server: prohibit more than MaxConcurrentStreams handlers from running at once
(CVE-2023-44487).
In addition to this change, applications should ensure they do not leave running
tasks behind related to the RPC before returning from method handlers, or should
enforce appropriate limits on any such work.
- https://github.com/grpc/grpc-go/compare/v1.56.2...v1.56.3
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Manually updating the indirect dependency to force go.etcd.io/etcd/server/v3
to v3.5.5 or up, which is now compatible with go.opentelemetry.io/otel v1.0.0.
With this, we can remove the replace rule for this module.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Some warnings about go1.16 compatibility, so including them here:
+ go mod tidy -modfile=vendor.mod
github.com/docker/cli/cli/registry/client imports
github.com/docker/distribution/registry/api/v2 imports
github.com/gorilla/mux loaded from github.com/gorilla/mux@v1.7.0,
but go 1.16 would select v1.8.0
github.com/docker/cli/cli/compose/loader imports
gopkg.in/yaml.v2 tested by
gopkg.in/yaml.v2.test imports
gopkg.in/check.v1 loaded from gopkg.in/check.v1@v1.0.0-20200227125254-8fa46927fb4f,
but go 1.16 would select v1.0.0-20201130134442-10cb98267c6c
github.com/docker/cli/cli/command imports
github.com/theupdateframework/notary/client tested by
github.com/theupdateframework/notary/client.test imports
github.com/theupdateframework/notary/server imports
github.com/theupdateframework/notary/utils imports
github.com/Shopify/logrus-bugsnag loaded from github.com/Shopify/logrus-bugsnag@v0.0.0-20170309145241-6dbc35f2c30d,
but go 1.16 would select v0.0.0-20171204204709-577dee27f20d
github.com/docker/cli/cli/command imports
github.com/theupdateframework/notary/client tested by
github.com/theupdateframework/notary/client.test imports
github.com/theupdateframework/notary/server/storage imports
gopkg.in/rethinkdb/rethinkdb-go.v6 imports
github.com/opentracing/opentracing-go loaded from github.com/opentracing/opentracing-go@v1.1.0,
but go 1.16 would select v1.2.0
github.com/docker/cli/cli/command imports
github.com/theupdateframework/notary/client tested by
github.com/theupdateframework/notary/client.test imports
github.com/theupdateframework/notary/server/storage imports
gopkg.in/rethinkdb/rethinkdb-go.v6 imports
github.com/opentracing/opentracing-go/ext loaded from github.com/opentracing/opentracing-go@v1.1.0,
but go 1.16 would select v1.2.0
github.com/docker/cli/cli/command imports
github.com/theupdateframework/notary/client tested by
github.com/theupdateframework/notary/client.test imports
github.com/theupdateframework/notary/server/storage imports
gopkg.in/rethinkdb/rethinkdb-go.v6 imports
github.com/opentracing/opentracing-go/log loaded from github.com/opentracing/opentracing-go@v1.1.0,
but go 1.16 would select v1.2.0
github.com/docker/cli/cli/command imports
github.com/theupdateframework/notary/client tested by
github.com/theupdateframework/notary/client.test imports
github.com/theupdateframework/notary/server imports
github.com/theupdateframework/notary/utils imports
github.com/spf13/viper imports
github.com/spf13/afero loaded from github.com/spf13/afero@v1.1.2,
but go 1.16 would select v1.2.2
github.com/docker/cli/cli/command imports
github.com/theupdateframework/notary/client tested by
github.com/theupdateframework/notary/client.test imports
github.com/theupdateframework/notary/server imports
github.com/theupdateframework/notary/utils imports
github.com/spf13/viper imports
github.com/spf13/cast loaded from github.com/spf13/cast@v1.3.0,
but go 1.16 would select v1.3.1
github.com/docker/cli/cli/command imports
github.com/theupdateframework/notary/client tested by
github.com/theupdateframework/notary/client.test imports
github.com/theupdateframework/notary/server imports
github.com/theupdateframework/notary/utils imports
github.com/spf13/viper imports
github.com/spf13/jwalterweatherman loaded from github.com/spf13/jwalterweatherman@v1.0.0,
but go 1.16 would select v1.1.0
github.com/docker/cli/cli/command imports
github.com/theupdateframework/notary/client tested by
github.com/theupdateframework/notary/client.test imports
github.com/theupdateframework/notary/server imports
github.com/theupdateframework/notary/utils imports
github.com/spf13/viper imports
gopkg.in/ini.v1 loaded from gopkg.in/ini.v1@v1.51.0,
but go 1.16 would select v1.56.0
github.com/docker/cli/cli/command imports
github.com/theupdateframework/notary/client tested by
github.com/theupdateframework/notary/client.test imports
github.com/theupdateframework/notary/server imports
github.com/theupdateframework/notary/utils imports
github.com/spf13/viper imports
github.com/spf13/afero imports
github.com/spf13/afero/mem loaded from github.com/spf13/afero@v1.1.2,
but go 1.16 would select v1.2.2
To upgrade to the versions selected by go 1.16:
go mod tidy -go=1.16 && go mod tidy -go=1.17
If reproducibility with go 1.16 is not needed:
go mod tidy -compat=1.17
For other options, see:
https://golang.org/doc/modules/pruning
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: https://github.com/grpc/grpc-go/compare/v1.23.0...v1.23.1
- grpc/grpc-go#3018 server: set and advertise max frame size of 16KB
- grpc/grpc-go#3017 grpclb: fix deadlock in grpclb connection cache
- Before the fix, if the timer to remove a SubConn fires at the
same time NewSubConn cancels the timer, it caused a mutex leak
and deadlock.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sebastiaan van Stijn
CrazyMax
Tibor Vass
Vincent Demeester
Tonis Tiigi
Daniel Nephin