OCPBUGS-80539: Bump google.golang.org/grpc to v1.79.3

[ocp-sustaining-admins]

This is an automated PR from the ARC system.

Go version used: go1.24.13

The commands used to generate this PR were:

go get google.golang.org/grpc@v1.79.3
go mod tidy
go mod vendor

A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.

[openshift-ci-robot]

@ocp-sustaining-admins: This pull request references Jira Issue OCPBUGS-80539, which is invalid:

• release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
• expected Jira Issue OCPBUGS-80539 to depend on a bug targeting a version in 4.21.0, 4.21.z and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This PR is part of an automated process.

The commands used to generate this PR were:

go get google.golang.org/grpc@v1.79.3 toolchain@none
go mod tidy
go mod vendor

A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

• do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: aeb30428-023f-4663-adc8-3dfea9a86a19

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

Hi @ocp-sustaining-admins. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ocp-sustaining-admins
Once this PR has been reviewed and has the lgtm label, please assign radekmanak for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[shannon]

/ok-to-test

[openshift-ci]

@ocp-sustaining-admins: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify-commits	ee2b4b2	link	false	/test verify-commits

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[racheljpg]

Hi. Do we need this PR?
Looking through this repo, I don't see the grpc package (in any of the releases), so I don't think it needs to be updated. I'm also not sure I see it being bumped in the diff of this PR - correct me if I'm wrong! Thanks
cc. @damdo

[shannon]

Hi @racheljpg,

The Openshift Sustaining team is still working on the ARC automation. There was an issue when this PR was created because it did not handle the fact that the actual vulnerability is in a subfolder.

https://github.com/openshift/azure-service-operator/blob/release-4.20/v2/go.mod#L122

Due to the practical requirements of fixing CVEs across all versions of components within OCP we will automatically bump all packages contained in the repo, even if they are not the main entry point.

We are working on a fix now and once resolved, we will re-run the automation which will update this PR.

Secondarily we are also aware that some components require commit verification upstream. We are working to determine the best way to automate this. Please bare with us while we take advantage of this real world case and make adjustments to our automation.

For now you can leave this PR to the Sustaining team. We will either make sure that it is valid, or will close it out if we are unable to arrive at a solution with the automation within our time constraints.