Skip to content

[release-4.19] OCPBUGS-80419: Bump google.golang.org/grpc to v1.79.3 #1501

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ocp-sustaining-admins wants to merge 1 commit into
base: release-4.19
Choose a base branch
from
Open

[release-4.19] OCPBUGS-80419: Bump google.golang.org/grpc to v1.79.3 #1501

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 22 additions & 20 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ require (
)

require (
cel.dev/expr v0.19.0 // indirect
cel.dev/expr v0.24.0 // indirect
github.com/JeffAshton/win_pdh v0.0.0-20161109143554-76bb4ee9f0ab // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/NYTimes/gziphandler v1.1.1 // indirect
Expand Down Expand Up @@ -80,7 +80,7 @@ require (
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32 // indirect
github.com/go-logr/logr v1.4.2 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-logr/zapr v1.3.0 // indirect
github.com/go-ole/go-ole v1.3.0 // indirect
github.com/go-openapi/analysis v0.21.4 // indirect
Expand Down Expand Up @@ -153,32 +153,32 @@ require (
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
go.opentelemetry.io/otel v1.34.0 // indirect
go.opentelemetry.io/otel v1.37.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect
go.opentelemetry.io/otel/metric v1.34.0 // indirect
go.opentelemetry.io/otel/sdk v1.34.0 // indirect
go.opentelemetry.io/otel/trace v1.34.0 // indirect
go.opentelemetry.io/otel/metric v1.37.0 // indirect
go.opentelemetry.io/otel/sdk v1.37.0 // indirect
go.opentelemetry.io/otel/trace v1.37.0 // indirect
go.opentelemetry.io/proto/otlp v1.3.1 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
go4.org v0.0.0-20230225012048-214862532bf5 // indirect
golang.org/x/crypto v0.36.0 // indirect
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
golang.org/x/mod v0.23.0 // indirect
golang.org/x/net v0.37.0 // indirect
golang.org/x/oauth2 v0.28.0 // indirect
golang.org/x/sync v0.12.0 // indirect
golang.org/x/sys v0.31.0 // indirect
golang.org/x/term v0.30.0 // indirect
golang.org/x/text v0.23.0 // indirect
golang.org/x/crypto v0.39.0 // indirect
golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c // indirect
golang.org/x/mod v0.25.0 // indirect
golang.org/x/net v0.41.0 // indirect
golang.org/x/oauth2 v0.30.0 // indirect
golang.org/x/sync v0.15.0 // indirect
golang.org/x/sys v0.33.0 // indirect
golang.org/x/term v0.32.0 // indirect
golang.org/x/text v0.26.0 // indirect
golang.org/x/time v0.10.0 // indirect
golang.org/x/tools v0.30.0 // indirect
golang.org/x/tools v0.33.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250227231956-55c901821b1e // indirect
google.golang.org/grpc v1.70.0 // indirect
google.golang.org/protobuf v1.36.5 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
google.golang.org/grpc v1.71.0 // indirect
google.golang.org/protobuf v1.36.6 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
Expand Down Expand Up @@ -240,3 +240,5 @@ replace (
// Technical debt of NTO and its dependencies.
// openshift/openshift-kni/debug-tools@v0.2.1 needs pinning of cadvisor; also gather-sysinfo.go needs to be fixed to allow usage of latest debug-tools
replace github.com/google/cadvisor => github.com/google/cadvisor v0.49.1

replace google.golang.org/grpc => github.com/openshift-sustaining/grpc-go v1.75.1-sec.1
Copy link
Copy Markdown

@qodo-code-review qodo-code-review Bot May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Grpc version ambiguous 🐞 Bug ⚙ Maintainability

go.mod now declares google.golang.org/grpc v1.71.0 but replaces it with
github.com/openshift-sustaining/grpc-go v1.75.1-sec.1, so the effective grpc code differs from the
declared grpc version in the module graph. This makes dependency tracking and future go mod
tidy/vendor regeneration error-prone because removing/altering the replace will silently drop back
to v1.71.0.
Agent Prompt 
### Issue description
`go.mod` declares `google.golang.org/grpc v1.71.0` but also replaces it with `github.com/openshift-sustaining/grpc-go v1.75.1-sec.1`, making the effective grpc code version differ from the declared grpc version.

### Issue Context
This discrepancy is also reflected in `vendor/modules.txt`, which will commonly be used by tooling/SBOM generation and can be silently reverted by future `go mod tidy`/`go mod vendor` changes if the `replace` line is touched.

### Fix Focus Areas
- go.mod[156-181]
- go.mod[240-244]

### What to change
- Update the declared `require google.golang.org/grpc ...` version to match the intended grpc version (and keep it aligned with the fork’s tag/base).
- Keep (or adjust) the `replace google.golang.org/grpc => github.com/openshift-sustaining/grpc-go ...` to the corresponding fork version.
- Re-run `go mod tidy` and `go mod vendor` to ensure `go.sum` and `vendor/modules.txt` are consistent with the final intended version.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

1,852 changes: 1,802 additions & 50 deletions go.sum
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion vendor/cel.dev/expr/.bazelversion
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
7.0.1
7.3.2
# Keep this pinned version in parity with cel-go
34 changes: 19 additions & 15 deletions vendor/cel.dev/expr/MODULE.bazel
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,26 +8,38 @@ bazel_dep(
)
bazel_dep(
name = "gazelle",
version = "0.36.0",
version = "0.39.1",
repo_name = "bazel_gazelle",
)
bazel_dep(
name = "googleapis",
version = "0.0.0-20240819-fe8ba054a",
version = "0.0.0-20241220-5e258e33.bcr.1",
repo_name = "com_google_googleapis",
)
bazel_dep(
name = "googleapis-cc",
version = "1.0.0",
)
bazel_dep(
name = "googleapis-java",
version = "1.0.0",
)
bazel_dep(
name = "googleapis-go",
version = "1.0.0",
)
bazel_dep(
name = "protobuf",
version = "26.0",
version = "27.0",
repo_name = "com_google_protobuf",
)
bazel_dep(
name = "rules_cc",
version = "0.0.9",
version = "0.0.17",
)
bazel_dep(
name = "rules_go",
version = "0.49.0",
version = "0.53.0",
repo_name = "io_bazel_rules_go",
)
bazel_dep(
Expand All @@ -36,7 +48,7 @@ bazel_dep(
)
bazel_dep(
name = "rules_proto",
version = "6.0.0",
version = "7.0.2",
)
bazel_dep(
name = "rules_python",
Expand All @@ -50,16 +62,8 @@ python.toolchain(
python_version = "3.11",
)

switched_rules = use_extension("@com_google_googleapis//:extensions.bzl", "switched_rules")
switched_rules.use_languages(
cc = True,
go = True,
java = True,
)
use_repo(switched_rules, "com_google_googleapis_imports")

go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
go_sdk.download(version = "1.21.1")
go_sdk.download(version = "1.22.0")

go_deps = use_extension("@bazel_gazelle//:extensions.bzl", "go_deps")
go_deps.from_file(go_mod = "//:go.mod")
Expand Down
2 changes: 0 additions & 2 deletions vendor/cel.dev/expr/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,5 +69,3 @@ For more detail, see:
* [Language Definition](doc/langdef.md)

Released under the [Apache License](LICENSE).

Disclaimer: This is not an official Google product.
2 changes: 1 addition & 1 deletion vendor/cel.dev/expr/cloudbuild.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
steps:
- name: 'gcr.io/cloud-builders/bazel:7.0.1'
- name: 'gcr.io/cloud-builders/bazel:7.3.2'
entrypoint: bazel
args: ['build', '...']
id: bazel-build
Expand Down
Loading