#1127420 grpc: ancient version outdated for years, open security issues for years

Package:
src:grpc
Source:
src:grpc
Submitter:
Ansgar
Date:
2026-09-17 18:01:01 UTC
Severity:
normal
#1127420#5
Date:
2026-02-08 12:56:05 UTC
From:
To:
grpc 1.51.1 was released in 2022[1], even 1.59.5 in experimental was
released back in 2024[2] and misses various features. The current
release is 1.78.0 release in 2026-01[3].

The version currently in Debian has various open security issues that
have no reponse[4][5][6][7][8][9] despite being open for multiple
years.

I don't think grpc should be released in Debian in its current state.

Ansgar

  [1]: https://github.com/grpc/grpc/releases/tag/v1.51.1
  [2]: https://github.com/grpc/grpc/releases/tag/v1.59.5
  [3]: https://github.com/grpc/grpc/releases/tag/v1.78.0
  [4]: https://bugs.debian.org/1059279
  [5]: https://bugs.debian.org/1059280
  [6]: https://bugs.debian.org/1059281
  [7]: https://bugs.debian.org/1074421
  [8]: https://bugs.debian.org/1088806
  [9]: https://bugs.debian.org/1082856
#1127420#10
Date:
2026-09-17 17:33:20 UTC
From:
To:
Hi Laszlo and Ansgar,

I maintain buildbox, one of grpc's reverse-dependencies and am concerned
about losing grpc from Debian forky on account of this and other RC bugs.

I note that 1.83.0-1 is now in experimental, but the packaging is not
updated in Salsa. Is there anything I can do to help get 1.83.0-1 into
forky, please? I would be glad to assist with getting the package in a
healthier state, but would require a sponsor for any uploads.

Thanks and kind regards,

Theodore