Commit 0695424
authored
fix(deps): update module google.golang.org/grpc [security] (main) (#11031)
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [google.golang.org/grpc](https://togithub.com/grpc/grpc-go) | require
| minor | `v1.53.0` -> `v1.56.3` |
| [google.golang.org/grpc](https://togithub.com/grpc/grpc-go) | require
| patch | `v1.58.2` -> `v1.58.3` |
### GitHub Vulnerability Alerts
####
[GHSA-m425-mq94-257g](https://togithub.com/grpc/grpc-go/security/advisories/GHSA-m425-mq94-257g)
### Impact
In affected releases of gRPC-Go, it is possible for an attacker to send
HTTP/2 requests, cancel them, and send subsequent requests, which is
valid by the HTTP/2 protocol, but would cause the gRPC-Go server to
launch more concurrent method handlers than the configured maximum
stream limit.
### Patches
This vulnerability was addressed by #​6703 and has been included
in patch releases: 1.56.3, 1.57.1, 1.58.3. It is also included in the
latest release, 1.59.0.
Along with applying the patch, users should also ensure they are using
the `grpc.MaxConcurrentStreams` server option to apply a limit to the
server's resources used for any single connection.
### Workarounds
None.
### References
#​6703
---
### Release Notes
<details>
<summary>grpc/grpc-go (google.golang.org/grpc)</summary>
### [`v1.56.3`](https://togithub.com/grpc/grpc-go/releases/tag/v1.56.3):
Release 1.56.3
[Compare
Source](https://togithub.com/grpc/grpc-go/compare/v1.56.2...v1.56.3)
### Security
- server: prohibit more than MaxConcurrentStreams handlers from running
at once (CVE-2023-44487)
In addition to this change, applications should ensure they do not leave
running tasks behind related to the RPC before returning from method
handlers, or should enforce appropriate limits on any such work.
### [`v1.56.2`](https://togithub.com/grpc/grpc-go/releases/tag/v1.56.2):
Release 1.56.2
[Compare
Source](https://togithub.com/grpc/grpc-go/compare/v1.56.1...v1.56.2)
- status: To fix a panic, `status.FromError` now returns an error with
`codes.Unknown` when the error implements the `GRPCStatus()` method, and
calling `GRPCStatus()` returns `nil`.
([#​6374](https://togithub.com/grpc/grpc-go/issues/6374))
### [`v1.56.1`](https://togithub.com/grpc/grpc-go/releases/tag/v1.56.1):
Release 1.56.1
[Compare
Source](https://togithub.com/grpc/grpc-go/compare/v1.56.0...v1.56.1)
- client: handle empty address lists correctly in addrConn.updateAddrs
### [`v1.56.0`](https://togithub.com/grpc/grpc-go/releases/tag/v1.56.0):
Release 1.56.0
[Compare
Source](https://togithub.com/grpc/grpc-go/compare/v1.55.1...v1.56.0)
### New Features
- client: support channel idleness using `WithIdleTimeout` dial option
([#​6263](https://togithub.com/grpc/grpc-go/issues/6263))
- This feature is currently disabled by default, but will be enabled
with a 30 minute default in the future.
- client: when using pickfirst, keep channel state in TRANSIENT_FAILURE
until it becomes READY ([gRFC
A62](https://togithub.com/grpc/proposal/blob/master/A62-pick-first.md))
([#​6306](https://togithub.com/grpc/grpc-go/issues/6306))
- xds: Add support for Custom LB Policies ([gRFC
A52](https://togithub.com/grpc/proposal/blob/master/A52-xds-custom-lb-policies.md))
([#​6224](https://togithub.com/grpc/grpc-go/issues/6224))
- xds: support pick_first Custom LB policy ([gRFC
A62](https://togithub.com/grpc/proposal/blob/master/A62-pick-first.md))
([#​6314](https://togithub.com/grpc/grpc-go/issues/6314))
([#​6317](https://togithub.com/grpc/grpc-go/issues/6317))
- client: add support for pickfirst address shuffling ([gRFC
A62](https://togithub.com/grpc/proposal/blob/master/A62-pick-first.md))
([#​6311](https://togithub.com/grpc/grpc-go/issues/6311))
- xds: Add support for String Matcher Header Matcher in RDS
([#​6313](https://togithub.com/grpc/grpc-go/issues/6313))
- xds/outlierdetection: Add Channelz Logger to Outlier Detection LB
([#​6145](https://togithub.com/grpc/grpc-go/issues/6145))
- Special Thanks:
[@​s-matyukevich](https://togithub.com/s-matyukevich)
- xds: enable RLS in xDS by default
([#​6343](https://togithub.com/grpc/grpc-go/issues/6343))
- orca: add support for application_utilization field and missing range
checks on several metrics setters
- balancer/weightedroundrobin: add new LB policy for balancing between
backends based on their load reports ([gRFC
A58](https://togithub.com/grpc/proposal/blob/master/A58-client-side-weighted-round-robin-lb-policy.md))
([#​6241](https://togithub.com/grpc/grpc-go/issues/6241))
- authz: add conversion of json to RBAC Audit Logging config
([#​6192](https://togithub.com/grpc/grpc-go/issues/6192))
- authz: add support for stdout logger
([#​6230](https://togithub.com/grpc/grpc-go/issues/6230) and
[#​6298](https://togithub.com/grpc/grpc-go/issues/6298))
- authz: support customizable audit functionality for authorization
policy ([#​6192](https://togithub.com/grpc/grpc-go/issues/6192)
[#​6230](https://togithub.com/grpc/grpc-go/issues/6230) [#​6298](https://togithub.com/grpc/grpc-go/issues/6298)
[#​6158](https://togithub.com/grpc/grpc-go/issues/6158)
[#​6304](https://togithub.com/grpc/grpc-go/issues/6304) and
[#​6225](https://togithub.com/grpc/grpc-go/issues/6225))
### Bug Fixes
- orca: fix a race at startup of out-of-band metric subscriptions that
would cause the report interval to request 0
([#​6245](https://togithub.com/grpc/grpc-go/issues/6245))
- xds/xdsresource: Fix Outlier Detection Config Handling and correctly
set xDS Defaults
([#​6361](https://togithub.com/grpc/grpc-go/issues/6361))
- xds/outlierdetection: Fix Outlier Detection Config Handling by setting
defaults in ParseConfig()
([#​6361](https://togithub.com/grpc/grpc-go/issues/6361))
### API Changes
- orca: allow a ServerMetricsProvider to be passed to the ORCA service
and ServerOption
([#​6223](https://togithub.com/grpc/grpc-go/issues/6223))
### [`v1.55.1`](https://togithub.com/grpc/grpc-go/releases/tag/v1.55.1):
Release 1.55.1
[Compare
Source](https://togithub.com/grpc/grpc-go/compare/v1.55.0...v1.55.1)
- status: To fix a panic, `status.FromError` now returns an error with
`codes.Unknown` when the error implements the `GRPCStatus()` method, and
calling `GRPCStatus()` returns `nil`.
([#​6374](https://togithub.com/grpc/grpc-go/issues/6374))
### [`v1.55.0`](https://togithub.com/grpc/grpc-go/releases/tag/v1.55.0):
Release 1.55.0
[Compare
Source](https://togithub.com/grpc/grpc-go/compare/v1.54.1...v1.55.0)
### Behavior Changes
- xds: enable federation support by default
([#​6151](https://togithub.com/grpc/grpc-go/issues/6151))
- status: `status.Code` and `status.FromError` handle wrapped errors
([#​6031](https://togithub.com/grpc/grpc-go/issues/6031) and
[#​6150](https://togithub.com/grpc/grpc-go/issues/6150))
- Special Thanks: [@​psyhatter](https://togithub.com/psyhatter)
### New Features
- xds/xdsclient: support `ignore_resource_deletion` server feature as
per gRFC
[A53](https://togithub.com/grpc/proposal/blob/master/A53-xds-ignore-resource-deletion.md)
([#​6035](https://togithub.com/grpc/grpc-go/issues/6035))
- security/advancedtls: add min/max TLS version selection options
([#​6007](https://togithub.com/grpc/grpc-go/issues/6007))
- Special Thanks: [@​joeljeske](https://togithub.com/joeljeske)
### Bug Fixes
- xds: stop routing RPCs to deleted clusters
([#​6125](https://togithub.com/grpc/grpc-go/issues/6125))
- client: fix race between stream creation and GOAWAY receipt, which
could lead to spurious UNAVAILABLE stream errors
([#​6142](https://togithub.com/grpc/grpc-go/issues/6142))
### Performance Improvements
- server: improve stream handler goroutine worker allocation when
[`NumStreamWorkers`](https://pkg.go.dev/google.golang.org/grpc#NumStreamWorkers)
is used ([#​6004](https://togithub.com/grpc/grpc-go/issues/6004))
- Special Thanks:
[@​SaveTheRbtz](https://togithub.com/SaveTheRbtz)
### [`v1.54.1`](https://togithub.com/grpc/grpc-go/releases/tag/v1.54.1):
Release 1.54.1
[Compare
Source](https://togithub.com/grpc/grpc-go/compare/v1.54.0...v1.54.1)
### Bug Fixes
- credentials/alts: revert a change that causes a crash in the
handshaker
### [`v1.54.0`](https://togithub.com/grpc/grpc-go/releases/tag/v1.54.0):
Release 1.54.0
[Compare
Source](https://togithub.com/grpc/grpc-go/compare/v1.53.0...v1.54.0)
### Behavior Changes
- xds: remove support for xDS v2 transport API
([#​6013](https://togithub.com/grpc/grpc-go/issues/6013))
### New Features
- server: expose `SetSendCompressor` API to set send compressor name
([#​5744](https://togithub.com/grpc/grpc-go/issues/5744))
- Special Thanks: [@​jronak](https://togithub.com/jronak)
- xdsclient: include `Node` proto only in the first discovery request
message, to improve performance
([#​6078](https://togithub.com/grpc/grpc-go/issues/6078))
### Bug Fixes
- metadata: fix validation logic and properly validate metadata appended
via `AppendToOutgoingContext`
([#​6001](https://togithub.com/grpc/grpc-go/issues/6001))
- Special Thanks: [@​ktalg](https://togithub.com/ktalg)
- transport: do not close connections when we encounter I/O errors until
after all data is consumed
([#​6110](https://togithub.com/grpc/grpc-go/issues/6110))
- ringhash: ensure addresses are consistently hashed across updates
([#​6066](https://togithub.com/grpc/grpc-go/issues/6066))
- xds/clusterimpl: fix a bug causing unnecessary closing and re-opening
of LRS streams
([#​6112](https://togithub.com/grpc/grpc-go/issues/6112))
- xds: NACK route configuration if sum of weights of weighted clusters
exceeds uint32\_max
([#​6085](https://togithub.com/grpc/grpc-go/issues/6085))
### Documentation
- resolver: update `Resolver.Scheme()` docstring to mention requirement
of lowercase scheme names
([#​6014](https://togithub.com/grpc/grpc-go/issues/6014))
- resolver: document expected error handling of `UpdateState` errors
([#​6002](https://togithub.com/grpc/grpc-go/issues/6002))
- Special Thanks: [@​fho](https://togithub.com/fho)
- examples: add example for ORCA load reporting
([#​6114](https://togithub.com/grpc/grpc-go/issues/6114))
- examples: add an example to illustrate authorization (authz) support
([#​5920](https://togithub.com/grpc/grpc-go/issues/5920))
- Special Thanks: [@​KenxinKun](https://togithub.com/KenxinKun)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/grafana/loki).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zMS41IiwidXBkYXRlZEluVmVyIjoiMzcuMzEuNSIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>%5D(https%3A%2F%2Frenovatebot.com&__src=https%3A%2F%2Fgithub.com%2Fgrafana%2Floki%2Fcommit%2F0695424f7dd62435df3a9981276b40f3c5ef5641&__type=xmlhttprequest){kind=link}
1 parent 7fa2f6e commit 0695424
8 files changed
Lines changed: 67 additions & 49 deletions
File tree
- pkg/push
- vendor
- google.golang.org/grpc
- internal/transport
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
104 | 104 | | |
105 | 105 | | |
106 | 106 | | |
107 | | - | |
| 107 | + | |
108 | 108 | | |
109 | 109 | | |
110 | 110 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2518 | 2518 | | |
2519 | 2519 | | |
2520 | 2520 | | |
2521 | | - | |
2522 | | - | |
| 2521 | + | |
| 2522 | + | |
2523 | 2523 | | |
2524 | 2524 | | |
2525 | 2525 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
6 | 6 | | |
7 | 7 | | |
8 | 8 | | |
9 | | - | |
| 9 | + | |
10 | 10 | | |
11 | 11 | | |
12 | 12 | | |
| |||
17 | 17 | | |
18 | 18 | | |
19 | 19 | | |
20 | | - | |
21 | | - | |
| 20 | + | |
| 21 | + | |
22 | 22 | | |
23 | 23 | | |
24 | 24 | | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
39 | 39 | | |
40 | 40 | | |
41 | 41 | | |
42 | | - | |
43 | | - | |
44 | 42 | | |
45 | 43 | | |
46 | 44 | | |
| |||
49 | 47 | | |
50 | 48 | | |
51 | 49 | | |
52 | | - | |
53 | | - | |
54 | 50 | | |
55 | 51 | | |
56 | 52 | | |
57 | 53 | | |
58 | | - | |
59 | | - | |
60 | 54 | | |
61 | 55 | | |
62 | 56 | | |
| |||
67 | 61 | | |
68 | 62 | | |
69 | 63 | | |
70 | | - | |
71 | | - | |
72 | | - | |
73 | | - | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
74 | 68 | | |
75 | 69 | | |
76 | | - | |
77 | | - | |
| 70 | + | |
| 71 | + | |
78 | 72 | | |
79 | 73 | | |
80 | 74 | | |
| |||
Lines changed: 3 additions & 8 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1747 | 1747 | | |
1748 | 1748 | | |
1749 | 1749 | | |
1750 | | - | |
| 1750 | + | |
1751 | 1751 | | |
1752 | 1752 | | |
1753 | 1753 | | |
| |||
0 commit comments