Upgrade vendored grpc to remove vulnerabilities coming from netty
- Dominant language
- Java
- Stars
- 8.7k
- Forks
- 4.7k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 196
Description
Currently we use this version of grpc
https://github.com/apache/beam/blob/15f973f616ec35ec6f5151f1fd8e0450d38bbc81/buildSrc/src/main/groovy/org/apache/beam/gradle/GrpcVendoring_1_69_0.groovy#L35
Along with this, we get Netty version 4.1.110.Final
https://github.com/grpc/grpc-java/blob/v1.69.0/gradle/libs.versions.toml#L2
There are vulnerabilities in this version like CVE-2026-42578, CVE-2026-42587, CVE-2026-42583, CVE-2025-58057, CVE-2025-67735 and many more.
Contributor guide
Research direction
Start with buildSrc/src/main/groovy/org/apache/beam/gradle/GrpcVendoring_1_69_0.groovy and the referenced grpc-java gradle/libs.versions.toml entry to understand the current vendored versions. Identify a compatible grpc upgrade that removes the reported Netty vulnerabilities; done means Beam no longer brings in the vulnerable Netty version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- grpc, java
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100