security: latest release (v1.9.3) has CVE-2025-22870

[or-shachar]

Latest release v1.9.3 uses golang.org/x/net:0.33.0 which has moderate CVE CVE-2025-22870 ( GHSA-qxp5-gwg8-xv66).

I see this is fixed on main branch.

Can we please release a new version?

[spiliopoulos]

+1 I just came here to say the same. Also CVE-2025-22868 which is also fixed on the main branch.

It would be nice to not have to wait for a few months until the next scheduled release. If there is toil associated with cutting a new release happy to help.

(Also I understand that CVEs might not always be exploitable or matter for a tool like grpcurl but their presence make using them in corp environments with compliance restrictions harder and might affect adoption).

[spiliopoulos]

@gpassini will you lend us your power?

[or-shachar]

Any updates on this?

[or-shachar]

@gpassini any chance for a new release or a patch soon?

[pkmaster21]

+1 these vulns are affecting us too, can we get a new release soon? @dragonsinth any chance you can create a new release?

[jsolana]

Also, CVE-2026-33186