Address vulnerabilities in Mettle repo (#351)

* Cherry-pick dependency-update commits to bump dependencies to latest version and fix merge conflict.
* Switches health registration to the official grpc health server implementation compatible with newer grpc
* Adds the missing grpc health build dependency
* Fixes a go.sum module path typo for cloud.google.com/go/longrunning
* Note: In grpc v1.79.3, the HealthServer interface added a new List method and changed the Watch signature, making existing custom health server implementations incompatible. So this PR replace direct registration of custom servers with the official health.NewServer() implementation and update BUILD dependencies accordingly.

Author: scyyx5

flair/rpc/rpc.go

@@ -49,6 +49,11 @@ func ServeForever(opts grpcutil.Opts, casReplicator, assetReplicator, executorRe
 		bytestreamRe:    regexp.MustCompile("(?:uploads/[0-9a-f-]+/)?(blobs|compressed-blobs/zstd)/([0-9a-f]+)/([0-9]+)"),
 		timeout:         timeout,
 	}
+	healthSrv := &healthServer{
+		replicator:      casReplicator,
+		assetReplicator: assetReplicator,
+		exeReplicator:   executorReplicator,
+	}
 	opts.NoHealth = true // We will do this ourselves.
 	lis, s := grpcutil.NewServer(opts)
 	pb.RegisterCapabilitiesServer(s, srv)
@@ -62,7 +67,7 @@ func ServeForever(opts grpcutil.Opts, casReplicator, assetReplicator, executorRe
 		pb.RegisterExecutionServer(s, srv)
 	}
 	ppb.RegisterGCServer(s, srv)
-	hpb.RegisterHealthServer(s, srv)
+	hpb.RegisterHealthServer(s, healthSrv)
 	grpcutil.ServeForever(lis, s)
 }
 
@@ -73,7 +78,15 @@ type server struct {
 	timeout                                    time.Duration
 }
 
-func (s *server) Check(context.Context, *hpb.HealthCheckRequest) (*hpb.HealthCheckResponse, error) {
+// healthServer is a separate struct (rather than embedding hpb.UnimplementedHealthServer into server)
+// because ppb.UnimplementedGCServer and hpb.UnimplementedHealthServer both define a List method with
+// different signatures, which would cause a compile-time conflict.
+type healthServer struct {
+	hpb.UnimplementedHealthServer
+	replicator, assetReplicator, exeReplicator *trie.Replicator
+}
+
+func (s *healthServer) Check(context.Context, *hpb.HealthCheckRequest) (*hpb.HealthCheckResponse, error) {
 	for _, r := range []*trie.Replicator{s.replicator, s.assetReplicator, s.exeReplicator} {
 		if r != nil {
 			if err := r.Healthcheck(); err != nil {
@@ -86,10 +99,6 @@ func (s *server) Check(context.Context, *hpb.HealthCheckRequest) (*hpb.HealthChe
 	return &hpb.HealthCheckResponse{Status: hpb.HealthCheckResponse_SERVING}, nil
 }
 
-func (s *server) Watch(*hpb.HealthCheckRequest, hpb.Health_WatchServer) error {
-	return status.Errorf(codes.Unimplemented, "grpc_health_v1.Watch not implemented")
-}
-
 func (s *server) GetCapabilities(ctx context.Context, req *pb.GetCapabilitiesRequest) (*pb.ServerCapabilities, error) {
 	// This always does the same thing as Elan.
 	// We might consider upping some of the size limits though since it will multiplex batch requests so will be more

go.mod

@@ -1,6 +1,6 @@
 module github.com/thought-machine/please-servers
 
-go 1.22
+go 1.24.0
 
 require (
 	cloud.google.com/go/profiler v0.4.0
@@ -11,13 +11,11 @@ require (
 	github.com/dgraph-io/ristretto v0.1.1
 	github.com/dustin/go-humanize v1.0.1
 	github.com/go-redis/redis/v8 v8.11.5
-	github.com/golang/protobuf v1.5.3
-	github.com/golang/snappy v0.0.4 // This is a required dep that Go mod tidy gets rid of. This breaks Please if it gets removed though.
-	github.com/google/go-cmp v0.6.0 // This is a required dep that Go mod tidy gets rid of. This breaks Please if it gets removed though.
+	github.com/golang/protobuf v1.5.4
 	github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.0
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.1
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/go-retryablehttp v0.7.5
+	github.com/hashicorp/go-retryablehttp v0.7.7
 	github.com/klauspost/compress v1.17.4
 	github.com/mostynb/go-grpc-compression v1.2.2
 	github.com/peterebden/go-cli-init/v4 v4.0.2
@@ -27,42 +25,41 @@ require (
 	github.com/prometheus/common v0.45.0
 	github.com/shirou/gopsutil v3.21.11+incompatible
 	github.com/sirupsen/logrus v1.9.3
-	github.com/stretchr/testify v1.8.4
+	github.com/stretchr/testify v1.11.1
 	github.com/thought-machine/http-admin v1.1.1
 	go.uber.org/automaxprocs v1.5.3
 	gocloud.dev v0.36.0
-	golang.org/x/crypto v0.17.0
+	golang.org/x/crypto v0.46.0
 	golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc
-	golang.org/x/sync v0.6.0
+	golang.org/x/sync v0.19.0
 	golang.org/x/time v0.5.0
 	google.golang.org/api v0.155.0
 	google.golang.org/genproto v0.0.0-20240102182953-50ed04b92917
 	google.golang.org/genproto/googleapis/bytestream v0.0.0-20240102182953-50ed04b92917
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917
-	google.golang.org/grpc v1.60.1
-	google.golang.org/protobuf v1.33.0
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217
+	google.golang.org/grpc v1.79.3
+	google.golang.org/protobuf v1.36.10
 	gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473
 )
 
 require (
 	cloud.google.com/go v0.111.0 // indirect
-	cloud.google.com/go/compute v1.23.3 // indirect
-	cloud.google.com/go/compute/metadata v0.2.3 // indirect
+	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	cloud.google.com/go/iam v1.1.5 // indirect
 	cloud.google.com/go/longrunning v0.5.4 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/golang/glog v1.2.0 // indirect
+	github.com/golang/glog v1.2.5 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/pprof v0.0.0-20231229205709-960ae82b1e42 // indirect
 	github.com/google/s2a-go v0.1.7 // indirect
-	github.com/google/uuid v1.5.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/google/wire v0.5.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
 	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
@@ -80,19 +77,19 @@ require (
 	github.com/thought-machine/go-flags v1.6.3 // indirect
 	github.com/yusufpapurcu/wmi v1.2.3 // indirect
 	go.opencensus.io v0.24.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 // indirect
-	go.opentelemetry.io/otel v1.21.0 // indirect
-	go.opentelemetry.io/otel/metric v1.21.0 // indirect
-	go.opentelemetry.io/otel/trace v1.21.0 // indirect
-	golang.org/x/net v0.19.0 // indirect
-	golang.org/x/oauth2 v0.15.0 // indirect
-	golang.org/x/sys v0.16.0 // indirect
-	golang.org/x/term v0.16.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
+	go.opentelemetry.io/otel v1.39.0 // indirect
+	go.opentelemetry.io/otel/metric v1.39.0 // indirect
+	go.opentelemetry.io/otel/trace v1.39.0 // indirect
+	golang.org/x/net v0.48.0 // indirect
+	golang.org/x/oauth2 v0.34.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )