[I] [Bug] Upgrade GRPC to 1.79 to remediate CVEs [rocketmq]

["shub-est (via GitHub)" <gi...@apache.org>]

shub-est opened a new issue, #10099:
URL: https://github.com/apache/rocketmq/issues/10099

   ### Before Creating the Bug Report
   
   - [x] I found a bug, not just asking a question, which should be created in [GitHub Discussions](https://github.com/apache/rocketmq/discussions).
   
   - [x] I have searched the [GitHub Issues](https://github.com/apache/rocketmq/issues) and [GitHub Discussions](https://github.com/apache/rocketmq/discussions)  of this repository and believe that this is not a duplicate.
   
   - [x] I have confirmed that this bug belongs to the current repository, not other repositories of RocketMQ.
   
   
   ### Runtime platform environment
   
   All
   
   ### RocketMQ version
   
   develop
   
   ### JDK Version
   
   _No response_
   
   ### Describe the Bug
   
   Upgraded GRPC to 1.79 to remediate CVE-2023-32731, CVE-2023-32732 and CVE-2025-55163
   
   ### Steps to Reproduce
   
   N/A
   
   ### What Did You Expect to See?
   
   N/A
   
   ### What Did You See Instead?
   
   N/A
   
   ### Additional Context
   
   _No response_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] Upgrade GRPC to 1.79 to remediate CVEs [rocketmq]

["RockteMQ-AI (via GitHub)" <gi...@apache.org>]

RockteMQ-AI commented on issue #10099:
URL: https://github.com/apache/rocketmq/issues/10099#issuecomment-5328000823

   **Issue Evaluation**
   
   Category: `enhancement` | Status: **Evaluated**
   
   The gRPC upgrade to 1.79 to remediate CVE-2023-32731, CVE-2023-32732, and CVE-2025-55163 is a valid security improvement.
   
   **Feasibility:** Feasible — gRPC 1.79 should be backward compatible.
   **Scope:** `pom.xml` dependency version bump.
   **Compatibility:** Non-breaking for downstream users.
   
   Note: Coordinate with #10089 (Netty) and #10097 (Protobuf) for a combined dependency upgrade PR.
   
   ---
   *Automated evaluation by RockteMQ-AI*


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org