[TT-11197] Upgrade google/grpc by titpetric · Pull Request #6100 · TykTechnologies/tyk

titpetric · 2024-03-06T05:45:17Z

User description

Upgrade google/grpc go dependency

Fixes CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-32731
Verified fix version: grpc/grpc@29d8bee

Type

enhancement, bug_fix

Description

Upgraded google.golang.org/grpc to version v1.62.1 to address CVE-2023-32731.
Updated github.com/google/uuid to v1.6.0 and google.golang.org/genproto dependencies for compatibility with the new gRPC version.
Updated checksums in go.sum for the upgraded dependencies.

Changes walkthrough

Relevant files

Enhancement

go.mod `Upgrade Dependencies for Security Fixes` go.mod Upgraded `github.com/google/uuid` from `v1.4.0` to `v1.6.0`. Upgraded `google.golang.org/grpc` from `v1.61.0-dev` to `v1.62.1`. Updated `google.golang.org/genproto` dependencies to newer versions.	+4/-4
go.sum `Update Checksums for Upgraded Dependencies` go.sum Updated checksums for `github.com/google/uuid` and `google.golang.org/grpc`. Updated checksums for `google.golang.org/genproto` dependencies.	+12/-12

✨ PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

github-actions · 2024-03-06T05:45:58Z

PR Description updated to latest commit (3a30e66)

github-actions · 2024-03-06T05:46:02Z

API Changes

no api changes detected

github-actions · 2024-03-06T05:46:27Z

PR Review

⏱️ Estimated effort to review [1-5]	2, because the changes are straightforward dependency upgrades with direct impact on addressing a CVE vulnerability. The modifications are limited to version numbers in `go.mod` and checksums in `go.sum`, which simplifies the review process.
🧪 Relevant tests	No
🔍 Possible issues	No
🔒 Security concerns	No

Code feedback:

relevant file	go.mod
suggestion	Consider running tests to ensure that the upgraded `google.golang.org/grpc` version does not introduce breaking changes to existing functionality. Upgrading major dependencies can sometimes lead to unexpected issues. [important]
relevant line	google.golang.org/grpc v1.62.1

relevant file	go.mod
suggestion	Verify compatibility of the upgraded `github.com/google/uuid` version with other project dependencies. It's crucial to ensure that this version change does not conflict with the versions expected by other libraries. [important]
relevant line	github.com/google/uuid v1.6.0 // indirect

relevant file	go.sum
suggestion	After upgrading dependencies, it's a good practice to prune any unused dependencies from `go.sum` to keep the project clean and maintainable. Use `go mod tidy` to remove unnecessary entries. [medium]
relevant line	github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=

relevant file	go.sum
suggestion	Ensure that all direct and transitive dependencies are reviewed for security vulnerabilities, as new versions might introduce new vulnerabilities or might not be compatible with your project's security policies. [important]
relevant line	google.golang.org/grpc v1.62.1 h1:B4n+nfKzOICUXMgyrNd19h/I9oH0L1pizfk1d4zSgTk=

✨ Review tool usage guide:

Overview:
The review tool scans the PR code changes, and generates a PR review. The tool can be triggered automatically every time a new PR is opened, or can be invoked manually by commenting on any PR.
When commenting, to edit configurations related to the review tool (pr_reviewer section), use the following template:

/review --pr_reviewer.some_config1=... --pr_reviewer.some_config2=...

With a configuration file, use the following template:

[pr_reviewer]
some_config1=...
some_config2=...

