Skip to content

fix(deps): update grpc to v1.83.2 and consolidate dependency updates - #108

Merged
jaronoff97 merged 1 commit into
masterfrom
fix/grpc-cve-and-deps
Sep 22, 2026
Merged

jaronoff97 merged 1 commit into
masterfrom
fix/grpc-cve-and-deps

Conversation

@jaronoff97

Copy link
Copy Markdown
Contributor

Summary

Fixes the open grpc CVEs for policy-go and consolidates the open renovate/dependabot PRs.

Security

Consolidated bot updates

Supersedes #102, #103, #106, #107.

Test plan

  • go build ./... in all modules, with the workspace and with GOWORK=off
  • go vet ./...
  • go test ./... in policy, backend/hyperscan, examples

🤖 Generated with Claude Code

Fixes CVE-2026-84304 and CVE-2026-84445 (google.golang.org/grpc).

- google.golang.org/grpc v1.82.1 -> v1.83.2
- google.golang.org/protobuf v1.36.11 -> v1.36.12
- google.golang.org/genproto/googleapis/api -> f61a6ca
- github.com/stretchr/testify v1.11.1 -> v1.12.1
- policy: github.com/usetero/policy-go/proto v1.10.0 -> v1.11.0
- backends: github.com/usetero/policy-go/policy v1.10.1 -> v1.12.0

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@macroscopeapp

macroscopeapp Bot commented Sep 22, 2026

Copy link
Copy Markdown

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR is limited to ignored dependency manifests and checksum updates, with no direct source-code or schema changes. Because it changes production dependency versions specifically to remediate grpc CVEs, the security-sensitive dependency selection should receive human review.

Not approved because:

  • Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.

@jaronoff97
jaronoff97 merged commit f5d3f6e into master Sep 22, 2026
6 checks passed
@jaronoff97
jaronoff97 deleted the fix/grpc-cve-and-deps branch September 22, 2026 22:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants