-
Notifications
You must be signed in to change notification settings - Fork 43
build(deps): bump the golang group across 1 directory with 11 updates #229
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
dependabot
wants to merge
1
commit into
main
Choose a base branch
from
dependabot/go_modules/golang-6a7037e41a
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,56 +1,57 @@ | ||
| module github.com/containernetworking/plugins | ||
|
|
||
| go 1.24.0 | ||
| go 1.25.0 | ||
|
|
||
| require ( | ||
| github.com/Microsoft/hcsshim v0.13.0 | ||
| github.com/Microsoft/hcsshim v0.14.1 | ||
| github.com/alexflint/go-filemutex v1.3.0 | ||
| github.com/buger/jsonparser v1.1.1 | ||
| github.com/buger/jsonparser v1.2.0 | ||
| github.com/containernetworking/cni v1.3.0 | ||
| github.com/coreos/go-iptables v0.8.0 | ||
| github.com/coreos/go-systemd/v22 v22.6.0 | ||
| github.com/godbus/dbus/v5 v5.1.0 | ||
| github.com/coreos/go-systemd/v22 v22.7.0 | ||
| github.com/godbus/dbus/v5 v5.2.2 | ||
| github.com/insomniacslk/dhcp v0.0.0-20240829085014-a3a4c1f04475 | ||
| github.com/mattn/go-shellwords v1.0.12 | ||
| github.com/mattn/go-shellwords v1.0.13 | ||
| github.com/networkplumbing/go-nft v0.4.0 | ||
| github.com/onsi/ginkgo/v2 v2.25.1 | ||
| github.com/onsi/gomega v1.38.1 | ||
| github.com/opencontainers/selinux v1.12.0 | ||
| github.com/onsi/ginkgo/v2 v2.28.3 | ||
| github.com/onsi/gomega v1.40.0 | ||
| github.com/opencontainers/selinux v1.13.1 | ||
| github.com/pkg/errors v0.9.1 | ||
| github.com/safchain/ethtool v0.6.2 | ||
| github.com/safchain/ethtool v0.7.0 | ||
| github.com/vishvananda/netlink v1.3.1 | ||
| github.com/vishvananda/netns v0.0.5 | ||
| golang.org/x/sys v0.35.0 | ||
| sigs.k8s.io/knftables v0.0.18 | ||
| golang.org/x/sys v0.43.0 | ||
| sigs.k8s.io/knftables v0.0.21 | ||
| ) | ||
|
|
||
| require ( | ||
| github.com/Masterminds/semver/v3 v3.4.0 // indirect | ||
| github.com/Microsoft/go-winio v0.6.2 // indirect | ||
| github.com/containerd/cgroups/v3 v3.0.3 // indirect | ||
| github.com/containerd/errdefs v0.3.0 // indirect | ||
| github.com/containerd/cgroups/v3 v3.0.5 // indirect | ||
| github.com/containerd/errdefs v1.0.0 // indirect | ||
| github.com/containerd/errdefs/pkg v0.3.0 // indirect | ||
| github.com/containerd/typeurl/v2 v2.2.0 // indirect | ||
| github.com/containerd/typeurl/v2 v2.2.3 // indirect | ||
| github.com/cyphar/filepath-securejoin v0.5.1 // indirect | ||
| github.com/go-logr/logr v1.4.3 // indirect | ||
| github.com/go-task/slim-sprig/v3 v3.0.0 // indirect | ||
| github.com/gogo/protobuf v1.3.2 // indirect | ||
| github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect | ||
| github.com/google/go-cmp v0.7.0 // indirect | ||
| github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 // indirect | ||
| github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect | ||
| github.com/josharian/native v1.1.0 // indirect | ||
| github.com/mdlayher/packet v1.1.2 // indirect | ||
| github.com/mdlayher/socket v0.5.1 // indirect | ||
| github.com/pierrec/lz4/v4 v4.1.21 // indirect | ||
| github.com/sirupsen/logrus v1.9.3 // indirect | ||
| github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 // indirect | ||
| go.opencensus.io v0.24.0 // indirect | ||
| go.uber.org/automaxprocs v1.6.0 // indirect | ||
| go.yaml.in/yaml/v3 v3.0.4 // indirect | ||
| golang.org/x/net v0.43.0 // indirect | ||
| golang.org/x/sync v0.16.0 // indirect | ||
| golang.org/x/text v0.28.0 // indirect | ||
| golang.org/x/tools v0.36.0 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53 // indirect | ||
| google.golang.org/grpc v1.69.0 // indirect | ||
| golang.org/x/mod v0.35.0 // indirect | ||
| golang.org/x/net v0.53.0 // indirect | ||
| golang.org/x/sync v0.20.0 // indirect | ||
| golang.org/x/text v0.36.0 // indirect | ||
| golang.org/x/tools v0.44.0 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect | ||
| google.golang.org/grpc v1.72.2 // indirect | ||
| google.golang.org/protobuf v1.36.7 // indirect | ||
| ) | ||
Large diffs are not rendered by default.
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: openshift/containernetworking-plugins
Length of output: 2857
🌐 Web query:
GHSA-p77j-4mvh-x3m3 grpc authz bypass advisory💡 Result:
GHSA-p77j-4mvh-x3m3 describes an authorization bypass in gRPC-Go caused by improper input validation of the HTTP/2 :path pseudo-header when it is missing the mandatory leading slash. What happens - If a client sends HTTP/2 :path values like "Service/Method" instead of "/Service/Method", gRPC-Go may still route the request to the correct handler. - However, path-based authorization logic (including the official RBAC in google.golang.org/grpc/authz, and/or custom interceptors that rely on info.FullMethod / grpc.Method(ctx)) may evaluate the non-canonical, raw path string. - As a result, "deny" rules that are written for canonical paths (starting with "/") may not match, allowing the request to bypass authorization when the policy has a fallback/allow behavior. Impact / who is affected - Affects gRPC-Go servers that: 1) use path-based authorization interceptors (grpc/authz RBAC or equivalents), and 2) have security policies with deny rules for canonical paths but otherwise allow other requests by default (fallback allow). - Exploitation requires the attacker to be able to send raw HTTP/2 frames with malformed :path directly to the gRPC server. Fixed in - Upgrade to gRPC-Go v1.79.3 or newer (the advisory notes this as the fixed tagged release; also references the latest master branch). Recommended mitigations (if you can’t upgrade immediately) - Use a validating outermost interceptor that rejects malformed method/path before authorization interceptors run (returning codes.Unimplemented per the advisory). - Ensure your infrastructure/proxies enforce strict HTTP/2 compliance and reject/normalize requests where :path does not start with a leading slash. - Harden authorization policy toward a default-deny posture (explicitly allow what’s needed; deny everything else). Related CVE - The issue is also listed as CVE-2026-33186 in NVD.
Citations:
🌐 Web query:
gRPC-Go latest version releases 2026💡 Result:
The latest version of gRPC-Go is v1.81.0, released on 2026-05-04. The previous version is v1.80.0, released on 2026-04-01. As of today (2026-05-04), v1.81.0 is the most recent stable release listed on the official GitHub releases page and pkg.go.dev.
Citations:
Upgrade
google.golang.org/grpcto address GHSA-p77j-4mvh-x3m3 authorization bypass.Your
go.modpinsgoogle.golang.org/grpc v1.72.2(indirect), which is affected by GHSA-p77j-4mvh-x3m3. This vulnerability allows authorization bypass in gRPC-Go servers using path-based authorization when HTTP/2 :path pseudo-headers lack the mandatory leading slash. Update to v1.81.0 (or at minimum v1.79.3 where the fix was released).✅ Proposed change
Reference: GHSA-p77j-4mvh-x3m3 / CVE-2026-33186
📝 Committable suggestion
🧰 Tools
🪛 OSV Scanner (2.3.5)
[CRITICAL] 55-55: google.golang.org/grpc 1.72.2: Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
(GO-2026-4762)
[CRITICAL] 55-55: google.golang.org/grpc 1.72.2: gRPC-Go has an authorization bypass via missing leading slash in :path
(GHSA-p77j-4mvh-x3m3)
🤖 Prompt for AI Agents