fix(cli): bump grpc-go v1.79.3 -- CVE-2026-33186 auth bypass by Aureliolo · Pull Request #574 · Aureliolo/synthorg

Aureliolo · 2026-03-19T09:05:09Z

Summary

Bump google.golang.org/grpc v1.79.2 -> v1.79.3 (indirect dep via sigstore-go)
Fixes CVE-2026-33186: authorization bypass via missing leading slash in :path header (critical severity)
Not exploitable in this CLI (no gRPC server exposed), but clears the Dependabot alert
Dependabot can't auto-PR indirect Go deps -- manual bump required

Test plan

go test ./... passes (all 11 packages)
Patch version bump only -- no API changes

🤖 Generated with Claude Code

) Authorization bypass via missing leading slash in :path header. Critical severity, patched in v1.79.3. Indirect dep via sigstore-go (not exploitable in this CLI -- no gRPC server exposed), but bumping to clear the Dependabot alert. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-03-19T09:05:21Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package

Version

Score

Details

gomod/google.golang.org/grpc

1.79.3

🟢 7.7

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 9	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
SAST	🟢 7	SAST tool detected but not run on all commits

Scanned Files

cli/go.mod

gemini-code-assist · 2026-03-19T09:05:26Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on a critical security update by bumping an indirect gRPC dependency to mitigate a known authorization bypass vulnerability. While the immediate impact on this specific CLI is minimal due to its architecture, the update ensures compliance with security best practices and resolves automated security alerts, maintaining the project's integrity.

Highlights

Dependency Update: The google.golang.org/grpc dependency has been bumped from version v1.79.2 to v1.79.3.
Security Fix: This update addresses CVE-2026-33186, which is an authorization bypass vulnerability related to a missing leading slash in the :path header.
Impact Assessment: Although the vulnerability is critical, it is noted that this specific CLI is not exploitable as it does not expose a gRPC server. The update primarily serves to clear a Dependabot alert.
Manual Intervention: The dependency update was performed manually because Dependabot is unable to automatically create pull requests for indirect Go dependencies.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request correctly bumps the google.golang.org/grpc dependency to v1.79.3 to address a reported security vulnerability. The changes in go.mod and go.sum are appropriate for this update. However, the CVE identifier CVE-2026-33186 referenced in the pull request title and description appears to be invalid, as its year is in the future. For accurate security tracking and maintainability, this should be corrected to the valid CVE identifier for the vulnerability being addressed.

coderabbitai · 2026-03-19T09:07:31Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: f5461df5-b601-4871-a023-ed2042947148

📥 Commits

Reviewing files that changed from the base of the PR and between 5bfc2c6 and a49ee0b.

⛔ Files ignored due to path filters (1)

cli/go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

cli/go.mod

📜 Recent review details

🧰 Additional context used

🧠 Learnings (3)

📓 Common learnings

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Applies to cli/** : CLI: Go 1.26+, dependencies in cli/go.mod (Cobra, charmbracelet/huh).

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-19T09:01:47.243Z
Learning: Applies to go.mod : Maintain Go 1.26+ requirement. Dependencies: Cobra (CLI framework), charmbracelet/huh and charmbracelet/lipgloss (UI), sigstore-go (code signing), go-containerregistry (container image verification), go-tuf (TUF client for Sigstore).

📚 Learning: 2026-03-15T11:48:14.867Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Applies to cli/** : CLI: Go 1.26+, dependencies in cli/go.mod (Cobra, charmbracelet/huh).

Applied to files:

cli/go.mod

📚 Learning: 2026-03-19T09:01:47.243Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-19T09:01:47.243Z
Learning: Applies to go.mod : Maintain Go 1.26+ requirement. Dependencies: Cobra (CLI framework), charmbracelet/huh and charmbracelet/lipgloss (UI), sigstore-go (code signing), go-containerregistry (container image verification), go-tuf (TUF client for Sigstore).

Applied to files:

cli/go.mod

🔇 Additional comments (1)

cli/go.mod (1)

112-112: Security patch bump looks correct and scoped.

Updating google.golang.org/grpc to v1.79.3 as an indirect dependency is appropriate for the CVE remediation objective, and the change is narrowly scoped in go.mod.

Based on learnings: Maintain Go 1.26+ requirement. Dependencies: Cobra (CLI framework), charmbracelet/huh and charmbracelet/lipgloss (UI), sigstore-go (code signing), go-containerregistry (container image verification), go-tuf (TUF client for Sigstore).

📝 Walkthrough

Summary by CodeRabbit

Chores
- Updated a dependency to the latest patch version.

Walkthrough

Updated the indirect Go module dependency google.golang.org/grpc from version v1.79.2 to v1.79.3 in the CLI module. No logic, control flow, or public API changes are involved.

Changes

Cohort / File(s)	Summary
Dependency Version Update `cli/go.mod`	Bumped `google.golang.org/grpc` indirect dependency from `v1.79.2` to `v1.79.3`.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: bumping grpc-go to v1.79.3 and the security CVE it addresses.
Description check	✅ Passed	The description is clearly related to the changeset, providing context about the dependency bump, CVE details, and test results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/bump-grpc-go-cve-33186

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch fix/bump-grpc-go-cve-33186

📝 Coding Plan

Generate coding plan for human review comments

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

🤖 I have created a release *beep* *boop* --- ## [0.3.6](v0.3.5...v0.3.6) (2026-03-19) ### Features * **cli:** add backup subcommands (backup, backup list, backup restore) ([#568](#568)) ([4c06b1d](4c06b1d)) * **engine:** implement execution loop auto-selection based on task complexity ([#567](#567)) ([5bfc2c6](5bfc2c6)) ### Bug Fixes * activate structured logging pipeline -- wire 8-sink system, integrate Uvicorn, suppress spam ([#572](#572)) ([9b6bf33](9b6bf33)) * **cli:** bump grpc-go v1.79.3 -- CVE-2026-33186 auth bypass ([#574](#574)) ([f0171c9](f0171c9)) * resolve OpenAPI schema validation warnings for union/optional fields ([#558](#558)) ([5d96b2b](5d96b2b)) ### CI/CD * bump codecov/codecov-action from 5.5.2 to 5.5.3 in the minor-and-patch group ([#571](#571)) ([267f685](267f685)) * ignore chainguard/python in Dependabot docker updates ([#575](#575)) ([1935eaa](1935eaa)) ### Maintenance * bump the major group across 1 directory with 2 updates ([#570](#570)) ([b98f82c](b98f82c)) * bump the minor-and-patch group across 2 directories with 4 updates ([#569](#569)) ([3295168](3295168)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

gemini-code-assist bot reviewed Mar 19, 2026

View reviewed changes

coderabbitai bot approved these changes Mar 19, 2026

View reviewed changes

Merge branch 'main' into fix/bump-grpc-go-cve-33186

9261dfa

Aureliolo merged commit f0171c9 into main Mar 19, 2026
36 checks passed

Aureliolo deleted the fix/bump-grpc-go-cve-33186 branch March 19, 2026 09:11

Aureliolo mentioned this pull request Mar 19, 2026

chore(main): release 0.3.6 #573

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(cli): bump grpc-go v1.79.3 -- CVE-2026-33186 auth bypass#574

fix(cli): bump grpc-go v1.79.3 -- CVE-2026-33186 auth bypass#574
Aureliolo merged 2 commits intomainfrom
fix/bump-grpc-go-cve-33186

Aureliolo commented Mar 19, 2026

Uh oh!

github-actions bot commented Mar 19, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Mar 19, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

coderabbitai bot commented Mar 19, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Aureliolo commented Mar 19, 2026

Summary

Test plan

Uh oh!

github-actions bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

gemini-code-assist bot commented Mar 19, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

coderabbitai bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions bot commented Mar 19, 2026 •

edited

Loading

coderabbitai bot commented Mar 19, 2026 •

edited

Loading