-
Notifications
You must be signed in to change notification settings - Fork 0
fix(deps): upgrade ev-node to v1.0.0 and fix broken metrics #33
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
auricom
wants to merge
2
commits into
main
Choose a base branch
from
auricom/fix_ev_node_v1.0.0
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| # build stage | ||
| FROM golang:1.24-alpine AS builder | ||
| FROM golang:1.25-alpine AS builder | ||
|
|
||
| WORKDIR /build | ||
|
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: evstack/ev-metrics
Length of output: 717
🌐 Web query:
GO-2026-4762 GHSA-p77j-4mvh-x3m3 gRPC vulnerability💡 Result:
GO-2026-4762 (GHSA-p77j-4mvh-x3m3, CVE-2026-33186) is an authorization bypass vulnerability in the gRPC-Go library (google.golang.org/grpc).[1][2][3] Published on March 27, 2026.[1][2] The gRPC-Go server accepts HTTP/2 requests with a:path pseudo-header missing the leading slash (e.g., "Service/Method" instead of "/Service/Method"). It routes these to the correct handler, but authorization interceptors (like google.golang.org/grpc/authz) check the raw non-canonical path. Deny rules for canonical paths (starting with /) fail to match, bypassing authorization if a fallback allow rule exists.[3][4][5] Impacted servers use path-based authorization interceptors (e.g., grpc/authz or custom using info.FullMethod) with deny rules for canonical paths and default allow.[3][6] Exploitable by sending raw HTTP/2 frames with malformed:path to the gRPC server.[3] Fixed in v1.79.3 (or later): rejects non-leading-slash:path with codes.Unimplemented before interceptors/handlers.[1][2][3] Upgrade to google.golang.org/grpc v1.79.3+. Workarounds: validating interceptor to reject/normalize paths, proxy enforcement of HTTP/2 compliance, default-deny policies.[3][6][7] Affected symbols: Server.Serve, Server.ServeHTTP, Server.handleStream.[2]
Citations:
🌐 Web query:
google.golang.org/grpc v1.79.3 security fix release notes💡 Result:
google.golang.org/grpc (grpc-go) v1.79.3 security fix release notes (as stated by the grpc-go project): - Server: fix an authorization bypass where malformed HTTP/2:path headers missing the leading slash could bypass path-based restricted “deny” rules in interceptors such as grpc/authz. In v1.79.3, any request with a non-canonical path is immediately rejected with an Unimplemented error. [1] Context / vulnerability description (CVE-2026-33186) from NVD: - The gRPC-Go server could accept requests where:path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server routed these correctly, authorization interceptors evaluated the raw, non-canonical path string, so canonical “deny” rules (starting with /) could fail to match, potentially allowing bypass (e.g., when a fallback allow exists). The fix ensures requests whose:path does not start with a leading slash are immediately rejected with codes.Unimplemented. [2] When to upgrade: - Upgrade to google.golang.org/grpc v1.79.3 (or newer) to obtain the fix. [1][2]
Citations:
Upgrade gRPC-Go to patch authorization bypass vulnerability.
google.golang.org/grpc v1.79.2is affected by GO-2026-4762 / GHSA-p77j-4mvh-x3m3 (CVE-2026-33186), an authorization bypass vulnerability where malformed HTTP/2 :path headers can bypass path-based authorization checks in interceptors. Upgrade to v1.79.3 or later before merging.Suggested fix
📝 Committable suggestion
🧰 Tools
🪛 OSV Scanner (2.3.6)
[CRITICAL] 16-16: google.golang.org/grpc 1.79.2: Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
(GO-2026-4762)
[CRITICAL] 16-16: google.golang.org/grpc 1.79.2: gRPC-Go has an authorization bypass via missing leading slash in :path
(GHSA-p77j-4mvh-x3m3)
🤖 Prompt for AI Agents