Problem
TiDB v8.5 needs to upgrade google.golang.org/grpc for a security fix.
The reported vulnerability is CVE-2026-33186, flagged against google.golang.org/grpc v1.63.2 in TiDB v8.5. The customer/security scan requires grpc-go to be upgraded to a non-vulnerable version.
The upgrade is currently blocked on the tidb-8.5 client-go dependency set. Bumping grpc alone does not compile because this branch still uses grpc APIs removed in newer grpc versions.
Current state
tidb-8.5 client-go:
github.com/tikv/client-go/v2: v2.0.8-0.20260420090212-754a707563bdgoogle.golang.org/grpc: v1.63.2
master-compatible client-go:
github.com/tikv/client-go/v2: v2.0.8-0.20260423085316-fce9638195b3google.golang.org/grpc: v1.75.1
Request
Please help provide a tidb-8.5-compatible client-go update so TiDB release-8.5 can upgrade grpc for the security fix.
Problem
TiDB v8.5 needs to upgrade
google.golang.org/grpcfor a security fix.The reported vulnerability is
CVE-2026-33186, flagged againstgoogle.golang.org/grpc v1.63.2in TiDB v8.5. The customer/security scan requires grpc-go to be upgraded to a non-vulnerable version.The upgrade is currently blocked on the tidb-8.5 client-go dependency set. Bumping grpc alone does not compile because this branch still uses grpc APIs removed in newer grpc versions.
Current state
tidb-8.5 client-go:
github.com/tikv/client-go/v2:v2.0.8-0.20260420090212-754a707563bdgoogle.golang.org/grpc:v1.63.2master-compatible client-go:
github.com/tikv/client-go/v2:v2.0.8-0.20260423085316-fce9638195b3google.golang.org/grpc:v1.75.1Request
Please help provide a tidb-8.5-compatible client-go update so TiDB release-8.5 can upgrade grpc for the security fix.