Skip to content

chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 - #14247

Merged
williammartin merged 1 commit into
trunkfrom
dependabot/go_modules/google.golang.org/grpc-1.83.1
Aug 27, 2026
Merged

chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1#14247
williammartin merged 1 commit into
trunkfrom
dependabot/go_modules/google.golang.org/grpc-1.83.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps google.golang.org/grpc from 1.83.0 to 1.83.1.

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.1

Security

  • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
  • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
  • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
  • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
  • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)

Performance

  • transport: Restrict memory overhead of buffering small data frames. (#9331)
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1
01fd267 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.0 to 1.83.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.83.0...v1.83.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Aug 24, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 24, 2026 14:03
@dependabot
dependabot Bot requested a review from BagToad August 24, 2026 14:03
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Aug 24, 2026
@cli-triage

cli-triage Bot commented Aug 24, 2026

Copy link
Copy Markdown

Recommendation: Merge, Confidence: High

google.golang.org/grpc is a direct dependency (no // indirect on its go.mod line), and the module and its subpackages (google.golang.org/grpc, internal/*, credentials, resolver, etc.) are compiled into the shipped binary per the production package list. This is a patch release whose changes are entirely in xds/rbac header-matching logic and transport buffering, neither of which appears among the packages this repo pulls in, so the fixed vulnerabilities and performance tweak have no bearing on gh. The diff is a clean two-line version bump in go.mod/go.sum with no other files touched.

Assessed at head commit 01fd2670a26945f7707fe96fc1a544da68b8b591.

Generated by Dependabot PR Triage (skills-driven) · auto · 69.8 AIC · ⌖ 1.42 AIC · ⊞ 8.7K · ◷

@williammartin
williammartin merged commit 09bf3ff into trunk Aug 27, 2026
47 of 48 checks passed
@williammartin
williammartin deleted the dependabot/go_modules/google.golang.org/grpc-1.83.1 branch August 27, 2026 08:16
@BrewTestBot BrewTestBot mentioned this pull request Sep 1, 2026
Merged
@scottames-github-bot scottames-github-bot Bot mentioned this pull request Sep 6, 2026
Merged
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@williammartin williammartin williammartin approved these changes
@BagToad BagToad Awaiting requested review from BagToad BagToad is a code owner automatically assigned from cli/code-reviewers

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@williammartin