Skip to content

build(deps): bump google.golang.org/grpc from 1.70.0 to 1.80.0 in /controller#413

Open
dependabot[bot] wants to merge 2 commits intomainfrom
dependabot/go_modules/controller/google.golang.org/grpc-1.80.0
Open

build(deps): bump google.golang.org/grpc from 1.70.0 to 1.80.0 in /controller#413
dependabot[bot] wants to merge 2 commits intomainfrom
dependabot/go_modules/controller/google.golang.org/grpc-1.80.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 7, 2026

Bumps google.golang.org/grpc from 1.70.0 to 1.80.0.

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.80.0

Behavior Changes

  • balancer: log a warning if a balancer is registered with uppercase letters, as balancer names should be lowercase. In a future release, balancer names will be treated as case-insensitive; see #5288 for details. (#8837)
  • xds: update resource error handling and re-resolution logic (#8907)
    • Re-resolve all LOGICAL_DNS clusters simultaneously when re-resolution is requested.
    • Fail all in-flight RPCs immediately upon receipt of listener or route resource errors, instead of allowing them to complete.

Bug Fixes

  • xds: support the LB policy configured in LOGICAL_DNS cluster resources instead of defaulting to pick_first. (#8733)
  • credentials/tls: perform per-RPC authority validation against the leaf certificate instead of the entire peer certificate chain. (#8831)
  • xds: enabling A76 ring hash endpoint keys no longer causes EDS resources with invalid proxy metadata to be NACKed when HTTP CONNECT (gRFC A86) is disabled. (#8875)
  • xds: validate that the sum of endpoint weights in a locality does not exceed the maximum uint32 value. (#8899)
  • xds: fix incorrect proto field access in the weighted round robin (WRR) configuration where blackout_period was used instead of weight_expiration_period. (#8915)
  • xds/rbac: handle addresses with ports in IP matchers. (#8990)

New Features

  • ringhash: enable gRFC A76 (endpoint hash keys and request hash headers) by default. (#8922)

Performance Improvements

  • credentials/alts: pool write buffers to reduce memory allocations and usage. (#8919)
  • grpc: enable the use of pooled write buffers for buffering HTTP/2 frame writes by default. This reduces memory usage when connections are idle. Use the WithSharedWriteBuffer dial option or the SharedWriteBuffer server option to disable this feature. (#8957)
  • xds/priority: stop caching child LB policies removed from the configuration. This will help reduce memory and cpu usage when localities are constantly switching between priorities. (#8997)
  • mem: add a faster tiered buffer pool; use the experimental mem.NewBinaryTieredBufferPool function to create such pools. (#8775)

Release 1.79.3

Security

  • server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (#8981)

Release 1.79.2

Bug Fixes

  • stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (grpc/grpc-go#8874)

Release 1.79.1

Bug Fixes

Release 1.79.0

API Changes

  • mem: Add experimental API SetDefaultBufferPool to change the default buffer pool. (#8806)
  • experimental/stats: Update MetricsRecorder to require embedding the new UnimplementedMetricsRecorder (a no-op struct) in all implementations for forward compatibility. (#8780)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code minor labels Apr 7, 2026
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Apr 7, 2026 •
edited
Loading

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d7c438e2-c24c-4db5-92b4-f42c42cec041

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dependabot/go_modules/controller/google.golang.org/grpc-1.80.0

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@netlify
Copy link
Copy Markdown

netlify bot commented Apr 7, 2026 •
edited
Loading

✅ Deploy Preview for jumpstarter-docs ready!

Name Link
🔨 Latest commit df42643
🔍 Latest deploy log https://app.netlify.com/projects/jumpstarter-docs/deploys/69d6637644dc180008c1314e
😎 Deploy Preview https://deploy-preview-413--jumpstarter-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@ambient-code
Copy link
Copy Markdown
Contributor

ambient-code bot commented Apr 7, 2026

The CI failures are caused by the operator submodule (controller/deploy/operator/) having its own go.mod with a replace directive pointing to the parent controller/ module. When Dependabot bumped grpc to v1.80.0 in controller/go.mod, the transitive dependency versions diverged — the operator's go.mod still referenced older versions of shared deps (otel, golang.org/x, etc.). This caused controller-gen to fail with go: updates to go.mod needed; to update it: go mod tidy.

Pushed a fix: ran go mod tidy in controller/deploy/operator/ to sync the transitive dependencies.

@ambient-code
Copy link
Copy Markdown
Contributor

ambient-code bot commented Apr 7, 2026

CI Status

CI is looking good so far — all core checks (lint-go, tests, deploy-kind) have passed. E2e tests are still running.

This PR correctly updates both controller/go.mod and controller/deploy/operator/go.mod with the grpc bump, so the multi-module consistency issue that affects other dependabot PRs is not present here.

@ambient-code
Copy link
Copy Markdown
Contributor

ambient-code bot commented Apr 7, 2026

E2E Test Flakiness

The remaining CI failure (e2e-tests (ubuntu-24.04, helm)) is a flaky test, not caused by the grpc bump. Tests 47 and 48 ("can lease and connect to exporters" / "can lease and connect to exporters by name") fail with Error: Connection to exporter lost — the same error seen on completely unrelated branches (e.g. driver-mitmproxy). Other e2e variants (arm, operator, kind-based) all pass.

This PR looks good to merge — the dependency bump and operator submodule sync are correct. The e2e flake should be investigated separately.

@ambient-code
Copy link
Copy Markdown
Contributor

ambient-code bot commented Apr 7, 2026

Dependabot PR Analysis

CI Status

The e2e-tests (ubuntu-24.04, helm) failure is a flaky test — not caused by this dependency change. Tests 47 & 48 ("can lease and connect to exporters" / "can lease and connect to exporters by name") fail with Connection to exporter lost, which is a known race condition in listenQueues cleanup after transient exporter disconnects. The same failure is happening on multiple unrelated PRs today. PR #417 (fix-listen-queue-race) addresses the root cause — once merged, these flaky failures should stop.

All other 50+ tests pass, including lint-go, tests, deploy-kind, and e2e-compat-*.

Dependency Analysis

This PR bumps google.golang.org/grpc from v1.70.0 to v1.80.0 in /controller. It correctly updates both controller/go.mod and controller/deploy/operator/go.mod. The bump also pulls in significant transitive dependency updates:

Notable: grpc v1.79.3 includes a security fix (authorization bypass with malformed :path headers — #8981).

⚠️ This PR conflicts with PR #410 (go-jose bump). If this is merged first, #410 can still cleanly apply (v4.1.3 → v4.1.4).

🤖 Generated with Claude Code

@ambient-code ambient-code bot mentioned this pull request Apr 7, 2026
Open
@ambient-code ambient-code bot force-pushed the dependabot/go_modules/controller/google.golang.org/grpc-1.80.0 branch from 1583747 to 3e6dec7 Compare April 7, 2026 13:25
@mangelajo
Copy link
Copy Markdown
Member

mangelajo commented Apr 8, 2026

@ambient-code please rebase this

dependabot bot and others added 2 commits April 8, 2026 14:17
@dependabot
build(deps): bump google.golang.org/grpc in /controller
92a9b21 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.70.0 to 1.80.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.70.0...v1.80.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.80.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@claude
build(deps): run go mod tidy in controller/deploy/operator
df42643 
The grpc v1.80.0 bump in controller/go.mod requires syncing
transitive dependencies in the operator submodule which uses
a replace directive pointing to the parent module.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@ambient-code ambient-code bot force-pushed the dependabot/go_modules/controller/google.golang.org/grpc-1.80.0 branch from 3e6dec7 to df42643 Compare April 8, 2026 14:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

already-checked dependencies Pull requests that update a dependency file go Pull requests that update go code minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mangelajo