chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.83.1 - #64
chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.83.1#64dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.83.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.81.1...v1.83.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependency Bump Evaluation
Version change: google.golang.org/grpc 1.81.1 -> 1.83.1 (two minor bumps + patches)
Files changed: go.mod, go.sum only
Changes (1.82.0 - 1.83.1):
- Security: HTTP/2 frame flood throttling (server), reject requests missing
:authorityandHostheaders, multiple xds/rbac fixes for DENY rules failing open and panics - Behavior: Strict RPC path validation is now permanent (env var to disable removed); balancer registry is now case-sensitive
- Performance: Reduced memory overhead from buffering small data frames
- Features: Server goroutine pprof labels, DirectPath over Interconnect, GCP auth filter, HTTP CONNECT proxy support (all opt-in)
Breaking changes: Strict path validation is permanent and balancer registry is case-sensitive (1.82.0), but neither affects this codebase -- the adapter serves standard protobuf-defined RPC methods and uses gRPC only as a server (no client-side balancers)
Security concerns: None negative. The bump includes beneficial security hardening (frame flood protection, authority header validation). The xds/rbac fixes do not apply -- the adapter does not use xds or rbac
Impact on codebase: The adapter uses only core stable APIs (grpc.NewServer, chain interceptors, codes, status, health). None of these APIs were changed or deprecated across any of the intermediate releases. No xds, rbac, or alts usage found in the codebase
Recommendation: SAFE TO MERGE
-- Claude Code
Bumps google.golang.org/grpc from 1.81.1 to 1.83.1.
Release notes
Sourced from google.golang.org/grpc's releases.
... (truncated)
Commits
1550d9eChange version to 1.83.1 (#9336)ebba6f3Cherry-pick #9258 and #9332 into v1.83.x (#9335)8cfeca0Cherry-pick #9331 to v1.83.x (#9333)dec6951Change version to 1.83.1-dev (#9229)4c226daChange version to 1.83.0 (#9228)c198988Cherrypick 9223 into v1.83.x (#9279)8ce3ebfCherrypick PR 9255 into v1.83.x (#9263)e393849Cherry-pick recent changes from master (#9240)2a112a8authz: add onPolicyUpdate callback to authz file watcher (#9142)1a80fcavet: adds a check to disallow usage of regex.Compile in xDS code (#9216)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.