Skip to content

[fix][sec] Upgrade grpc in pulsar-function-go to 1.82.1 to fix GHSA-hrxh-6v49-42gf - #26235

Merged
nodece merged 1 commit into
apache:masterfrom
lhotari:lh-fix-fn-go-grpc-vuln
Jul 24, 2026
Merged

[fix][sec] Upgrade grpc in pulsar-function-go to 1.82.1 to fix GHSA-hrxh-6v49-42gf#26235
nodece merged 1 commit into
apache:masterfrom
lhotari:lh-fix-fn-go-grpc-vuln

Conversation

@lhotari

@lhotari lhotari commented Jul 23, 2026

Copy link
Copy Markdown
Member

Motivation

The Go Functions runtime module pulsar-function-go depends on google.golang.org/grpc v1.79.3, which is affected by GHSA-hrxh-6v49-42gf ("gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", high severity). All gRPC-Go versions below 1.82.1 are affected.

The pulsar-function-go/examples module was already updated to gRPC 1.82.1 by Dependabot in #26231; this PR applies the same upgrade to the main pulsar-function-go module.

Modifications

  • Upgrade google.golang.org/grpc from v1.79.3 to v1.82.1 (the first patched version for GHSA-hrxh-6v49-42gf) in pulsar-function-go/go.mod
  • Transitive updates pulled in by the upgrade: google.golang.org/protobuf v1.36.10 → v1.36.11, golang.org/x/oauth2 v0.34.0 → v0.36.0, and a newer google.golang.org/genproto/googleapis/rpc snapshot
  • Update go.sum accordingly

Verifying this change

  • Make sure that the change passes the CI checks.

This change is already covered by existing tests: the pulsar-function-go tests run in CI. Verified locally with go build ./..., go mod verify, and go mod tidy -diff (no drift).

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

  • Dependencies (add or upgrade a dependency)
  • The public API
  • The schema
  • The default values of configurations
  • The threading model
  • The binary protocol
  • The REST endpoints
  • The admin CLI options
  • The metrics
  • Anything that affects deployment

@nodece
nodece merged commit 8aab815 into apache:master Jul 24, 2026
45 checks passed
@lhotari lhotari added this to the 5.0.0-M2 milestone Jul 27, 2026
lhotari added a commit that referenced this pull request Aug 4, 2026
lhotari added a commit that referenced this pull request Aug 4, 2026
nodece pushed a commit to ascentstream/pulsar that referenced this pull request Aug 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants