Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update grpc-core version #8412

Merged
merged 2 commits into from
Oct 6, 2024
Merged

Update grpc-core version #8412

merged 2 commits into from
Oct 6, 2024

Conversation

mikhsol
Copy link
Contributor

@mikhsol mikhsol commented Sep 30, 2024

io.grpc:grpc-core package in version 1.36.0 contains multiple CVE's. Bump grpc-core version to latest 1.68.0 version to mitigate potential vulnerabilities.

io.grpc:grpc-core package in version 1.36.0 contains multiple [CVE's](https://mvnrepository.com/artifact/io.grpc/grpc-core/1.36.0).
Bump grpc-core version to latest 1.68.0 version to mitigate potential vulnerabilities.
@github-actions github-actions bot added the grpc label Sep 30, 2024
@aardappel aardappel self-requested a review October 4, 2024 16:01
@aardappel
Copy link
Collaborator

Should the version be v1.67.1 ? v1.68 is labelled as a "mistake" here: https://github.com/grpc/grpc-java/releases

Copy link
Collaborator

@aardappel aardappel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pick a better version

grpc was mistakenly released to maven under version 1.68.0 whenever a real release was done for version 1.67.1 [1]. The mistake was fixed later.

[1] https://github.com/grpc/grpc-java/releases
@mikhsol
Copy link
Contributor Author

mikhsol commented Oct 5, 2024

Good catch! Thank you. Fixed. Changed to 1.67.1,

@mikhsol mikhsol requested a review from aardappel October 5, 2024 08:27
@aardappel
Copy link
Collaborator

Thanks!

@aardappel aardappel merged commit 2f59a03 into google:master Oct 6, 2024
48 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants