Repository navigation
chore(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 - #91
Merged
ImMohammad20000 merged 2 commits intoSep 24, 2026
Merged
ImMohammad20000 merged 2 commits into
ImMohammad20000 merged 2 commits into
Conversation
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.2 to 1.84.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.83.2...v1.84.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
@dependabot rebase |
Contributor
Author
|
Looks like this PR is already up-to-date with dev! If you'd still like to recreate it from scratch, overwriting any edits, you can request |
dependabot
Bot
deleted the
dependabot/go_modules/dev/google.golang.org/grpc-1.84.0
branch
September 24, 2026 10:13
Free-Guy-IR
added a commit
to Free-Guy-IR/node
that referenced
this pull request
Oct 9, 2026
The release lead holds upstream 52d5aab (grpc 1.84.0, PasarGuard#91) out of 0.6.21, so the node stays on grpc 1.83.2. The Go vulnerability database still lists released v1.84.0 as affected by GO-2026-6443 (golang/vulndb #6511, #6580), although the fix is verified in v1.84.0 http2_server.go, so the bump would make govulncheck fail. It is waived as pending until the database entry is corrected. docs/upstream-parity.md said 0.6.21 would port it; that row now records the hold. So that pending waivers cannot be forgotten, scripts/upstream_drift.sh now ends every run with a PENDING WAIVERS (N) block. The block lists each waived item whose category is pending, across node, xray, sing-box, sing-quic and mtg, with its component, id and reason. Pending items stay waived; the exit code rules are unchanged. The state section names the node heads checked on 2026-09-24. Upstream dev moved past be2c445 to 4a9d0cf, which adds PasarGuard#90 (configurable WireGuard server interface MTU). That commit is new, not assessed, and flagged by the check. In the run with this change, the block lists 52 pending items, and 3 items remain UNPORTED: be2c445 and 4a9d0cf on node, and the new sing-box release v1.14.2 (af6e64c3b69e).
Free-Guy-IR
added a commit
to Free-Guy-IR/node
that referenced
this pull request
Oct 30, 2026
Each reason was re-checked on 2026-10-25 before its date moved: - The xray pin is still d2758a0 (v26.3.27), so the items taken with the pin move keep that condition. patches/xray-router-race.patch is still carried for 598bde7, and e03754d still needs Xray's UserManager. - drift6 still pins sing-box v1.13.14 (4a87f50) while the fork's main carries v1.13.21, so the node 0.6.22 items stay pending. The node code still generates no rule_set. - The sing-box 1.14 line stays planned after node 0.6.22. These move to 2026-11-20. Five reasons rely on a production check from 2026-09-25 that core 1's change on 2026-10-21 may have outdated: three say no prod core has an xhttp client outbound, and two say prod runs only Hysteria2 on sing-box. They move only to 2026-10-31, until that check is re-run. 52d5aab (PasarGuard#91, grpc 1.84.0) is not renewed: GO-2026-6443 no longer lists the released v1.84.0 (entry modified 2026-10-06), and v0.5.5 contains the commit, so its condition is met.
Free-Guy-IR
added a commit
to Free-Guy-IR/node
that referenced
this pull request
Nov 2, 2026
Port of upstream PasarGuard#91, matching upstream release v0.5.5 (47857d4), which pins the same grpc 1.84.0, genproto/googleapis/rpc 20260706201446-f0a921348800 and protobuf 1.36.12. go.mod and go.sum match upstream's hunks exactly. Tidy drops the otel, logr and xxhash sums. Tidied with Go 1.26.10. Every new go.sum line matches sum.golang.org. Upstream's other two hunks do not apply. Its controller.go hunk gofmts `now:=` in the free function keepAliveStale(lastRequest, keepAlive). This fork's watchdog port (40248f2) has the method (c *Controller) keepAliveStale, which is already gofmt-clean. Its controller_test.go hunk fixes the call shape in TestKeepAliveStaleIncludesGrace, a test this fork never took; the grace is covered by TestKeepAliveWatchdogAllowsAGraceBeyondKeepAlive in watchdog_test.go. What changes on the node's gRPC server: unary RPCs now go through the streaming pipeline. The cardinality tests in the previous commit pin that change. Unchanged between the two versions: keepalive, the tap handle, TLS credentials, flow control and window sizes, and the message-size limits, which the unary path now enforces through serverStream RecvMsg/SendMsg with the same values. This port was held on 2026-09-24 because govulncheck flagged GO-2026-6443 against released 1.84.0, which was a false positive in the vulnerability database. The database entry changed on 2026-10-06: the 1.84.0-dev range now ends at a pseudo-version, so 1.84.0 is no longer listed. RED: on grpc 1.83.2, two of the five cardinality tests fail. A second request message is answered OK, and the answer comes before the caller half-closes. GREEN: controller/rpc/preauth passes with -race -count=3. go build ./..., GOOS=linux go vet ./... and go mod verify pass. govulncheck v1.8.0 (linux/amd64, database of 2026-10-21) reports only GO-2026-6651, which is in the xray-core module and handled separately, and no GO-2026-6443. Upstream: 52d5aab
Free-Guy-IR
added a commit
to Free-Guy-IR/node
that referenced
this pull request
Nov 2, 2026
The drift check reports 52d5aab (PasarGuard#91, grpc 1.84.0), 1ae411b (PasarGuard#104, x/sys 0.49.0), f58fce8 (PasarGuard#106, chi 5.4.0) and 5cbcb5f (PasarGuard#108, chi 5.5.0) as PORTED through their Upstream: lines, with "the waiver for this commit is no longer needed". Those four pending waivers are removed. The parity table records the four ports, and the node section of the parity doc no longer says that grpc 1.84.0 is held. The parity doc gets the Go 1.26.10 sentence (GO-2026-6809) and F-SEC1026-V1. The constitution moves from 1.1.2 to 1.1.3 (PATCH: the Release Constraints toolchain value only), with approval pending. The gate-container image and the gate checker's Go in specs/002 and specs/003 name 1.26.10. These are prose and data changes only. This is the drift commit of the pre-linear sec1026 merge line, re-applied linearly. The bundle no longer arrives through merge commits, so that commit's two allowed-merge lines, for merges that do not exist on this line, are left out.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps google.golang.org/grpc from 1.83.2 to 1.84.0.
Release notes
Sourced from google.golang.org/grpc's releases.
Commits
e84aa5aChange version to 1.84.0 (#9324)c5ae88dCherrypick #9204 and #9321 to v1.84.x (#9407)a592f6aCherrypick #9351 and #9404 to v1.84.x (#9408)d5a4111cherry-pick #9365 to v1.84.x (#9370)89d55e0cherry-pick #9346 to v1.84.x (#9372)8a9f866Cherry-pick #9332 to v1.84.x (#9338)f8b54e7Cherry-pick #9331 to v1.84.x (#9334)30ce1d5xds: support injecting bootstrap and server config into HTTP filter config pa...54c743eextproc : wait for async RPC to complete in test (#9311)538bb2fendpointsharding: decouple locking, and simplify ChildState API (#9290)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)