go.mod: bump google.golang.org/grpc from 1.77.0 to 1.79.3#28
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
|
@dependabot rebase |
|
Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request |
`claude-code-action@v1` added a `restoreConfigFromBase()` security step (around v1.0.79, 2026-03-18) that runs `git fetch` before the Claude prompt executes. The ClauDependabot workflow intentionally skipped `actions/checkout` to avoid giving the agent write access, but the new step crashes with `fatal: not a git repository` when no working directory exists. Both open Dependabot PRs (#28, #35) are stuck because of this. Adding a checkout with `persist-credentials: false` satisfies the git requirement without granting push capability; the review steps already authenticate through `gh` which manages its own token. The `GH_REPO` env override and the comments documenting harmless git errors are no longer needed and are removed. `Read`, `Glob`, and `Grep` are added to the tool allowlists so Claude can inspect the checked-out source during reviews rather than relying solely on `gh pr diff`. --------- Co-authored-by: Daniel Orbach <ddorbach@gmail.com>
|
@dependabot rebase |
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.77.0 to 1.79.3. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.77.0...v1.79.3) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/go_modules/google.golang.org/grpc-1.79.3
branch
from
599cd06 to
9c84c18
Compare
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Reviewed by claude-sonnet-4-6.
This is a routine dependency bump of google.golang.org/grpc from 1.77.0 → 1.79.3, with corresponding minor updates to genproto/googleapis/api, genproto/googleapis/rpc, and golang.org/x/oauth2. Only go.mod and go.sum are changed — no application code is affected.
Notably, 1.79.3 includes a security fix for an authorization bypass where malformed :path headers could bypass path-based deny rules in interceptors (grpc/grpc-go#8981). This makes the update especially worthwhile. Changes are backwards-compatible.
dependabot
Bot
deleted the
dependabot/go_modules/google.golang.org/grpc-1.79.3
branch
1 participant
Bumps google.golang.org/grpc from 1.77.0 to 1.79.3.
Release notes
Sourced from google.golang.org/grpc's releases.
... (truncated)
Commits
dda86dbChange version to 1.79.3 (#8983)72186f1grpc: enforce strict path checking for incoming requests on the server (#8981)97ca352Changing version to 1.79.3-dev (#8954)8902ab6Change the version to release 1.79.2 (#8947)a928670Cherry-pick #8874 to v1.79.x (#8904)06df363Change version to 1.79.2-dev (#8903)782f2deChange version to 1.79.1 (#8902)850eccbChange version to 1.79.1-dev (#8851)765ff05Change version to 1.79.0 (#8850)68804beCherry pick #8864 to v1.79.x (#8896)