fix(deps): update gRPC security release across Go modules - #9825
fix(deps): update gRPC security release across Go modules#9825Victor Vazquez (vhvb1989) wants to merge 3 commits into
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 25a17f9b-287c-4396-b7c9-8e15432773a4
|
Azure Pipelines: Successfully started running 16 pipeline(s). 6 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
There was a problem hiding this comment.
🟢 Approval recommended
All 15 modules consistently select the verified security release and include matching dependency checksums.
Pull request overview
Updates gRPC across azd core and all 14 first-party Go extensions to address GHSA-vp52-pcj8-j9qc.
Changes:
- Upgrades gRPC to 1.83.1.
- Aligns OpenTelemetry 1.44.0 and Google genproto dependencies.
- Regenerates checksums across all affected modules.
File summaries
| File | Description |
|---|---|
cli/azd/go.mod |
Updates core dependencies. |
cli/azd/go.sum |
Updates core checksums. |
cli/azd/extensions/microsoft.azd.concurx/go.mod |
Aligns extension dependencies. |
cli/azd/extensions/microsoft.azd.concurx/go.sum |
Updates extension checksums. |
cli/azd/extensions/azure.coding-agent/go.mod |
Aligns extension dependencies. |
cli/azd/extensions/azure.coding-agent/go.sum |
Updates extension checksums. |
cli/azd/extensions/azure.appservice/go.mod |
Aligns extension dependencies. |
cli/azd/extensions/azure.appservice/go.sum |
Updates extension checksums. |
cli/azd/extensions/azure.ai.training/go.mod |
Aligns extension dependencies. |
cli/azd/extensions/azure.ai.training/go.sum |
Updates extension checksums. |
cli/azd/extensions/azure.ai.toolboxes/go.mod |
Aligns extension dependencies. |
cli/azd/extensions/azure.ai.toolboxes/go.sum |
Updates extension checksums. |
cli/azd/extensions/azure.ai.skills/go.mod |
Promotes and updates gRPC. |
cli/azd/extensions/azure.ai.skills/go.sum |
Updates extension checksums. |
cli/azd/extensions/azure.ai.routines/go.mod |
Aligns extension dependencies. |
cli/azd/extensions/azure.ai.routines/go.sum |
Updates extension checksums. |
cli/azd/extensions/azure.ai.rle/go.mod |
Aligns extension dependencies. |
cli/azd/extensions/azure.ai.rle/go.sum |
Updates extension checksums. |
cli/azd/extensions/azure.ai.projects/go.mod |
Aligns extension dependencies. |
cli/azd/extensions/azure.ai.projects/go.sum |
Updates extension checksums. |
cli/azd/extensions/azure.ai.models/go.mod |
Aligns extension dependencies. |
cli/azd/extensions/azure.ai.models/go.sum |
Updates extension checksums. |
cli/azd/extensions/azure.ai.inspector/go.mod |
Promotes and updates gRPC. |
cli/azd/extensions/azure.ai.inspector/go.sum |
Updates extension checksums. |
cli/azd/extensions/azure.ai.finetune/go.mod |
Aligns extension dependencies. |
cli/azd/extensions/azure.ai.finetune/go.sum |
Updates extension checksums. |
cli/azd/extensions/azure.ai.connections/go.mod |
Aligns extension dependencies. |
cli/azd/extensions/azure.ai.connections/go.sum |
Updates extension checksums. |
cli/azd/extensions/azure.ai.agents/go.mod |
Aligns extension dependencies. |
cli/azd/extensions/azure.ai.agents/go.sum |
Updates extension checksums. |
Review details
- Files reviewed: 15/30 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 25a17f9b-287c-4396-b7c9-8e15432773a4
There was a problem hiding this comment.
🟡 Changes recommended
The Go extension scaffold still generates projects pinned to vulnerable gRPC 1.82.1.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 22/37 changed files
- Comments generated: 1
- Review effort level: Balanced
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 25a17f9b-287c-4396-b7c9-8e15432773a4
There was a problem hiding this comment.
🟢 Approval recommended
The security update and associated dependency graph are consistently applied across core, all affected extensions, and the scaffold.
Review details
- Files reviewed: 23/39 changed files
- Comments generated: 0 new
- Review effort level: Balanced
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
Summary
google.golang.org/grpcfrom 1.82.1 to 1.83.1 in azd core and all 14 affected first-party Go extension modulesThis consolidates the repository-wide fix for GHSA-vp52-pcj8-j9qc. A single PR is both possible and preferred because
cli/azd/go.modis the source of truth for shared direct dependencies.Supersedes #9819, #9820, and #9821.
Validation
mage checkDependencyVersionspassesFixes #9826