Utilizing extra instructions The `review` tool can be configured with extra instructions, which can be used to guide the model to a feedback tailored to the needs of your project. Be specific, clear, and concise in the instructions. With extra instructions, you are the prompter. Specify the relevant sub-tool, and the relevant aspects of the PR that you want to emphasize. Examples for extra instructions: `[pr_reviewer] # /review # extra_instructions=""" In the 'possible issues' section, emphasize the following: - Does the code logic cover relevant edge cases? - Is the code logic clear and easy to understand? - Is the code logic efficient? ... """` Use triple quotes to write multi-line instructions. Use bullet points to make the instructions more readable.
How to enable\disable automation When you first install PR-Agent app, the default mode for the `review` tool is: `pr_commands = ["/review", ...]` meaning the `review` tool will run automatically on every PR, with the default configuration. Edit this field to enable/disable the tool, or to change the used configurations
Auto-labels The `review` tool can auto-generate two specific types of labels for a PR: a `possible security issue` label, that detects possible security issues (`enable_review_labels_security` flag) a `Review effort [1-5]: x` label, where x is the estimated effort to review the PR (`enable_review_labels_effort` flag)
Extra sub-tools The `review` tool provides a collection of possible feedbacks about a PR. It is recommended to review the possible options, and choose the ones relevant for your use case. Some of the feature that are disabled by default are quite useful, and should be considered for enabling. For example: `require_score_review`, `require_soc2_ticket`, and more.
Auto-approve PRs By invoking: `/review auto_approve` The tool will automatically approve the PR, and add a comment with the approval. To ensure safety, the auto-approval feature is disabled by default. To enable auto-approval, you need to actively set in a pre-defined configuration file the following: `[pr_reviewer] enable_auto_approval = true` (this specific flag cannot be set with a command line argument, only in the configuration file, committed to the repository) You can also enable auto-approval only if the PR meets certain requirements, such as that the `estimated_review_effort` is equal or below a certain threshold, by adjusting the flag: `[pr_reviewer] maximal_review_effort = 5`
More PR-Agent commands To invoke the PR-Agent, add a comment using one of the following commands: /review: Request a review of your Pull Request. /describe: Update the PR title and description based on the contents of the PR. /improve [--extended]: Suggest code improvements. Extended mode provides a higher quality feedback. /ask <QUESTION>: Ask a question about the PR. /update_changelog: Update the changelog based on the PR's contents. /add_docs 💎: Generate docstring for new components introduced in the PR. /generate_labels 💎: Generate labels for the PR based on the PR's contents. /analyze 💎: Automatically analyzes the PR, and presents changes walkthrough for each component. See the tools guide for more details. To list the possible configuration parameters, add a /config comment.

See the review usage page for a comprehensive guide on using this tool.

github-actions · 2024-03-06T05:46:28Z

PR Code Suggestions

Category	Suggestions
Best practice	Align the versions of `google.golang.org/grpc` and its examples. Consider using the same version of `google.golang.org/grpc` and its examples to ensure compatibility and avoid potential issues due to version mismatches. Currently, the version of `google.golang.org/grpc` is updated to `v1.62.1`, but the examples remain at an older commit. Aligning these versions can help in maintaining consistency and avoiding unexpected behavior. go.mod [72-73] google.golang.org/grpc v1.62.1 -google.golang.org/grpc/examples v0.0.0-20220317213542-f95b001a48df // test +google.golang.org/grpc/examples v1.62.1 // test
Best practice	Run `go mod tidy` to clean up and update the `go.sum` file. After updating dependencies, it's a good practice to ensure that all transitive dependencies are also up to date. This can be achieved by running `go mod tidy` to clean up the `go.sum` file. This command removes unnecessary entries and updates the file with the correct set of dependencies for the current set of modules. go.sum [245-246] -github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68= -github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w= +(Result of running `go mod tidy`)
Maintainability	Consider consolidating UUID libraries to avoid confusion. It's recommended to review and possibly consolidate the usage of `github.com/google/uuid` and `github.com/gofrs/uuid`. Having multiple UUID libraries in a project can lead to confusion and inconsistency in UUID generation and handling. If both libraries provide similar functionalities that your project needs, consider sticking to one for consistency. go.mod [35-38] -github.com/gofrs/uuid v4.4.0+incompatible github.com/google/uuid v1.6.0 // indirect
Maintainability	Ensure compatibility of `google.golang.org/genproto` with other dependencies. Verify the compatibility of the newly added versions of `google.golang.org/genproto` with the rest of your project dependencies, especially `google.golang.org/grpc`. Incompatibilities between these packages can lead to runtime issues. It's advisable to test thoroughly or consult the respective package's compatibility matrix if available. go.mod [213-214] -google.golang.org/genproto/googleapis/api v0.0.0-20240123012728-ef4313101c80 // indirect -google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 // indirect +(Ensure compatibility with other dependencies)
Possible issue	Review dependency updates for breaking changes. Ensure that the updated versions of dependencies do not introduce breaking changes or require code modifications. It's crucial to review the release notes or change logs of `github.com/google/uuid` and `google.golang.org/grpc` for any breaking changes or migration steps required due to the version upgrade. go.mod [38-72] -github.com/google/uuid v1.6.0 // indirect -google.golang.org/grpc v1.62.1 +(Review and apply necessary code changes based on dependency updates)

✨ Improve tool usage guide:

Overview:
The improve tool scans the PR code changes, and automatically generates suggestions for improving the PR code. The tool can be triggered automatically every time a new PR is opened, or can be invoked manually by commenting on a PR.
When commenting, to edit configurations related to the improve tool (pr_code_suggestions section), use the following template:

/improve --pr_code_suggestions.some_config1=... --pr_code_suggestions.some_config2=...

With a configuration file, use the following template:

[pr_code_suggestions]
some_config1=...
some_config2=...

Enabling\disabling automation When you first install the app, the default mode for the improve tool is: `pr_commands = ["/improve --pr_code_suggestions.summarize=true", ...]` meaning the `improve` tool will run automatically on every PR, with summarization enabled. Delete this line to disable the tool from running automatically.
Utilizing extra instructions Extra instructions are very important for the `improve` tool, since they enable to guide the model to suggestions that are more relevant to the specific needs of the project. Be specific, clear, and concise in the instructions. With extra instructions, you are the prompter. Specify relevant aspects that you want the model to focus on. Examples for extra instructions: `[pr_code_suggestions] # /improve # extra_instructions=""" Emphasize the following aspects: - Does the code logic cover relevant edge cases? - Is the code logic clear and easy to understand? - Is the code logic efficient? ... """` Use triple quotes to write multi-line instructions. Use bullet points to make the instructions more readable.
A note on code suggestions quality While the current AI for code is getting better and better (GPT-4), it's not flawless. Not all the suggestions will be perfect, and a user should not accept all of them automatically. Suggestions are not meant to be simplistic. Instead, they aim to give deep feedback and raise questions, ideas and thoughts to the user, who can then use his judgment, experience, and understanding of the code base. Recommended to use the 'extra_instructions' field to guide the model to suggestions that are more relevant to the specific needs of the project, or use the custom suggestions 💎 tool With large PRs, best quality will be obtained by using 'improve --extended' mode.
More PR-Agent commands To invoke the PR-Agent, add a comment using one of the following commands: /review: Request a review of your Pull Request. /describe: Update the PR title and description based on the contents of the PR. /improve [--extended]: Suggest code improvements. Extended mode provides a higher quality feedback. /ask <QUESTION>: Ask a question about the PR. /update_changelog: Update the changelog based on the PR's contents. /add_docs 💎: Generate docstring for new components introduced in the PR. /generate_labels 💎: Generate labels for the PR based on the PR's contents. /analyze 💎: Automatically analyzes the PR, and presents changes walkthrough for each component. See the tools guide for more details. To list the possible configuration parameters, add a /config comment.

See the improve usage page for a more comprehensive guide on using this tool.

buger · 2024-03-06T06:08:06Z

API tests result - postgres15-sha256 env: success ✅
Branch used: refs/heads/master
Commit: f62b31c TT-11197 Upgrade google/grpc (#6100)

User description

Upgrade google/grpc go dependency

Fixes CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-32731
Verified fix version:
grpc/grpc@29d8bee

Type

enhancement, bug_fix

Description

Upgraded google.golang.org/grpc to version v1.62.1 to address
CVE-2023-32731.
Updated github.com/google/uuid to v1.6.0 and
google.golang.org/genproto dependencies for compatibility with the new
gRPC version.
Updated checksums in go.sum for the upgraded dependencies.

