Bump google.golang.org/grpc from 1.57.1 to 1.79.3

[cdesiniotis]

No description provided.

[tariq1890]

The grpc dependency is indirect. Do we know which direct dependency of the toolkit brings grpc to the dependency tree?

[coveralls]

Coverage Report for CI Build 25688988089

Coverage remained the same at 43.325%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	14862
Covered Lines:	6439
Line Coverage:	43.33%
Coverage Strength:	0.48 hits per line

---

💛 - Coveralls

[cdesiniotis]

The grpc dependency is indirect. Do we know which direct dependency of the toolkit brings grpc to the dependency tree?

github.com/containerd/nri/pkg/api which unfortunately has not updated the grpc dependency yet https://github.com/containerd/nri/blob/520641efc61c07ccb5a39b13dcfe5598ab1f9ab9/go.mod#L20. There is a critical CVE in this package which will block our release.

[tariq1890]

Got it. Thanks for the context. Let me take a look at the NRI repo and see how grpc is used here (my impression was that NRI uses ttrpc and not grpc). We might need to run a quick test to ensure the NRI plugin feature isn't impacted by this

[tariq1890]

This is a safe bump

[cdesiniotis]

Thanks for checking!