Skip to content

build(deps): Bump grpcio to 1.84.1 - #723

Merged
NicoHinderling merged 1 commit into
mainfrom
vuln-3216/grpcio-1.84.1
Oct 27, 2026
Merged

NicoHinderling merged 1 commit into
mainfrom
vuln-3216/grpcio-1.84.1

Conversation

@sentry-junior

@sentry-junior sentry-junior Bot commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

Bumps grpcio from 1.81.0 to 1.84.1 for VULN-3216 (eMudhra CA compromise).

grpcio wheels up to 1.84.0 bundle grpc/_cython/_credentials/roots.pem, which includes the compromised emSign ECC Root CA - G3 root. gRPC trusts that bundle for TLS unless GRPC_DEFAULT_SSL_ROOTS_FILE_PATH is set. 1.84.1 drops it.

Files changed: uv.lock, via uv lock --upgrade-package grpcio==1.84.1. Only grpcio changes. grpcio-health-checking (1.71.2) and protobuf (5.29.6) stay put.

Verified: uv lock --check passes. On Python 3.14, grpcio 1.84.1 imports alongside grpcio-health-checking 1.71.2 and protobuf 5.29.6.

Refs VULN-3216

via Geoff Goldsmith.

--

View Junior Session [Sentry]

Co-Authored-By: Geoff Goldsmith <geoff.goldsmith@sentry.io>
@linear-code

linear-code Bot commented Oct 27, 2026

Copy link
Copy Markdown

VULN-3216

@NicoHinderling
NicoHinderling merged commit 48a7885 into main Oct 27, 2026
25 checks passed
@NicoHinderling
NicoHinderling deleted the vuln-3216/grpcio-1.84.1 branch October 27, 2026 19:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant