From 15860ebdbdb69d1db88390a42f57f34f1f3cf37d Mon Sep 17 00:00:00 2001 From: Raghavendra Nataraj Date: Thu, 23 Jul 2026 09:35:13 -0700 Subject: [PATCH] Makefile: drop stale grpc@v1.59.0 pin from bootstrap target The `bootstrap` target ran `go get -u google.golang.org/grpc@v1.59.0`, pinning grpc to v1.59.0. That pin was added in #367 when grpc was at v1.59.0 and never updated after go.mod moved to v1.82.1. Because `bootstrap` is a prerequisite of `generate`/`pipeline`, running either target downgrades the module's grpc back to v1.59.0 (re-introducing already-remediated CVEs) and `gen.sh`'s trailing `go mod tidy` persists the downgrade into go.mod/go.sum. Proto generation does not need the grpc module fetched: rpc/gen_proto.sh emits code via `--go_out=plugins=grpc:`, whose grpc plugin ships inside protoc-gen-go@v1.3.2. The grpc runtime version is governed entirely by go.mod. Removing the line leaves bootstrap installing only protoc-gen-go and keeps grpc at the go.mod-selected v1.82.1. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4a902de7-e15e-494c-b590-1f9e94a5fadd --- Makefile | 1 - 1 file changed, 1 deletion(-) diff --git a/Makefile b/Makefile index 9a6b00a4..b5d56c6b 100644 --- a/Makefile +++ b/Makefile @@ -25,7 +25,6 @@ format: gofmt -s -w rpc/ pkg/ bootstrap: - GOOS="linux" go get -u google.golang.org/grpc@v1.59.0 GOOS="linux" go install github.com/golang/protobuf/protoc-gen-go@v1.3.2 test: unittest