Conversation
github-actions
Bot
changed the base branch from
main
to
raphael/advisory-improvement-9608
September 19, 2026 06:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The current affected-version interval includes released gRPC-Go v1.84.0 even though that release contains the fix for GHSA-2v4p-qf9q-27wj. Split the development-version interval by release branch so fixed v1.84.0 is excluded while unpatched 1.84 and 1.85 development versions remain affected.
The current interval starts at
1.84.0-devand ends at1.85.0-dev.0.20260825072537-93e31b48545e. Version ordering places stable1.84.0inside that interval. However, backport PR #9370 cherry-picked the original fix intov1.84.xasd5a41119e0e3. That commit is an ancestor of the v1.84.0 release, three commits before its exact tag targete84aa5ab15d1d2b29d54f838312ad490cb7551a8.The corrected development ranges are:
1.84.0-dev1.84.0-dev.0.20260825144003-d5a41119e0e31.85.0-dev1.85.0-dev.0.20260825072537-93e31b48545eThe Go module query for the exact backport commit returns the first fixed version above. The second range retains the existing main-branch fix at
93e31b48545e; thev1.85.0-devtag precedes that fix and remains affected. The existing ranges fixed in 1.82.2 and 1.83.2 are unchanged.The final v1.84.0 source still contains both checks: the HTTP/2 transport rejects a request lacking both host and authority before dispatch, and xDS routing rejects an empty authority slice before indexing it. The corresponding transport, routing and end-to-end regression tests are present in that tagged source. This is source and ancestry verification, not a claim that upstream tests were rerun.
Only this advisory changes: the two development ranges, the patch explanation, and public backport/release references. Severity, affected package, existing stable ranges and other metadata remain unchanged. The original JSON formatting, including its missing final newline, is preserved. JSON parsing and applying the patch against the captured advisory both passed. No application code, dependency pin, security-check exemption or migration is involved; advisory consumers can use the corrected ranges after GitHub curates and publishes the update.