Changes walkthrough

Relevant files

Enhancement

go.mod `Upgrade Dependencies for Security Fixes` go.mod Upgraded `github.com/google/uuid` from `v1.4.0` to `v1.6.0`. Upgraded `google.golang.org/grpc` from `v1.61.0-dev` to `v1.62.1`. Updated `google.golang.org/genproto` dependencies to newer versions.	+4/-4
go.sum `Update Checksums for Upgraded Dependencies` go.sum Updated checksums for `github.com/google/uuid` and `google.golang.org/grpc`. Updated checksums for `google.golang.org/genproto` dependencies.	+12/-12

✨ PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools
and their descriptions

Co-authored-by: Tit Petric [email protected]
Triggered by: push (@titpetric)
Execution page

buger · 2024-03-06T06:08:29Z

API tests result - mongo44-sha256 env: success ✅
Branch used: refs/heads/master
Commit: f62b31c TT-11197 Upgrade google/grpc (#6100)

User description

Upgrade google/grpc go dependency

Fixes CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-32731
Verified fix version:
grpc/grpc@29d8bee

Type

enhancement, bug_fix

Description

Upgraded google.golang.org/grpc to version v1.62.1 to address
CVE-2023-32731.
Updated github.com/google/uuid to v1.6.0 and
google.golang.org/genproto dependencies for compatibility with the new
gRPC version.
Updated checksums in go.sum for the upgraded dependencies.

Changes walkthrough

Relevant files

Enhancement

go.mod `Upgrade Dependencies for Security Fixes` go.mod Upgraded `github.com/google/uuid` from `v1.4.0` to `v1.6.0`. Upgraded `google.golang.org/grpc` from `v1.61.0-dev` to `v1.62.1`. Updated `google.golang.org/genproto` dependencies to newer versions.	+4/-4
go.sum `Update Checksums for Upgraded Dependencies` go.sum Updated checksums for `github.com/google/uuid` and `google.golang.org/grpc`. Updated checksums for `google.golang.org/genproto` dependencies.	+12/-12

✨ PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools
and their descriptions

Co-authored-by: Tit Petric [email protected]
Triggered by: push (@titpetric)
Execution page

sonarqubecloud · 2024-03-07T08:40:52Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

titpetric · 2024-03-07T08:52:56Z

/release to release-5.3

tykbot · 2024-03-07T08:53:10Z

Working on it! Note that it can take a few minutes.

## **User description** Upgrade google/grpc go dependency - Fixes CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-32731 - Verified fix version: grpc/grpc@29d8bee ___ ## **Type** enhancement, bug_fix ___ ## **Description** - Upgraded `google.golang.org/grpc` to version `v1.62.1` to address CVE-2023-32731. - Updated `github.com/google/uuid` to `v1.6.0` and `google.golang.org/genproto` dependencies for compatibility with the new gRPC version. - Updated checksums in `go.sum` for the upgraded dependencies. ___ ## **Changes walkthrough** <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Enhancement</strong></td><td><table> <tr> <td> <details> <summary><strong>go.mod</strong><dd><code>Upgrade Dependencies for Security Fixes</code>                                    </dd></summary> <hr> go.mod <li>Upgraded <code>github.com/google/uuid</code> from <code>v1.4.0</code> to <code>v1.6.0</code>.<br> <li> Upgraded <code>google.golang.org/grpc</code> from <code>v1.61.0-dev</code> to <code>v1.62.1</code>.<br> <li> Updated <code>google.golang.org/genproto</code> dependencies to newer versions. </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6100/files#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6">+4/-4</a>      </td> </tr> <tr> <td> <details> <summary><strong>go.sum</strong><dd><code>Update Checksums for Upgraded Dependencies</code>                              </dd></summary> <hr> go.sum <li>Updated checksums for <code>github.com/google/uuid</code> and <br><code>google.golang.org/grpc</code>.<br> <li> Updated checksums for <code>google.golang.org/genproto</code> dependencies. </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6100/files#diff-3295df7234525439d778f1b282d146a4f1ff6b415248aaac074e8042d9f42d63">+12/-12</a>  </td> </tr> </table></td></tr></tr></tbody></table> ___ > ✨ **PR-Agent usage**: >Comment `/help` on the PR to get a list of all available PR-Agent tools and their descriptions Co-authored-by: Tit Petric <[email protected]> (cherry picked from commit f62b31c)

