chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 in the go_modules group across 1 directory (#36)

* chore(deps): bump google.golang.org/grpc

Bumps the go_modules group with 1 update in the / directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).


Updates `google.golang.org/grpc` from 1.78.0 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <[email protected]>

* Resolve merge conflicts and harden storage paths

Co-authored-by: lukaszraczylo <[email protected]>

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: lukaszraczylo <[email protected]>

pkg/storage/nfs/nfs.go

@@ -130,7 +130,18 @@ func (s *Storage) Put(ctx context.Context, key string, data io.Reader, opts *sto
 		s.logger.Warn().Err(err).Str("key", key).Msg("nfs: post-put path lookup failed; skipping fsync")
 		return nil
 	}
-	f, err := os.OpenFile(path, os.O_RDWR, 0) // #nosec G304 -- path resolved by sanitizing backend
+	relPath, err := relativeToBase(s.path, path)
+	if err != nil {
+		s.logger.Warn().Err(err).Str("key", key).Msg("nfs: post-put path escaped configured base; skipping fsync")
+		return nil
+	}
+	root, err := os.OpenRoot(s.path)
+	if err != nil {
+		s.logger.Warn().Err(err).Str("path", s.path).Msg("nfs: failed to open configured base; skipping fsync")
+		return nil
+	}
+	defer root.Close() // #nosec G307 -- Best-effort cleanup of opened NFS root
+	f, err := root.OpenFile(relPath, os.O_RDWR, 0)
 	if err != nil {
 		s.logger.Warn().Err(err).Str("key", key).Msg("nfs: post-put open failed; skipping fsync")
 		return nil
@@ -226,6 +237,22 @@ func (s *Storage) GetLocalPath(ctx context.Context, key string) (string, error)
 	return s.fs.GetLocalPath(ctx, key)
 }
 
+func relativeToBase(basePath, path string) (string, error) {
+	baseAbs, err := filepath.Abs(basePath)
+	if err != nil {
+		return "", errors.Wrap(err, errors.ErrCodeStorageFailure, "nfs: failed to resolve base path")
+	}
+	pathAbs, err := filepath.Abs(path)
+	if err != nil {
+		return "", errors.Wrap(err, errors.ErrCodeStorageFailure, "nfs: failed to resolve path")
+	}
+	rel, err := filepath.Rel(baseAbs, pathAbs)
+	if err != nil {
+		return "", errors.Wrap(err, errors.ErrCodeStorageFailure, "nfs: failed to compare path")
+	}
+	return rel, nil
+}
+
 // detectMountType returns the filesystem type backing path. Linux-only: on
 // other platforms the second return value is false. Implementation walks
 // /proc/mounts and selects the longest matching mount point, which is the