Skip to content

Update direct dependencies including grpc CVE fix#354

Open
jfberry wants to merge 1 commit intomainfrom
deps/update-dependencies
Open

Update direct dependencies including grpc CVE fix#354
jfberry wants to merge 1 commit intomainfrom
deps/update-dependencies

Conversation

@jfberry
Copy link
Copy Markdown
Collaborator

@jfberry jfberry commented Apr 1, 2026

Summary

  • google.golang.org/grpc v1.79.2 → v1.80.0 — fixes critical CVE (authorization bypass via missing leading slash in :path). Resolves Dependabot alert add docker image #25.
  • github.com/getsentry/sentry-go v0.43.0 → v0.44.1
  • github.com/goccy/go-json v0.10.5 → v0.10.6
  • github.com/golang/geo updated to latest
  • github.com/grafana/pyroscope-go v1.2.7 → v1.2.8
  • github.com/knadh/koanf/v2 v2.3.3 → v2.3.4
  • github.com/paulmach/orb v0.12.0 → v0.13.0

Test plan

  • go build ./... passes
  • go test ./... passes
  • Deploy to staging and verify normal operation

🤖 Generated with Claude Code

- google.golang.org/grpc v1.79.2 → v1.80.0 (fixes CVE: authorization bypass via missing leading slash)
- github.com/getsentry/sentry-go v0.43.0 → v0.44.1
- github.com/goccy/go-json v0.10.5 → v0.10.6
- github.com/golang/geo to latest
- github.com/grafana/pyroscope-go v1.2.7 → v1.2.8
- github.com/knadh/koanf/v2 v2.3.3 → v2.3.4
- github.com/paulmach/orb v0.12.0 → v0.13.0

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant