[gominimal-pkgmgr-mgr]

Update grpc 1.83.1 → 1.84.0

Source: github:grpc/grpc
Release: https://github.com/grpc/grpc/releases/tag/v1.84.0
Changelog: grpc/grpc@v1.83.1...v1.84.0
Released: 28 days ago (2026-09-11)

Pkgscan: clean — diff against the prior version surfaced no newly-introduced suspicious patterns.

Components changed

CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)

	Component	Old	New
~	grpc	1.83.1	1.84.0
~	grpc-upstream	1.83.1	1.84.0

Changes

	Old	New
Version	1.83.1	1.84.0
SHA256	60caa8397426d8a5...	17a4d25717f4871e...
Size		16.4 MB
Source	https://github.com/grpc/grpc/archive/refs/tags/v1.83.1.tar.gz	https://github.com/grpc/grpc/archive/refs/tags/v1.84.0.tar.gz

• License: Apache-2.0 (source: GitHub)

---

Created by pkgmgr

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 14642a70-e354-4a61-94d2-7f21fc843077

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[mitodrummer]

The minimal build fails on both arches because grpc 1.84.0 adds third_party/grpc-proto as a new git submodule (url github.com/grpc/grpc-proto, pinned at ec30f589e2519d595688b9a42f88a91bdd6b733f), and GitHub's archive tarball leaves submodule directories empty, so CMake can't find third_party/grpc-proto/grpc/reflection/v1/reflection.proto. The bump can't merge as-is. Add a second Source for grpc/grpc-proto at that commit and place it at third_party/grpc-proto before configure (or in build.sh), then re-run the build.

[bryan-minimal]

@mitodrummer thanks, that diagnosis was spot on. Fixed in 2a09671, as you suggested:

• build.ncl: a second Source for grpc/grpc-proto at ec30f589e2519d595688b9a42f88a91bdd6b733f, the commit git ls-tree v1.84.0 third_party/grpc-proto points the submodule to. The sha256 is the one grpc's own CMakeLists.txt records for that archive.
• build.sh: unpacks it into third_party/grpc-proto before configure, then fails closed with test -f third_party/grpc-proto/grpc/reflection/v1/reflection.proto.

It's green on both arches now (minimal build and minimal-check, plus closure and the report checks). The last commit, 36a274c, is only a no-op to rebuild against current main.

One follow-up for the next bump: pkgmgr's updater rewrites only the first sha256, so the grpc-proto pin won't move on its own. The build.ncl comment says to re-check it on every bump.

Could you take another look?