chore(deps): roll up supernode grpc dependabot bumps - #326
Conversation
314aeff to
9b7eb44
Compare
There was a problem hiding this comment.
🟡 Changes recommended
The new govulncheck wrapper/workflow has a failure-mode where govulncheck/module errors can produce empty JSON and incorrectly pass, and the workflow invocation should not rely on executable file mode.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR rolls up a set of Go dependency updates (notably gRPC, OpenTelemetry, and golang.org/x/*) across the repo’s multiple Go modules, and tightens CI vulnerability scanning by introducing a govulncheck baseline wrapper that allowlists only explicitly reviewed, currently-unfixed reachable findings.
Changes:
- Bump Go module dependencies across root,
cmd/sncli,sn-manager, andtests/system(includinggoogle.golang.org/grpctov1.83.2and multiplegolang.org/x/*updates). - Update
godirectives from1.26.2to1.26.6across modules. - Add
scripts/govulncheck-baseline.shand switch thegovulncheckworkflow to use it.
File summaries
| File | Description |
|---|---|
go.mod |
Bumps Go version and core deps (grpc, genproto, x/*). |
go.sum |
Updates checksums to match new root module dependency graph. |
cmd/sncli/go.mod |
Bumps sncli module deps (grpc, x/*, genproto). |
cmd/sncli/go.sum |
Updates checksums for sncli module dependency graph. |
sn-manager/go.mod |
Bumps sn-manager module deps (grpc, x/*, genproto). |
sn-manager/go.sum |
Updates checksums for sn-manager module dependency graph. |
tests/system/go.mod |
Bumps systemtests module deps (grpc, x/*, genproto). |
tests/system/go.sum |
Updates checksums for systemtests module dependency graph. |
scripts/govulncheck-baseline.sh |
New wrapper to enforce an actionable govulncheck baseline/allowlist policy. |
.github/workflows/govulncheck.yml |
Switches CI to run govulncheck via the new baseline wrapper across a module matrix. |
Review details
- Files reviewed: 6/10 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
9b7eb44 to
fa9c53a
Compare
No description provided.