Skip to content

google patch[deps]: fix release-2.45.3-gmp vulnerabilities - #354

Merged
bwplotka merged 1 commit into
release-2.45.3-gmpfrom
bwplotka/release-2.45.3-gmp-gmpctl-vulnfix
Aug 6, 2026
Merged

google patch[deps]: fix release-2.45.3-gmp vulnerabilities#354
bwplotka merged 1 commit into
release-2.45.3-gmpfrom
bwplotka/release-2.45.3-gmp-gmpctl-vulnfix

Conversation

@bwplotka

@bwplotka bwplotka commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

Updating Go and image vulnerabilities using

./gmpctl.sh vulnfix

Signed-off-by: bwplotka <bwplotka@gmail.com>

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the gRPC dependency to version 1.82.1, bringing in various improvements, refactorings, and security enhancements. Key changes include bounding the built-in gzip decompressor output to prevent zip bomb vulnerabilities, adding support for collecting non-gRPC response bodies on the client, introducing server-side goroutine labeling, and removing the strict path checking escape hatch. Feedback on the changes highlights a resource leak in the ALTS server handshake where the handshaker is not closed on error, a potential pprof label leak when worker pools are enabled, and an opportunity to optimize slice allocations when registering telemetry label callbacks.

Comment thread vendor/google.golang.org/grpc/credentials/alts/alts.go
Comment thread vendor/google.golang.org/grpc/server.go
Comment thread vendor/google.golang.org/grpc/internal/stats/labels.go
@bwplotka
bwplotka requested a review from avilevy18 August 6, 2026 12:18
@bwplotka
bwplotka merged commit 1e07289 into release-2.45.3-gmp Aug 6, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants