Skip to content

Makefile: drop stale grpc@v1.59.0 pin from bootstrap target#445

Merged
raghavendra-nataraj merged 1 commit into
mainfrom
raghavendra-nataraj/fix-bootstrap-grpc-pin
Jul 23, 2026
Merged

Makefile: drop stale grpc@v1.59.0 pin from bootstrap target#445
raghavendra-nataraj merged 1 commit into
mainfrom
raghavendra-nataraj/fix-bootstrap-grpc-pin

Conversation

@raghavendra-nataraj

Copy link
Copy Markdown
Contributor

What

Remove the stale go get -u google.golang.org/grpc@v1.59.0 line from the bootstrap target in the Makefile.

Why

  • bootstrap is a prerequisite of the generate and pipeline targets.
  • The line pins grpc to v1.59.0, added in Update golang.org/x/net #367 when grpc was at v1.59.0, and never updated after go.mod moved to v1.82.1.
  • Running make generate / make pipeline therefore downgrades the module's grpc back to v1.59.0 — re-introducing already-remediated CVEs — and gen.sh's trailing go mod tidy persists that downgrade into go.mod / go.sum.

Why removal is safe

  • Proto generation does not need the grpc module fetched: rpc/gen_proto.sh generates via --go_out=plugins=grpc:, whose grpc plugin ships inside protoc-gen-go@v1.3.2 (installed by the same bootstrap target).
  • The grpc runtime version is governed entirely by go.mod. After this change, bootstrap installs only protoc-gen-go and grpc stays at the go.mod-selected v1.82.1.
  • Sibling repos (moc-pkg, moc-sdk-for-go) carry no such grpc pin.

Diff

 bootstrap:
-	GOOS="linux" go get -u google.golang.org/grpc@v1.59.0
 	GOOS="linux" go install github.com/golang/protobuf/protoc-gen-go@v1.3.2

The `bootstrap` target ran `go get -u google.golang.org/grpc@v1.59.0`,
pinning grpc to v1.59.0. That pin was added in #367 when grpc was at
v1.59.0 and never updated after go.mod moved to v1.82.1. Because
`bootstrap` is a prerequisite of `generate`/`pipeline`, running either
target downgrades the module's grpc back to v1.59.0 (re-introducing
already-remediated CVEs) and `gen.sh`'s trailing `go mod tidy` persists
the downgrade into go.mod/go.sum.

Proto generation does not need the grpc module fetched: rpc/gen_proto.sh
emits code via `--go_out=plugins=grpc:`, whose grpc plugin ships inside
protoc-gen-go@v1.3.2. The grpc runtime version is governed entirely by
go.mod. Removing the line leaves bootstrap installing only protoc-gen-go
and keeps grpc at the go.mod-selected v1.82.1.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4a902de7-e15e-494c-b590-1f9e94a5fadd
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@raghavendra-nataraj

Copy link
Copy Markdown
Contributor Author

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

@raghavendra-nataraj
raghavendra-nataraj merged commit b64cbd1 into main Jul 23, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants