Skip to content

chore(deps): Bump google.golang.org/grpc from 1.79.3 to 1.80.0#39

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/google.golang.org/grpc-1.80.0
Closed

chore(deps): Bump google.golang.org/grpc from 1.79.3 to 1.80.0#39
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/google.golang.org/grpc-1.80.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 22, 2026

Bumps google.golang.org/grpc from 1.79.3 to 1.80.0.

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.80.0

Behavior Changes

  • balancer: log a warning if a balancer is registered with uppercase letters, as balancer names should be lowercase. In a future release, balancer names will be treated as case-insensitive; see #5288 for details. (#8837)
  • xds: update resource error handling and re-resolution logic (#8907)
    • Re-resolve all LOGICAL_DNS clusters simultaneously when re-resolution is requested.
    • Fail all in-flight RPCs immediately upon receipt of listener or route resource errors, instead of allowing them to complete.

Bug Fixes

  • xds: support the LB policy configured in LOGICAL_DNS cluster resources instead of defaulting to pick_first. (#8733)
  • credentials/tls: perform per-RPC authority validation against the leaf certificate instead of the entire peer certificate chain. (#8831)
  • xds: enabling A76 ring hash endpoint keys no longer causes EDS resources with invalid proxy metadata to be NACKed when HTTP CONNECT (gRFC A86) is disabled. (#8875)
  • xds: validate that the sum of endpoint weights in a locality does not exceed the maximum uint32 value. (#8899)
  • xds: fix incorrect proto field access in the weighted round robin (WRR) configuration where blackout_period was used instead of weight_expiration_period. (#8915)
  • xds/rbac: handle addresses with ports in IP matchers. (#8990)

New Features

  • ringhash: enable gRFC A76 (endpoint hash keys and request hash headers) by default. (#8922)

Performance Improvements

  • credentials/alts: pool write buffers to reduce memory allocations and usage. (#8919)
  • grpc: enable the use of pooled write buffers for buffering HTTP/2 frame writes by default. This reduces memory usage when connections are idle. Use the WithSharedWriteBuffer dial option or the SharedWriteBuffer server option to disable this feature. (#8957)
  • xds/priority: stop caching child LB policies removed from the configuration. This will help reduce memory and cpu usage when localities are constantly switching between priorities. (#8997)
  • mem: add a faster tiered buffer pool; use the experimental mem.NewBinaryTieredBufferPool function to create such pools. (#8775)
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): Bump google.golang.org/grpc from 1.79.3 to 1.80.0
0ad2049 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.3 to 1.80.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.79.3...v1.80.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.80.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Apr 22, 2026
@kevinelliott kevinelliott mentioned this pull request Apr 24, 2026
Merged
5 tasks
kevinelliott added a commit that referenced this pull request Apr 24, 2026
@kevinelliott @claude
chore(deps): raise minimum Go to 1.25; bump 5 deps; migrate golangci-…
91708a8 
…lint to v2

golang.org/x/sync v0.20.0 requires go >= 1.25.0. Rather than pin that
sub-package to v0.19 and leave four other bumps blocked, bump the
module's minimum Go to match. User-visible: go install users on 1.24
will see a clear "requires go >= 1.25" error when they next install.

Golangci-lint v1 is discontinued (last release v1.64.8 built with
Go 1.24, refuses to lint Go 1.25 modules). Migrated to v2.11.4:
- .golangci.yml: v1 format -> v2 (via `golangci-lint migrate`)
- Makefile GOLANGCI_LINT_VERSION: v1.64.8 -> v2.11.4; install path
  switched to v2 module (.../v2/cmd/golangci-lint)
- CI uses golangci-lint-action@v7 (v6 doesn't support v2 binaries)
- Added exclusions for 3 v2-new rules that fire false-positive-heavy
  on this codebase:
  - gocritic importShadow (we deliberately shadow agent/status)
  - gosec G703 (all flagged paths are from platform.GetConfigDir /
    platform.GetDataDir / catalog package names, never user input)
  - noctx (most flags are exec.Command/net.Listen/httptest.NewRequest
    where adopting ctx variants adds ceremony without correctness)

Dep bumps:
- google.golang.org/grpc           v1.79.3  -> v1.80.0
- golang.org/x/sync                v0.19.0  -> v0.20.0  (forces 1.25)
- github.com/mattn/go-isatty       v0.0.20  -> v0.0.21
- github.com/mattn/go-sqlite3      v1.14.34 -> v1.14.42
- golang.org/x/sys                 v0.41.0  -> v0.43.0
- Transitive: x/net 0.48->0.49, x/text 0.32->0.33,
  protobuf 1.36.10->1.36.11, genproto-rpc bump

Toolchain updates: go.mod go 1.24.2 -> 1.25.0; CI GO_VERSION 1.24
-> 1.25; test matrix ['1.23','1.24'] -> ['1.25']; Dockerfile
golang:1.24-alpine -> golang:1.25-alpine; README.md +
CONTRIBUTING.md prerequisites Go 1.24+ -> Go 1.25+.

Real findings the v2 lint surfaced and fixed inline:
- internal/systray/systray.go:109 gosec G118: cancel func is stored
  on the struct and invoked in onExit; suppressed with contextual
  nolint since gosec can't see that.
- internal/systray/systray.go:942 nolintlint: removed a stale
  //nolint:gosec directive (the call no longer matched G204 under
  the new ruleset).
- internal/tui/app.go:572 staticcheck QF1012: WriteString(Sprintf)
  -> Fprintf.

Supersedes dependabot PRs #35, #36, #37, #38, #39.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
kevinelliott added a commit that referenced this pull request Apr 24, 2026
@kevinelliott @claude
chore(deps): raise minimum Go to 1.25; bump 5 deps; migrate golangci-…
9f863a8 
…lint to v2 (#40)

golang.org/x/sync v0.20.0 requires go >= 1.25.0. Rather than pin that
sub-package to v0.19 and leave four other bumps blocked, bump the
module's minimum Go to match. User-visible: go install users on 1.24
will see a clear "requires go >= 1.25" error when they next install.

Golangci-lint v1 is discontinued (last release v1.64.8 built with
Go 1.24, refuses to lint Go 1.25 modules). Migrated to v2.11.4:
- .golangci.yml: v1 format -> v2 (via `golangci-lint migrate`)
- Makefile GOLANGCI_LINT_VERSION: v1.64.8 -> v2.11.4; install path
  switched to v2 module (.../v2/cmd/golangci-lint)
- CI uses golangci-lint-action@v7 (v6 doesn't support v2 binaries)
- Added exclusions for 3 v2-new rules that fire false-positive-heavy
  on this codebase:
  - gocritic importShadow (we deliberately shadow agent/status)
  - gosec G703 (all flagged paths are from platform.GetConfigDir /
    platform.GetDataDir / catalog package names, never user input)
  - noctx (most flags are exec.Command/net.Listen/httptest.NewRequest
    where adopting ctx variants adds ceremony without correctness)

Dep bumps:
- google.golang.org/grpc           v1.79.3  -> v1.80.0
- golang.org/x/sync                v0.19.0  -> v0.20.0  (forces 1.25)
- github.com/mattn/go-isatty       v0.0.20  -> v0.0.21
- github.com/mattn/go-sqlite3      v1.14.34 -> v1.14.42
- golang.org/x/sys                 v0.41.0  -> v0.43.0
- Transitive: x/net 0.48->0.49, x/text 0.32->0.33,
  protobuf 1.36.10->1.36.11, genproto-rpc bump

Toolchain updates: go.mod go 1.24.2 -> 1.25.0; CI GO_VERSION 1.24
-> 1.25; test matrix ['1.23','1.24'] -> ['1.25']; Dockerfile
golang:1.24-alpine -> golang:1.25-alpine; README.md +
CONTRIBUTING.md prerequisites Go 1.24+ -> Go 1.25+.

Real findings the v2 lint surfaced and fixed inline:
- internal/systray/systray.go:109 gosec G118: cancel func is stored
  on the struct and invoked in onExit; suppressed with contextual
  nolint since gosec can't see that.
- internal/systray/systray.go:942 nolintlint: removed a stale
  //nolint:gosec directive (the call no longer matched G204 under
  the new ruleset).
- internal/tui/app.go:572 staticcheck QF1012: WriteString(Sprintf)
  -> Fprintf.

Supersedes dependabot PRs #35, #36, #37, #38, #39.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@kevinelliott
Copy link
Copy Markdown
Owner

kevinelliott commented Apr 24, 2026

Superseded by #40 (batched Go 1.25 + 5 deps + golangci-lint v2 migration).

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 24, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/go_modules/google.golang.org/grpc-1.80.0 branch April 24, 2026 21:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kevinelliott