nic-6443 opened a new pull request, #14195: URL: https://github.com/apache/apisix/pull/14195
This bumps the test-only dependencies that currently have open Dependabot alerts. None of them ship in the runtime; they are the gRPC test servers and the node test suite under `t/`. `t/grpc_server_example` and `t/plugin/grpc-web` move `google.golang.org/grpc` to v1.84.0 (alerts want >= 1.83.1). v1.84.0 still declares `go 1.25.0`, so the go directive and the Go 1.25 provisioning in `ci/linux_openresty_common_runner.sh` / `ci/redhat-ci.sh` stay as they are; v1.85.0 would have forced go 1.26. `grpc_server_example` was still on grpc v1.53.0 with the old monolithic `google.golang.org/genproto`, which now resolves to the `googleapis/rpc` submodule instead. The grpc jump surfaced two fixture problems that the old version tolerated: - `SayHelloAfterDelay`: with recent grpc-go, once the deadline expires the transport sends RST_STREAM(CANCEL) before the handler returns, so nginx logs `upstream rejected request with error 8` and answers 502 instead of 504 (`grpc-transcode.t` TEST 18). The handler now returns `DeadlineExceeded` 100ms before the deadline so the server still writes a proper trailer. - `t/plugin/grpc-web/req.bin` and the inline base64 bodies in `grpc-web.t` had two stray bytes (`0a 0a`) after a complete 7-byte gRPC frame. grpc-go v1.84 rejects that with `grpc-status: 13 unexpected EOF` (TEST 12 and TEST 18). The bytes are dropped; the corrected payload also passes against the previous v1.79.3 server. On the npm side, `t/package.json` bumps `vitest` to ^5.1.0 (@vitest/mocker), `axios` to ^1.21.1 (follow-redirects >= 1.16.2) and `simple-git` to ^4.0.2 (@simple-git/argv-parser 2.0.1). `vite` is only a transitive dependency of vitest and its range was already satisfied by the locked 8.3.1, so the lockfile is refreshed to vite 8.3.8 without adding an override. The lockfile churn is limited to those trees. No new test cases: the existing suites that use these fixtures are the coverage. `grpc_server_example` is built in `ci/linux_openresty_common_runner.sh` and `ci/redhat-ci.sh` and consumed by the grpc tests in `t/node` (grpc-proxy*, upstream-tls2, upstream-keepalive-pool), `t/plugin` (grpc-transcode*, batch-requests-grpc, proxy-mirror3) and `t/admin/protos-force-delete.t`; `t/plugin/grpc-web` is built by its `setup.sh` and consumed by `t/plugin/grpc-web.t`; the node suite runs through `t/admin/metadata.t`, `t/admin/standalone.t`, `t/node/websocket-proxy.t` and `t/plugin/openapi-to-mcp-interop.t`. All of these run in the `build` workflow matrix (and the RedHat workflow for the grpc ones). No docs change, since nothing user-facing moves. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
