Skip to content

deps(all): update gRPC to v1.82.1 - #12780

Draft
asddongmen wants to merge 1 commit into
pingcap:masterfrom
asddongmen:agent/master-security-dependencies
Draft

deps(all): update gRPC to v1.82.1#12780
asddongmen wants to merge 1 commit into
pingcap:masterfrom
asddongmen:agent/master-security-dependencies

Conversation

@asddongmen

Copy link
Copy Markdown
Contributor

What problem does this PR solve?

Issue Number: close #12779

TiFlow master selects gRPC v1.79.3, below the v1.82.1 fixed version for GHSA-hrxh-6v49-42gf. The other reported vulnerable modules were already updated by #12769.

What is changed and how it works?

  • Update google.golang.org/grpc to v1.82.1.
  • Refresh only the transitive module closure required by Go minimal version selection.
  • Keep the diff limited to root go.mod and go.sum.

Check List

Tests

  • Unit test: GOPROXY=https://proxy.golang.org,direct make unit_test
  • Unit test: GOPROXY=https://proxy.golang.org,direct make dm_unit_test
  • Manual test: GOPROXY=https://proxy.golang.org,direct make build
  • Manual test: GOPROXY=https://proxy.golang.org,direct make check

Questions

Will it cause performance regression or break compatibility?

No expected regression. This changes only module metadata, and the full build and unit suites pass.

Do you need to update user documentation, design documentation or monitoring documentation?

No.

Release note

Upgrade gRPC to address a known security vulnerability.

Update gRPC to the advisory fixed version and refresh only the transitive module closure required by minimal version selection.
@ti-chi-bot

ti-chi-bot Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@ti-chi-bot ti-chi-bot Bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/needs-triage-completed labels Jul 31, 2026
@ti-chi-bot

ti-chi-bot Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign joechenrh for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e441da8b-5b6d-4609-a67d-4ab78c82dcdc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@ti-chi-bot ti-chi-bot Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jul 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/needs-triage-completed do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Update gRPC dependency on master

1 participant