google-guest-agent: upgrade google.golang.org/grpc to v1.83.1 to fix CVE-2026-84304
Upgrade google.golang.org/grpc dependency to v1.83.1 and re-vendor Go dependencies via `go mod vendor` to resolve CVE-2026-84304 in app-admin/google-guest-agent.
Provenance:
- CVE-2026-84304: Go module google.golang.org/grpc fixed in v1.83.1, fix commits 7354d9c8debb ("transport: restrict memory overhead of buffering small data frames (#9331)"), 8cfeca0e1ee5 ("Cherry-pick #9331 to v1.83.x (#9333)") (https://github.com/advisories/GHSA-vp52-pcj8-j9qc)
Build adjustments:
- go get google.golang.org/grpc@v1.83.1
- go mod tidy && go mod vendor && go mod verify
BUG=b/580154760
TEST=go mod verify; CGO_ENABLED=0 go build -mod=vendor ./...
RELEASE_NOTE=Fixed CVE-2026-84304 in google-guest-agent.
cos-patch: security-high
Change-Id: Ia97e0b35fe4a13548f86279e456d6da03bc16d91
Reviewed-on: https://cos-review.googlesource.com/c/third_party/google-guest-agent/+/232351
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: He Gao <hegao@google.com>
SLSA-Policy-Verified: SLSA Policy Verification Service <devtools-gerritcodereview-exitgate@google.com>
This repository contains the source code and packaging artifacts for the Google guest agent. These components are installed on Windows and Linux GCE VMs in order to enable GCE platform features.
In the codebase there's a GNU Make based build system with targets to build and test the guest agent.
In order to build both the guest-agent and core_plugins, run
make
To build only one or the other, run the respective make target:
make build cmd/google_guest_agent/google_guest_agent
make build cmd/core_plugin/core_plugin
To run all the go tests, run:
make test
For more targets and info about the build system run:
make help