Bump google.golang.org/grpc from 1.66.0 to 1.79.3#386
Bump google.golang.org/grpc from 1.66.0 to 1.79.3#386dependabot[bot] wants to merge 1 commit intooadp-devfrom
Conversation
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.66.0 to 1.79.3. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.66.0...v1.79.3) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
WalkthroughUpdated Go toolchain version from 1.22.0 to 1.24.0 with corresponding dependency upgrades across direct and indirect packages including logr, go-cmp, testify, golang.org modules, grpc, protobuf, and OpenTelemetry components. Added one new indirect dependency. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
needs-ok-to-test
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
go.mod (1)
8-10: Dependency blast radius is much larger than the stated PR goal; consider narrowing this PR to grpc-related changes only.This update now changes toolchain + many unrelated modules, which increases rollback/debug complexity and risk for dependency regressions.
A safer path is to keep this PR scoped to
google.golang.org/grpc(and only strictly required transitive updates), then follow with a separate toolchain/dependency refresh PR.
As per coding guidelines, "**: Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity."Also applies to: 15-15, 129-135, 138-139, 155-155, 169-169, 200-205, 209-210
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@go.mod` around lines 8 - 10, The PR broadens the dependency/toolchain changes in go.mod beyond the stated grpc goal; revert unrelated module bumps (e.g., github.com/go-logr/logr, github.com/google/go-cmp, github.com/hashicorp/go-hclog and any other non-grpc entries changed) so go.mod only updates google.golang.org/grpc and the minimal transitive modules strictly required by that grpc change, and remove any toolchain/Go version changes from this PR; prepare a separate follow-up PR to perform a general dependency/toolchain refresh covering the other modules referenced in the comment ranges.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@go.mod`:
- Around line 8-10: The PR broadens the dependency/toolchain changes in go.mod
beyond the stated grpc goal; revert unrelated module bumps (e.g.,
github.com/go-logr/logr, github.com/google/go-cmp, github.com/hashicorp/go-hclog
and any other non-grpc entries changed) so go.mod only updates
google.golang.org/grpc and the minimal transitive modules strictly required by
that grpc change, and remove any toolchain/Go version changes from this PR;
prepare a separate follow-up PR to perform a general dependency/toolchain
refresh covering the other modules referenced in the comment ranges.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 66faddfe-ac2f-494d-82fe-d79d3846cad5
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
weshayutin
added
ok-to-test
|
@dependabot[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Bumps google.golang.org/grpc from 1.66.0 to 1.79.3.
Release notes
Sourced from google.golang.org/grpc's releases.
... (truncated)
Commits
dda86dbChange version to 1.79.3 (#8983)72186f1grpc: enforce strict path checking for incoming requests on the server (#8981)97ca352Changing version to 1.79.3-dev (#8954)8902ab6Change the version to release 1.79.2 (#8947)a928670Cherry-pick #8874 to v1.79.x (#8904)06df363Change version to 1.79.2-dev (#8903)782f2deChange version to 1.79.1 (#8902)850eccbChange version to 1.79.1-dev (#8851)765ff05Change version to 1.79.0 (#8850)68804beCherry pick #8864 to v1.79.x (#8896)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.