From 3224d7d6974568994a2638ee7c74950272981fcc Mon Sep 17 00:00:00 2001 From: SimpleTest Date: Wed, 22 Jul 2026 17:02:13 +0300 Subject: [PATCH] fix: patch grpc-go in MinIO images --- Dockerfile.minio | 6 ++++-- README.md | 7 ++++--- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/Dockerfile.minio b/Dockerfile.minio index ffe4827..abace4c 100644 --- a/Dockerfile.minio +++ b/Dockerfile.minio @@ -14,7 +14,8 @@ RUN tar --extract --gzip --file /tmp/minio.tar.gz \ github.com/prometheus/prometheus@v0.311.3 \ golang.org/x/crypto@v0.52.0 \ golang.org/x/net@v0.55.0 \ - google.golang.org/grpc@v1.81.1 \ + google.golang.org/grpc@v1.82.1 \ + && test "$(go list -m -f '{{.Version}}' google.golang.org/grpc)" = "v1.82.1" \ && CGO_ENABLED=0 go build \ -mod=mod \ -trimpath \ @@ -41,8 +42,9 @@ RUN tar --extract --gzip --file /tmp/mc.tar.gz \ github.com/prometheus/prometheus@v0.311.3 \ golang.org/x/crypto@v0.52.0 \ golang.org/x/net@v0.55.0 \ - google.golang.org/grpc@v1.81.1 \ + google.golang.org/grpc@v1.82.1 \ && go mod tidy \ + && test "$(go list -m -f '{{.Version}}' google.golang.org/grpc)" = "v1.82.1" \ && CGO_ENABLED=0 go build \ -trimpath \ -tags kqueue \ diff --git a/README.md b/README.md index 06721bc..3ba8b96 100644 --- a/README.md +++ b/README.md @@ -110,9 +110,10 @@ Compose starts Traefik, PostGIS, Mailpit, a migration runner, 2 web replicas, and 2 Oban worker replicas. It waits for readiness and verifies a PubSub message broadcast from a different BEAM node. Registration emails appear in Mailpit. The Traefik image is reproducibly built from the checksum-pinned upstream -`v3.7.8` source with `grpc-go 1.82.1`. The Caddy edge and backup image build -upstream Caddy `v2.11.4` and restic `v0.19.1` with the same dependency pin. -Those latest upstream dependency graphs still contain older `grpc-go` versions affected by +`v3.7.8` source with `grpc-go 1.82.1`. The Caddy edge, backup image, and optional +MinIO images build upstream Caddy `v2.11.4`, restic `v0.19.1`, MinIO, and `mc` +with the same dependency pin. Those upstream dependency graphs still contain +older `grpc-go` versions affected by [GHSA-hrxh-6v49-42gf](https://github.com/advisories/GHSA-hrxh-6v49-42gf). Four deployment settings in the ignored environment select the runtime without