Take grpc to 1.83.2 across the nine modules that carry it

GHSA-2v4p-qf9q-27wj is a panic in gRPC-Go's xDS routing interceptor: a request arriving with neither `:authority` nor `Host` indexes an empty slice, the per-RPC goroutine does not recover, and the process dies. High, and nine alerts, because nine go.mod files pin the same version -- eight directly, terraform indirectly. Nothing here was reachable. The interceptor is installed by `xds.NewGRPCServer`, which this repo never calls: the one production server is `grpc.NewServer(grpc.Creds(...))` in ingest/internal/grpcserver and the only other is a plain one in a searchclient test. That is also why security-scan has been green throughout -- govulncheck reports on reachability and found nothing on 1.83.1, while Dependabot reports on version ranges and found nine. Both were right. Taken anyway: it is a patch release, and the next advisory in this dependency may well land somewhere we do reach. `go mod tidy` carried the indirect requirements grpc 1.83.2 asks for -- x/net, x/text, x/sys and friends. No CI job builds or tests Go here, so all nine modules were built locally and api, ingest and enterprise tested with -count=1, since a cached pass would not have exercised the new version. The dependabot.yml is the other half. There was no config, so nothing opened a PR against any of this. Go majors stay out of the group, being import path changes rather than bumps.
2026-09-10 09:01:27 -07:00
parent 6a17fa1562
commit b7f99b49f2
19 changed files with 172 additions and 105 deletions
@@ -0,0 +1,67 @@
+version: 2
+updates:
+  # Fifteen Go modules, each with its own go.mod and no workspace tying them
+  # together, so a single entry cannot reach them: `directories` with a glob
+  # is what covers the hack/ fixtures without listing every one by hand.
+  # Grouped, because the alternative is what prompted this file -- one
+  # advisory in a shared dependency opened nine separate alerts.
+  - package-ecosystem: gomod
+    directories:
+      - "/api"
+      - "/ingest"
+      - "/alerting"
+      - "/enterprise"
+      - "/proto"
+      - "/cli"
+      - "/terraform"
+      - "/deploy/operator"
+      - "/hack/*"
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    groups:
+      # Majors stay out: a Go major is an import path change, never a bump.
+      go-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+  - package-ecosystem: cargo
+    directories:
+      - "/agent"
+      - "/search"
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC
+    groups:
+      cargo-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+  - package-ecosystem: npm
+    directory: "/web"
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC
+    groups:
+      npm-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC
+    groups:
+      actions:
+        patterns:
+          - "*"