Skip to content

chore: bump vendor/zoekt to upgrade gRPC-Go to v1.82.1#1503

Merged
jsourcebot merged 2 commits into
mainfrom
jack/fix-SOU-1567
Jul 24, 2026
Merged

chore: bump vendor/zoekt to upgrade gRPC-Go to v1.82.1#1503
jsourcebot merged 2 commits into
mainfrom
jack/fix-SOU-1567

Conversation

@jsourcebot

@jsourcebot jsourcebot commented Jul 24, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Fixes SOU-1567

Summary

Advances vendor/zoekt from 58f59f1 to 0e0e62b, the merge commit from sourcebot-dev/zoekt#17. This upgrades google.golang.org/grpc from vulnerable v1.80.0 to patched v1.82.1 for GHSA-hrxh-6v49-42gf.

The Sourcebot change is pointer-only; the Zoekt dependency change is limited to go.mod and go.sum.

Verification

  • Zoekt: go test ./...
  • Zoekt: go build ./...
  • Sourcebot: make zoekt
  • Built zoekt-webserver module metadata reports google.golang.org/grpc v1.82.1

Note

Low Risk
Pointer-only submodule bump with a targeted Go dependency upgrade in Zoekt; no application logic changes in the visible diff.

Overview
Bumps the vendor/zoekt submodule so the bundled Zoekt stack picks up google.golang.org/grpc v1.82.1 (from v1.80.0), addressing GHSA-hrxh-6v49-42gf. The Sourcebot-side change is a submodule pointer update; the dependency bump lives in the forked Zoekt go.mod / go.sum.

Documents the fix under [Unreleased] → Fixed in CHANGELOG.md.

Reviewed by Cursor Bugbot for commit d12a511. Bugbot is set up for automated code reviews on this repo. Configure here.

Summary by CodeRabbit

  • Bug Fixes
    • Updated the bundled Zoekt gRPC-Go component to version 1.82.1.
    • Includes upstream fixes and improvements from the updated Zoekt revision.

@jsourcebot
chore: bump zoekt submodule for gRPC security fix
5806d64 
Advance vendor/zoekt to sourcebot-dev/zoekt#17, upgrading google.golang.org/grpc from v1.80.0 to v1.82.1 to address GHSA-hrxh-6v49-42gf.
@github-actions

This comment has been minimized.

Sign in to view
@coderabbitai

coderabbitai Bot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f4385636-d2ab-41a7-a7c8-9a743a0ef428

📥 Commits

Reviewing files that changed from the base of the PR and between 8c74f1f and d12a511.

📒 Files selected for processing (2)
  • CHANGELOG.md
  • vendor/zoekt

Walkthrough

The vendored Zoekt submodule reference is updated to a newer upstream commit, and the unreleased changelog records the bundled Zoekt gRPC-Go dependency upgrade to v1.82.1.

Changes

Zoekt dependency update

Layer / File(s) Summary
Update Zoekt dependency and changelog
vendor/zoekt, CHANGELOG.md		 The Zoekt submodule pointer advances to a new upstream commit, and the unreleased changelog adds the corresponding gRPC-Go upgrade entry.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

Suggested reviewers: brendan-kellam, msukkari

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and accurately summarizes the main change: bumping vendor/zoekt to upgrade gRPC-Go to v1.82.1.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch jack/fix-SOU-1567

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@jsourcebot
jsourcebot requested a review from msukkari July 24, 2026 03:13
@jsourcebot

jsourcebot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

@msukkari could you please review this final SOU-1567 integration? It advances vendor/zoekt to the merge commit from the Zoekt PR you approved. All Sourcebot checks pass, including the production Docker build, and the built binary reports google.golang.org/grpc v1.82.1.

@jsourcebot

jsourcebot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

@brendan-kellam could you please review this small final SOU-1567 integration when available? It advances vendor/zoekt to the already-merged Zoekt security upgrade; all Sourcebot checks pass, including the production Docker build.

@jsourcebot
jsourcebot merged commit 7fad965 into main Jul 24, 2026
11 checks passed
@jsourcebot
jsourcebot deleted the jack/fix-SOU-1567 branch July 24, 2026 03:18
@github-actions github-actions Bot mentioned this pull request Jul 24, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@msukkari msukkari msukkari approved these changes
@brendan-kellam brendan-kellam Awaiting requested review from brendan-kellam

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jsourcebot @msukkari