Skip to content

chore(deps): bump google.golang.org/protobuf v1.36.12, google.golang.org/grpc v1.79.3, sigs.k8s.io/yaml v1.5.0 - #310

Draft
thaJeztah wants to merge 4 commits into
containerd:mainfrom
thaJeztah:bump_more_deps
Draft

chore(deps): bump google.golang.org/protobuf v1.36.12, google.golang.org/grpc v1.79.3, sigs.k8s.io/yaml v1.5.0#310
thaJeztah wants to merge 4 commits into
containerd:mainfrom
thaJeztah:bump_more_deps

Conversation

@thaJeztah

@thaJeztah thaJeztah commented Aug 20, 2026

Copy link
Copy Markdown
Member

chore(deps): bump google.golang.org/protobuf v1.36.12, google.golang.org/grpc v1.79.3, sigs.k8s.io/yaml v1.5.0

chore(deps): bump google.golang.org/protobuf v1.36.12

chore(deps): bump google.golang.org/grpc v1.79.3

Update to a newer version to reduce transitive dependencies on deprecated
modules.

This also pleases vulnerability scanners scanners on GHSA-p77j-4mvh-x3m3
(CVE-2026-33186); this is a false positive, but most consumers of this
module already updated to a newer version og grpc, so we may as well
update.

Note that there's newer versions available, which also fix some CVEs
(high, not critical), but keeping the version slightly conservative.

chore(deps): bump sigs.k8s.io/yaml v1.5.0

Update to a newer version that drops dependencies on the deprecated
gopkg.in/yaml.v2, gopkg.in/yaml.v3 modules. I did not pick the latest
(v1.6.0) version as that introduces an extra dependency that may not
be needed.

Manually updated the indirect go.yaml.in/yaml/v2 to its latest
version (v2.4.4) which no longer has any dependencies.

@thaJeztah

Copy link
Copy Markdown
Member Author

Ugh, so this breaks for WASM;

Error: ../../../go/pkg/mod/github.com/knqyf263/go-plugin@v0.9.0/gen/main.go:97:22: undefined: vtgenerator.Extensions
Error: ../../../go/pkg/mod/github.com/knqyf263/go-plugin@v0.9.0/gen/main.go:100:41: cannot use plugin.Files (variable of type []*protogen.File) as *protogen.Plugin value in argument to vtgenerator.NewGenerator
Error: ../../../go/pkg/mod/github.com/knqyf263/go-plugin@v0.9.0/gen/vtproto.go:12:11: gg.vtgen.GenerateFile undefined (type *generator.Generator has no field or method GenerateFile, but does have unexported method generateFile)
make: *** [Makefile:231: install-wasm-plugin] Error 1
Error: Process completed with exit code 2.

Looks like github.com/knqyf263/go-plugin is not compatible with newer version of github.com/planetscale/vtprotobuf;

Related; planetscale/vtprotobuf@0d40610 (https://github.com/planetscale/vtprotobuf/releases/tag/v0.6.0)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Update to a newer version to reduce transitive dependencies on deprecated
modules.

This also pleases vulnerability scanners scanners on GHSA-p77j-4mvh-x3m3
(CVE-2026-33186); this is a false positive, but most consumers of this
module already updated to a newer version og grpc, so we may as well
update.

Note that there's newer versions available, which also fix some CVEs
(high, not critical), but keeping the version slightly conservative.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Update to a newer version that drops dependencies on the deprecated
gopkg.in/yaml.v2, gopkg.in/yaml.v3 modules. I did not pick the latest
(v1.6.0) version as that introduces an extra dependency that may not
be needed.

Manually updated the indirect go.yaml.in/yaml/v2 to its latest
version (v2.4.4) which no longer has any dependencies.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah

Copy link
Copy Markdown
Member Author

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant