gitlab-secret_detection 0.22.0 → 0.23.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23f339cfa15de4a60b7dd0f41c5ffbf8cf171b07c7dcee144a6a022b037bd3d2
-  data.tar.gz: 28172d767a70c1d653aa35f44227ebea4819136238288b69e740eeb5e47b428d
+  metadata.gz: 2a12149b2a289bb2642f51bfde52aa4ca223918505b0272e3d5710aeaf387a70
+  data.tar.gz: f734162a3d851466bb771aa85db9ae7aec620e3d075cc25884e7da3574dadcbf
 SHA512:
-  metadata.gz: 31df0221c0faad763b2539c511a9c75b45e151457849c1eac1bcf481e87cbdbc9c137088244a202daeb464dfd7b248119d0262748de6e703ec9afe48cf5e8e1c
-  data.tar.gz: 93f90609fcabb34094786caffb1a1a8b925d1fb91882b301cc7f5f556e8a4264d6d0502b6f532a7462a5317051306830a71b4a495cb908a3cd60f6e35fdb30a3
+  metadata.gz: a6a963979c92466e950d7001edaee12653c60518af8cae79225f69c419dcf96033a4c35b1d9fe2952044f99813280b2cd11a79614d66f00976f954e1677e4bef
+  data.tar.gz: 6ff3fd914a208217772861d2538a1407d0bfc1308ebe6eb8a7fbacb57de7064fb846c3705eb20543f033c68efc87056824e0e6d4c6b0f0544bebe95144db7a3a

data/lib/gitlab/secret_detection/core/secret_push_protection_rules.toml

@@ -1,5 +1,14 @@
-# rule-set version: 0.8.0
+# rule-set version: 0.9.0
 # Rules are auto-generated. See https://gitlab.com/gitlab-org/security-products/secret-detection/secret-detection-rules for instructions on updating the rules.
+[[rules]]
+id = 'Adobe Client Secret'
+regex = '\b(p8e-)[a-zA-Z0-9]{32}\b'
+description = "An Adobe client secret was detected. Adobe client secrets are used to connect to various API or webhook event based\nservices. Depending on which type of service was defined for a project, a malicious actor with access to the secret can\nuse it to gain access to various APIs or events that may contain sensitive information."
+title = 'Adobe client secret'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nRemediation steps depend on which type of client secret was leaked, please see the following\ntypes of remediation steps below and use the one that applies to the secret that was detected.\n\nOAuth (Server-to-Server):\n\n- Sign in to your account at <https://developer.adobe.com/console>\n- Select the project or \"All projects\" to find the project that is impacted\n- On the left-hand side, under \"Credentials\", select \"OAuth Server-to-Server\"\n- Under \"Client Secret\" select \"Retrieve client secret\"\n- After the table of secrets is visible, below the table, select \"Add new client secret\"\n- After the new secret has been created, find the leaked token value and select the trash icon to remove it\n- Copy the secret value and update all services with the new client secret\n\nOAuth Web App (Event based project):\n\n- Sign in to your account at <https://developer.adobe.com/console>\n- Select the project or select \"All projects\" to find the project that is impacted\n- On the left-hand side, under \"Credentials\", select \"OAuth Web App\".\n- Select \"Retrieve client secret\"\n- Verify this is the leaked secret\n- If this project is configured for events, copy all event details before removing it. You can do this by finding the\n  event listed on the right hand side and selecting on it. You should be brought to a dashboard that shows its details\n  such as event delivery methods, providers, subscribed events, and connected Credentials.\n- To remove the event, select \"...\" in the event, which is on the right hand side of the project page, above\n  \"Connect another service\".\n  - Select \"remove\"\n  - When prompted, type in the project name and select \"Delete Events Registration\"\n- In the top right-hand corner, select \"Delete credential\"\n  - When prompted, type in the project name and select \"Delete Credential\"\n- Re-add the event with the same details as before\n  - When prompted to add back the Credentials, be sure to use \"User Authentication\" OAuth\n  - Select \"Web App\" for OAuth 2.0 authentication and authorization\n- After the event has been re-added, under \"Credentials\" on left hand side, select \"OAuth Web App\"\n- Select \"Retrieve client secret\"\n- Copy the secret value and update all services with the new client secret\n\nOAuth Web App (API Service based project):\n\n- Sign in to your account at <https://developer.adobe.com/console>\n- Select the project or select \"All projects\" to find the project that is impacted\n- On the left-hand side, under \"Credentials\", select \"OAuth Web App\"\n- Select \"Retrieve client secret\"\n- If this project is configured for API, select the trash icon \"Remove\" to remove the connected product and service.\n  - When prompted, enter the project name and select \"Remove API\"\n- In the top right-hand corner, select \"Delete credential\"\n  - When prompted, type in the project name and select \"Delete Credential\"\n- Re-add the API with the same details as before\n  - Select \"Web App\" for OAuth 2.0 authentication and authorization\n- After the service has been re-added, on the left-hand side under \"Credentials\", select \"OAuth Web App\"\n- Select \"Retrieve client secret\"\n- Copy the secret value and update all services with the new client secret"
+tags = ['gitlab_blocking']
+keywords = ['p8e-']
+
 [[rules]]
 id = 'anthropic_key'
 regex = '\b(sk-ant-[a-z]{3}\d{2}-[A-Za-z0-9\\-_]{86}-[A-Za-z0-9\\-_]{8})(?:[[:punct:]]|[[:space:]]|[[:blank:]]|$)'
@@ -19,13 +28,31 @@ tags = ['aws', 'revocation_type', 'gitlab_blocking']
 keywords = ['AKIA']
 
 [[rules]]
-id = 'GCP API key'
-regex = "(?i)\\b(AIza[0-9A-Za-z-_]{35})(?:['|\\\"|\\n|\\r|\\s|\\x60|;]|$)"
-description = "A GCP API key was detected. GCP API keys are used to authorize requests from services, not for users. API keys are\ncommonly used for accessing public data anonymously, and are used to associate API requests with the consumer Google\nCloud project for quota and billing. A malicious actor with access to this key can issue requests to Google Cloud\nservices that are billed to the owning account."
-title = 'GCP API key'
-remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke an API key:\n\n- Sign in to your GCP account and go to <https://console.cloud.google.com/apis/credentials>\n- Under the \"Actions\" column of the \"API Keys\" table, select the kebab menu (vertical ellipsis) for the identified key\n- Select \"Delete API Key\"\n- When prompted select \"Delete\" in the \"Delete credential\" dialog\n\nFor more information please see [https://cloud.google.com/docs/authentication/api-keys](https://cloud.google.com/docs/authentication/api-keys)"
-tags = ['gitlab_partner_token', 'revocation_type', 'gitlab_blocking']
-keywords = ['AIza']
+id = 'CircleCIPersonalAccessToken'
+regex = '\bCCIPAT_[a-zA-Z0-9]{22}_[a-f0-9]{40}\b'
+description = "A CircleCI personal access token was identified. Personal access tokens grant the same level of permissions as the user\nthat created the token. A malicious actor with access to this token can impersonate the user and gain access to all\nfeatures and services in CircleCI."
+title = 'CircleCI Personal Access Token'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nFor rotating a Personal Access token:\n\n- In the CircleCI application, go to your User settings.\n- Select \"Personal API Tokens\".\n- Select \"X\" in the Remove column for the token you wish to replace and confirm your deletion.\n- Select \"Create New Token\".\n- In the Token name field, type a new name for the old token you are rotating. It can be the same name given to the old\n  token.\n- Select \"Add API Token\".\n- After the token appears, copy and paste it to another location. It is not possible to view the token again.\n\nFor more information please see their [documentation on rotating personal access tokens](https://circleci.com/docs/managing-api-tokens/#rotating-a-personal-api-token)."
+tags = ['gitlab_blocking']
+keywords = ['CCIPAT_']
+
+[[rules]]
+id = 'ContentfulPersonalAccessToken'
+regex = '\bCFPAT-([a-zA-Z0-9_\-]){43}\b'
+description = "A Contentful personal access token was identified. Personal access tokens are tied to the user who requests them and\ncarry the same permissions, including access to organizations, spaces, and content."
+title = 'Contentful personal access token'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a personal access token:\n\n- Sign in and visit your account profile: <https://app.contentful.com/account/profile/user>\n- Select the \"CMA tokens\" tab in the top menu\n- Identify the token that was detected\n- Select \"Revoke\" in the right hand column\n- Select \"Revoke\" when prompted\n\nFor more information, please see the developer [documentation on personal access tokens](https://www.contentful.com/help/token-management/personal-access-tokens)."
+tags = ['gitlab_blocking']
+keywords = ['CFPAT-']
+
+[[rules]]
+id = 'Doppler API token'
+regex = '\b(dp\.pt\.)[a-zA-Z0-9]{43}\b'
+description = 'Doppler personal access token was detected.'
+title = 'Doppler API token'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke the Doppler personal access token:\n\n- Open and sign in to <https://dashboard.doppler.com/>\n- Select \"Tokens\" on the right-hand side menu\n- Select the \"Personal\" tab\n- Find the personal token and select \"Roll\" in the Action column\n- After the \"Roll Personal Token\" dialog is displayed select \"Roll\"\n- Copy the new token's value\n\nFor more information please see their documentation: <https://docs.doppler.com/docs/start>"
+tags = ['gitlab_blocking']
+keywords = ['dp.pt.']
 
 [[rules]]
 id = 'GCP OAuth client secret'
@@ -189,6 +216,15 @@ remediation = "For general guidance on handling security incidents with regards
 tags = ['gitlab_blocking']
 keywords = ['b.AAAAAQ']
 
+[[rules]]
+id = 'Linear API token'
+regex = '\blin_api_[a-zA-Z0-9]{40}\b'
+description = "A Linear API token was identified. Personal API tokens can be used to access Linear's GraphQL API. A malicious actor\nwith access to this token can read or write issues, projects and teams to Linear and any systems the account has been\nintegrated with."
+title = 'Linear API token'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a Linear API token:\n\n- Sign in to your account at <https://linear.app/>\n- Select your organization in the top left corner and select \"Preferences\"\n- In the left-hand menu, select \"API\" under \"My Account\"\n- Find the identified API key in the \"Personal API Keys\" section of the page\n- Select \"Revoke\" next to the identified key\n- When prompted, select \"Revoke\" in the \"Revoke access?\" dialog\n\nFor more information, please see [Linear's documentation on using personal API keys](https://developers.linear.app/docs/graphql/working-with-the-graphql-api#personal-api-keys)."
+tags = ['gitlab_blocking']
+keywords = ['lin_api_']
+
 [[rules]]
 id = 'Mailchimp API key'
 regex = "(?i)mailchimp[a-z0-9_ .\\-,]{0,25}(?:=|>|:=|\\|\\|:|<=|=>|:).{0,5}['\\\"]([a-f0-9]{32}-us20)['\\\"]"
@@ -216,6 +252,15 @@ remediation = "For general guidance on handling security incidents with regards
 tags = ['gitlab_blocking']
 keywords = ['mailgun']
 
+[[rules]]
+id = 'MaxMind License Key'
+regex = '\b([a-zA-Z0-9]{6}_[a-zA-Z0-9]{29}_mmk)\b'
+description = 'MaxMind License Key'
+title = 'MaxMind License Key'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet)."
+tags = ['gitlab_blocking']
+keywords = ['_mmk']
+
 [[rules]]
 id = 'New Relic user API Key'
 regex = "['\\\"](NRAK-[A-Z0-9]{27})['\\\"]"
@@ -243,6 +288,33 @@ remediation = "For general guidance on handling security incidents with regards
 tags = ['gitlab_blocking']
 keywords = ['npm_']
 
+[[rules]]
+id = 'Onfido Live API Token'
+regex = '\bapi_live(?:_[a-z]{2})?\.[_a-zA-Z0-9]{11}\.[-_a-zA-Z0-9]{32}\b'
+description = 'Onfido Live API Token'
+title = 'Onfido Live API Token'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet)."
+tags = ['gitlab_blocking']
+keywords = ['api_live']
+
+[[rules]]
+id = 'Planetscale password'
+regex = '\bpscale_pw_[a-zA-Z0-9]{43}\b'
+description = "A PlanetScale password was identified. PlanetScale passwords are used to connect to database instances. A malicious\nactor with access to this password can access PlanetScale managed databases."
+title = 'PlanetScale password'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nFor more information, please see [PlanetScale's documentation on database connection strings](https://planetscale.com/docs/concepts/connection-strings)."
+tags = ['gitlab_blocking']
+keywords = ['pscale_pw_']
+
+[[rules]]
+id = 'Planetscale API token'
+regex = '\bpscale_tkn_[a-zA-Z0-9\-_]{43}\b'
+description = "A PlanetScale API service token was identified. Service tokens are created and assigned permissions depending on the\nallowed scope. A malicious actor with access to the service token is granted the same permissions that were assigned to\nthis service token."
+title = 'PlanetScale API token'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a service token:\n\n- Sign in to your PlanetScale account and access <https://app.planetscale.com/>.\n- From the menu on the left-hand side, select \"Settings\"\n- Under \"Settings\", select \"Service tokens\"\n- Find the identified security token and select its name\n- Take note of its organization access, permissions and scope\n- Select \"Delete service token\" in the top right corner\n- When prompted, select \"Delete\" in the \"Delete service token\" dialog\n\nFor more information, please see [PlanetScale's documentation on service tokens](https://planetscale.com/docs/concepts/service-tokens)."
+tags = ['gitlab_blocking']
+keywords = ['pscale_tkn_']
+
 [[rules]]
 id = 'PyPI upload token'
 regex = 'pypi-AgEIcHlwaS5vcmc[A-Za-z0-9-_]{50,1000}'
@@ -279,6 +351,33 @@ remediation = "For general guidance on handling security incidents with regards
 tags = ['gitlab_blocking']
 keywords = ['SG.']
 
+[[rules]]
+id = 'Sendinblue API token'
+regex = '\bxkeysib-[a-f0-9]{64}-[a-zA-Z0-9]{16}\b'
+description = 'Brevo API token'
+title = 'Brevo API token'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet)."
+tags = ['gitlab_blocking']
+keywords = ['xkeysib-']
+
+[[rules]]
+id = 'Sendinblue SMTP token'
+regex = '\bxsmtpsib-[a-f0-9]{64}-[a-zA-Z0-9]{16}\b'
+description = 'Brevo SMTP token'
+title = 'Brevo SMTP token'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet)."
+tags = ['gitlab_blocking']
+keywords = ['xsmtpsib-']
+
+[[rules]]
+id = 'Shippo API token'
+regex = '\bshippo_live_[a-f0-9]{40}\b'
+description = "A live Shippo API token was identified. API tokens can be used to access the Shippo API which is used for shipping services.\nA malicious actor with access to this token can access billing and order information and modify shipping data."
+title = 'Shippo API token'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke an API token:\n\n- Sign in to your Shippo account and access <https://apps.goshippo.com/>\n- In the top right-hand side, select the \"gear\" icon to go to the \"Settings\" page\n- Scroll down in the left hand menu to \"Advanced\" and select \"API\"\n- Under the \"Token\" section, select \"Manage your token\"\n- Find the identified token and select the trash icon\n- When prompted, select \"Yes, remove token\" in the \"Manage Your Tokens\" dialog\n\nFor more information, please see [Shippo's documentation on API keys](https://portal.goshippo.com/api-config/api)."
+tags = ['gitlab_blocking']
+keywords = ['shippo_live_']
+
 [[rules]]
 id = 'Shopify shared secret'
 regex = 'shpss_[a-fA-F0-9]{32}'
@@ -325,10 +424,37 @@ tags = ['gitlab_blocking']
 keywords = ['xoxb', 'xoxa', 'xoxp', 'xoxr', 'xoxs']
 