[TT-11197] Upgrade google/grpc (#6100) ## **User description** Upgrade google/grpc go dependency - Fixes CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-32731 - Verified fix version: grpc/grpc@29d8bee ___ ## **Type** enhancement, bug_fix ___ ## **Description** - Upgraded `google.golang.org/grpc` to version `v1.62.1` to address CVE-2023-32731. - Updated `github.com/google/uuid` to `v1.6.0` and `google.golang.org/genproto` dependencies for compatibility with the new gRPC version. - Updated checksums in `go.sum` for the upgraded dependencies. ___ ## **Changes walkthrough** <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Enhancement</strong></td><td><table> <tr> <td> <details> <summary><strong>go.mod</strong><dd><code>Upgrade Dependencies for Security Fixes</code>                                    </dd></summary> <hr> go.mod <li>Upgraded <code>github.com/google/uuid</code> from <code>v1.4.0</code> to <code>v1.6.0</code>.<br> <li> Upgraded <code>google.golang.org/grpc</code> from <code>v1.61.0-dev</code> to <code>v1.62.1</code>.<br> <li> Updated <code>google.golang.org/genproto</code> dependencies to newer versions. </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6100/files#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6">+4/-4</a>      </td> </tr> <tr> <td> <details> <summary><strong>go.sum</strong><dd><code>Update Checksums for Upgraded Dependencies</code>                              </dd></summary> <hr> go.sum <li>Updated checksums for <code>github.com/google/uuid</code> and <br><code>google.golang.org/grpc</code>.<br> <li> Updated checksums for <code>google.golang.org/genproto</code> dependencies. </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6100/files#diff-3295df7234525439d778f1b282d146a4f1ff6b415248aaac074e8042d9f42d63">+12/-12</a>  </td> </tr> </table></td></tr></tr></tbody></table> ___ > ✨ **PR-Agent usage**: >Comment `/help` on the PR to get a list of all available PR-Agent tools and their descriptions Co-authored-by: Tit Petric <[email protected]>

tykbot · 2024-03-07T08:53:36Z

@titpetric Succesfully merged PR

buger · 2024-03-07T09:01:03Z

API tests result - mongo44-murmur64 env: success ✅
Branch used: refs/heads/master
Commit: f62b31c TT-11197 Upgrade google/grpc (#6100)

User description

Upgrade google/grpc go dependency

Fixes CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-32731
Verified fix version:
grpc/grpc@29d8bee

Type

enhancement, bug_fix

Description

Upgraded google.golang.org/grpc to version v1.62.1 to address
CVE-2023-32731.
Updated github.com/google/uuid to v1.6.0 and
google.golang.org/genproto dependencies for compatibility with the new
gRPC version.
Updated checksums in go.sum for the upgraded dependencies.

Changes walkthrough

Relevant files

Enhancement

go.mod `Upgrade Dependencies for Security Fixes` go.mod Upgraded `github.com/google/uuid` from `v1.4.0` to `v1.6.0`. Upgraded `google.golang.org/grpc` from `v1.61.0-dev` to `v1.62.1`. Updated `google.golang.org/genproto` dependencies to newer versions.	+4/-4
go.sum `Update Checksums for Upgraded Dependencies` go.sum Updated checksums for `github.com/google/uuid` and `google.golang.org/grpc`. Updated checksums for `google.golang.org/genproto` dependencies.	+12/-12

✨ PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools
and their descriptions

Co-authored-by: Tit Petric [email protected]
Triggered by: push (@titpetric)
Execution page

titpetric · 2024-03-07T09:05:43Z

/release to release-5.3.0

tykbot · 2024-03-07T09:05:57Z

Working on it! Note that it can take a few minutes.

