — arch v0.23.0, crypto v0.56.0, net v0.58.0, sys v0.47.0, text v0.41.0, oauth2 v0.36.0, protobuf v1.36.11, plus the whole gin/sonic/quic-go/mongo-driver set. davecgh/go-spew and pmezard/go-difflib (basic only) are absent from endpoints/go.mod and are correctly skipped by the script.
Bonus: this also clears pre-existing drift that was on main independently of the grpc bump — plugins were pinned at crypto v0.54.0 / text v0.40.0 while endpoints was already at v0.56.0 / v0.41.0. So the PR leaves make plugins in a better state than it found it.
3. go.sum integrity
Every added hash line matches the same module version already recorded in independently-generated sums elsewhere in the repo:
crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=— identical innhp/go.sum:135,endpoints/go.sum:585,demoapp/go.sum:109text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=— identical innhp/go.sum:144,endpoints/go.sum:640,demoapp/go.sum:121net v0.58.0— identical to the Dependabot-generated line inendpoints/go.sum
The removals (mattn/go-isatty v0.0.20, golang.org/x/sys v0.6.0/go.mod) are ordinary module-graph pruning fallout from the bumps, consistent with genuine go mod tidy output rather than hand editing.
Non-blocking notes
go 1.26→go 1.26.0in all three plugingo.modfiles. Incidentalgo getnormalization, semantically identical to Go. It happens to be an improvement:nhp,endpoints, anddemoappall already use the three-part1.26.0form, so the plugins are now consistent with the rest of the repo. Worth a line in the commit body next time since it is unrelated to the dep bump.nhp/go.mod:52still pinsgolang.org/x/net v0.57.0. Harmless —nhpis consumed viareplacefrom bothendpointsand the plugins, and MVS selectsv0.58.0in both build lists, so the compiled package is identical on either side of the plugin boundary. No fingerprint risk. Mentioning only so it is not mistaken for drift on a future audit.- Suggestion (follow-up, not this PR): this manual re-sync will recur on every Dependabot bump that touches a package shared with the plugins.
scripts/check-plugin-deps.shalready knows the exact package/version mapping it needs; adding a--fixmode that shells out togo mod edit -require=+go mod tidyper plugin would turn this from a two-commit manual fix into a one-liner. Alternatively, have Dependabot open a grouped PR coveringexamples/server_plugin/*alongsideendpoints.
Not applicable
No source changes, so no Go formatting/import-grouping concerns per CLAUDE.md. No config, API, or protocol surface touched — no breaking-change or migration risk. Plugin build verification rests on the pending build job (make → make plugins → check-plugin-deps); worth confirming it goes green before merge.
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #1721 +/- ##
=======================================
Coverage 13.10% 13.10%
=======================================
Files 96 96
Lines 15006 15006
=======================================
Hits 1967 1967
- Misses 12842 12843 +1
+ Partials 197 196 -1
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
2 participants
Bumps google.golang.org/grpc from 1.83.1 to 1.83.2.
Release notes
Sourced from google.golang.org/grpc's releases.
Commits
030ee8bUpdate version to 1.83.2 (#9375)8668b69cherry-pick #9365 to v1.83.x (#9366)a3e952dcherry-pick #9346 to v1.83.x and update x/net dependency (#9369)58f8fd9Change version to 1.83.2-dev (#9337)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.