 [[rules]]
-id = 'Stripe'
-regex = '(?i)(?:sk|pk)_(?:test|live)_[0-9a-z]{10,32}'
-description = 'Stripe'
-title = 'Stripe key'
-remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nFor more information, please see [Stripe's documentation on API keys](https://docs.stripe.com/keys)."
+id = 'SlackAppLevelToken'
+regex = '\bxapp-1-[A-Z0-9]{11}-[0-9]{13}-[a-f0-9]{64}\b'
+description = "A Slack app level token was identified. App level tokens are for use with Slack apps but only with specific APIs, which\nare related to the app across all organizations where the app is installed. Three scope levels can be assigned:\n\n- connections:write: Route your app's interactions and event payloads over WebSockets\n- authorizations:read: View information about your app's authorizations on installed teams\n- app_configurations:write: Configure your application\n\nA malicious actor with access to this token is granted one or more of the above permissions to access the API with for\na specific application."
+title = 'Slack app level token'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a Slack app level token:\n\n- Sign in to Slack and access <https://api.slack.com/apps>\n- Find the application with the identified token and select the name\n- In the left-hand menu, select \"Basic Information\"\n- Scroll down to the \"App-Level Tokens\" section and select the token name of the identified token\n- In the token dialog, select \"Revoke\"\n- When prompted, select \"Yes, I'm sure\" in the \"Are you sure?\" dialog"
+tags = ['gitlab_blocking']
+keywords = ['xapp-1-']
+
+[[rules]]
+id = 'StripeLiveSecretKey'
+regex = '\bsk_live_[A-Za-z0-9]{99}\b'
+description = "A Stripe live secret key was identified. Live secret keys authenticate requests on your server when in\nlive mode. By default, you can use this key to perform any API request without restriction. A malicious actor who gained\naccess to this key could gain read/write access to all data in Stripe for this account."
+title = 'Stripe live secret key'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo rotate your Stripe live secret key:\n\n- Sign in to your Stripe account and access <https://dashboard.stripe.com/apikeys>\n- Ensure \"Test mode\" is disabled\n- In the \"Standard keys\" section, find the key that was identified and select the ellipsis in the right-hand side\n- Select \"Roll key...\"\n- In the \"Roll API key\" dialog, select an expiration date, for example \"now\"\n- Select \"Roll API Key\"\n\nFor more information, please see [Stripe's documentation on rotating API keys](https://docs.stripe.com/keys#rolling-keys)."
+tags = ['gitlab_blocking']
+keywords = ['sk_live_']
+
+[[rules]]
+id = 'StripeLiveRestrictedKey'
+regex = '\brk_live_[A-Za-z0-9]{99}\b'
+description = "A Stripe live restricted key was identified. Restricted keys offer greater security by only allowing read or write\naccess to specific API resources. A malicious actor with access to this key is limited by the scope defined for the key."
+title = 'Stripe live restricted key'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo rotate your Stripe live restricted key:\n\n- Sign in to your Stripe account and access <https://dashboard.stripe.com/apikeys>\n- Ensure \"Test mode\" is disabled\n- In the \"Restricted keys\" section, find the key that was identified and select the ellipsis in the right-hand side\n- Select \"Roll key...\"\n- In the \"Roll API key\" dialog, select an expiration date, for example \"now\"\n- Select \"Roll API Key\"\n\nFor more information, please see [Stripe's documentation on rotating API keys](https://docs.stripe.com/keys#rolling-keys)."
+tags = ['gitlab_blocking']
+keywords = ['rk_live_']
+
+[[rules]]
+id = 'Twilio API Key'
+regex = '\bSK[0-9a-fA-F]{32}\b'
+description = 'Twilio API Key'
+title = 'Twilio API key'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet)."
 tags = ['gitlab_blocking']
-keywords = ['sk_test', 'pk_test', 'sk_live', 'pk_live']
+keywords = ['SK', 'twilio']

data/lib/gitlab/secret_detection/version.rb

@@ -5,7 +5,7 @@ module Gitlab
     class Gem
       # Ensure to maintain the same version in CHANGELOG file.
       # More details available under 'Release Process' section in the README.md file.
-      VERSION = "0.22.0"
+      VERSION = "0.23.0"
 
       # SD_ENV env var is used to determine which environment the
       # server is running. This var is defined in `.runway/env-<env>.yml` files.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-secret_detection
 version: !ruby/object:Gem::Version
-  version: 0.22.0
+  version: 0.23.0
 platform: ruby
 authors:
 - group::secret detection
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-04-01 00:00:00.000000000 Z
+date: 2025-04-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: grpc