## **User description** Upgrade google/grpc go dependency - Fixes CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-32731 - Verified fix version: grpc/grpc@29d8bee ___ ## **Type** enhancement, bug_fix ___ ## **Description** - Upgraded `google.golang.org/grpc` to version `v1.62.1` to address CVE-2023-32731. - Updated `github.com/google/uuid` to `v1.6.0` and `google.golang.org/genproto` dependencies for compatibility with the new gRPC version. - Updated checksums in `go.sum` for the upgraded dependencies. ___ ## **Changes walkthrough** <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Enhancement</strong></td><td><table> <tr> <td> <details> <summary><strong>go.mod</strong><dd><code>Upgrade Dependencies for Security Fixes</code>                                    </dd></summary> <hr> go.mod <li>Upgraded <code>github.com/google/uuid</code> from <code>v1.4.0</code> to <code>v1.6.0</code>.<br> <li> Upgraded <code>google.golang.org/grpc</code> from <code>v1.61.0-dev</code> to <code>v1.62.1</code>.<br> <li> Updated <code>google.golang.org/genproto</code> dependencies to newer versions. </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6100/files#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6">+4/-4</a>      </td> </tr> <tr> <td> <details> <summary><strong>go.sum</strong><dd><code>Update Checksums for Upgraded Dependencies</code>                              </dd></summary> <hr> go.sum <li>Updated checksums for <code>github.com/google/uuid</code> and <br><code>google.golang.org/grpc</code>.<br> <li> Updated checksums for <code>google.golang.org/genproto</code> dependencies. </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6100/files#diff-3295df7234525439d778f1b282d146a4f1ff6b415248aaac074e8042d9f42d63">+12/-12</a>  </td> </tr> </table></td></tr></tr></tbody></table> ___ > ✨ **PR-Agent usage**: >Comment `/help` on the PR to get a list of all available PR-Agent tools and their descriptions Co-authored-by: Tit Petric <[email protected]> (cherry picked from commit f62b31c)

[TT-11197] Upgrade google/grpc (#6100) ## **User description** Upgrade google/grpc go dependency - Fixes CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-32731 - Verified fix version: grpc/grpc@29d8bee ___ ## **Type** enhancement, bug_fix ___ ## **Description** - Upgraded `google.golang.org/grpc` to version `v1.62.1` to address CVE-2023-32731. - Updated `github.com/google/uuid` to `v1.6.0` and `google.golang.org/genproto` dependencies for compatibility with the new gRPC version. - Updated checksums in `go.sum` for the upgraded dependencies. ___ ## **Changes walkthrough** <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Enhancement</strong></td><td><table> <tr> <td> <details> <summary><strong>go.mod</strong><dd><code>Upgrade Dependencies for Security Fixes</code>                                    </dd></summary> <hr> go.mod <li>Upgraded <code>github.com/google/uuid</code> from <code>v1.4.0</code> to <code>v1.6.0</code>.<br> <li> Upgraded <code>google.golang.org/grpc</code> from <code>v1.61.0-dev</code> to <code>v1.62.1</code>.<br> <li> Updated <code>google.golang.org/genproto</code> dependencies to newer versions. </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6100/files#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6">+4/-4</a>      </td> </tr> <tr> <td> <details> <summary><strong>go.sum</strong><dd><code>Update Checksums for Upgraded Dependencies</code>                              </dd></summary> <hr> go.sum <li>Updated checksums for <code>github.com/google/uuid</code> and <br><code>google.golang.org/grpc</code>.<br> <li> Updated checksums for <code>google.golang.org/genproto</code> dependencies. </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/6100/files#diff-3295df7234525439d778f1b282d146a4f1ff6b415248aaac074e8042d9f42d63">+12/-12</a>  </td> </tr> </table></td></tr></tr></tbody></table> ___ > ✨ **PR-Agent usage**: >Comment `/help` on the PR to get a list of all available PR-Agent tools and their descriptions Co-authored-by: Tit Petric <[email protected]>

tykbot · 2024-03-07T09:06:22Z

@titpetric Succesfully merged PR

buger · 2024-03-07T09:14:33Z

API tests result - postgres15-murmur64 env: success ✅
Branch used: refs/heads/master
Commit: f62b31c TT-11197 Upgrade google/grpc (#6100)

User description

Upgrade google/grpc go dependency

Fixes CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-32731
Verified fix version:
grpc/grpc@29d8bee

Type

enhancement, bug_fix

Description

Upgraded google.golang.org/grpc to version v1.62.1 to address
CVE-2023-32731.
Updated github.com/google/uuid to v1.6.0 and
google.golang.org/genproto dependencies for compatibility with the new
gRPC version.
Updated checksums in go.sum for the upgraded dependencies.

Changes walkthrough

Relevant files

Enhancement

go.mod `Upgrade Dependencies for Security Fixes` go.mod Upgraded `github.com/google/uuid` from `v1.4.0` to `v1.6.0`. Upgraded `google.golang.org/grpc` from `v1.61.0-dev` to `v1.62.1`. Updated `google.golang.org/genproto` dependencies to newer versions.	+4/-4
go.sum `Update Checksums for Upgraded Dependencies` go.sum Updated checksums for `github.com/google/uuid` and `google.golang.org/grpc`. Updated checksums for `google.golang.org/genproto` dependencies.	+12/-12

✨ PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools
and their descriptions

Co-authored-by: Tit Petric [email protected]
Triggered by: push (@titpetric)
Execution page

github-actions Bot added enhancement bug_fix labels Mar 6, 2024

github-actions Bot added the Review effort [1-5]: 2 label Mar 6, 2024

titpetric requested review from andrei-tyk and jeffy-mathew March 6, 2024 05:49

andrei-tyk approved these changes Mar 6, 2024

View reviewed changes

jeffy-mathew approved these changes Mar 6, 2024

View reviewed changes

jeffy-mathew force-pushed the fix/cve-2023-32731/upgrade-grpc branch from 3a30e66 to e92c952 Compare March 6, 2024 12:48

Upgrade google/grpc

d6631ff

titpetric force-pushed the fix/cve-2023-32731/upgrade-grpc branch from e92c952 to d6631ff Compare March 7, 2024 08:28

titpetric enabled auto-merge (squash) March 7, 2024 08:28

titpetric merged commit f62b31c into master Mar 7, 2024

titpetric deleted the fix/cve-2023-32731/upgrade-grpc branch March 7, 2024 08:51

buger mentioned this pull request Mar 7, 2024

Merging to release-5.3: [TT-11197] Upgrade google/grpc (#6100) #6109

Merged

buger mentioned this pull request Mar 7, 2024

Merging to release-5.3.0: [TT-11197] Upgrade google/grpc (#6100) #6110

Merged

Uh oh!

Conversation

titpetric commented Mar 6, 2024 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Type

Description

Changes walkthrough

Uh oh!

github-actions Bot commented Mar 6, 2024

Uh oh!

github-actions Bot commented Mar 6, 2024

Uh oh!

github-actions Bot commented Mar 6, 2024

PR Review

Uh oh!

github-actions Bot commented Mar 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Code Suggestions

Uh oh!

buger commented Mar 6, 2024 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Type

Description

Changes walkthrough

Uh oh!

buger commented Mar 6, 2024 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Type

Description

Changes walkthrough

Uh oh!

sonarqubecloud Bot commented Mar 7, 2024

Quality Gate passed

Uh oh!

titpetric commented Mar 7, 2024

Uh oh!

tykbot Bot commented Mar 7, 2024

Uh oh!

tykbot Bot commented Mar 7, 2024

Uh oh!

buger commented Mar 7, 2024 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Type

Description

Changes walkthrough

Uh oh!

titpetric commented Mar 7, 2024

Uh oh!

tykbot Bot commented Mar 7, 2024

Uh oh!

tykbot Bot commented Mar 7, 2024

Uh oh!

buger commented Mar 7, 2024 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Type

Description

Changes walkthrough

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

titpetric commented Mar 6, 2024 •

edited by github-actions Bot

Loading

github-actions Bot commented Mar 6, 2024 •

edited

Loading

buger commented Mar 6, 2024 •

edited by atlassian Bot

Loading

buger commented Mar 6, 2024 •

edited by atlassian Bot

Loading

buger commented Mar 7, 2024 •

edited by atlassian Bot

Loading

buger commented Mar 7, 2024 •

edited by atlassian Bot

Loading