diff --git a/.gitignore b/.gitignore
index ef05245..32478ba 100644
--- a/.gitignore
+++ b/.gitignore
@@ -47,13 +47,14 @@ go.work
 go.work.sum
 
 # Files produced by run.sh
+*.bak
+*.zip
 kitex_gen/
 kitex_gen_slim/
 kitex_gen_noDefSerdes/
 grpc_gen/
 go.mod
 go.sum
-*.bak
 bin
 thrift_streaming/binaries
 thrift_streaming/kitex_gen/
diff --git a/run.sh b/run.sh
index e07727e..587f92a 100755
--- a/run.sh
+++ b/run.sh
@@ -26,8 +26,17 @@ fi
 
 set -x
 
-PROTOC_OUT=$PWD/bin
-PROTOC_VERSION=v3.13.0 # FIXME: this version doesn't support darwin arm64
+PATH_BIN=$PWD/bin
+mkdir -p $PATH_BIN
+
+export PATH=$PATH_BIN:$PATH
+
+# GOBIN need to be changed here as kitex-tests will install different version bin when testing,
+# GOPATH remains the same as default,
+# coz other runners in the same host may share path like GOMODCACHE, GOCACHE
+export GOBIN=$PATH_BIN
+
+PROTOC_VERSION=v3.20.2
 
 install_protoc() {
     echo "installing protoc ... "
@@ -39,8 +48,7 @@ install_protoc() {
     rm -f $filename
     wget -q $url || exit 1
     unzip -o -q $filename -d ./tmp/
-    mkdir -p $PROTOC_OUT
-    mv ./tmp/bin/protoc $PROTOC_OUT
+    mv ./tmp/bin/protoc $PATH_BIN
     rm -rf ./tmp/
     echo "installing protoc ... done"
 }
@@ -55,8 +63,6 @@ kitex_cmd() {
   kitex --no-dependency-check $@
 }
 
-export PATH=$PROTOC_OUT:$PATH
-
 echo -e "\ninstalling missing commands\n"
 
 # install protoc
@@ -87,12 +93,10 @@ echo -e "\ninstalling missing commands ... done\n"
 
 # double check commands,
 # set -e may not working since commands run in background
-which protoc
-which protoc-gen-go
-which protoc-gen-go-grpc
-which thriftgo
-which kitex
-
+protoc --version
+protoc-gen-go --version
+protoc-gen-go-grpc --version
+thriftgo --version
 kitex -version
 
 rm -f go.mod # go mod init fails if it already exists
diff --git a/thrift_streaming/exitserver/go.mod b/thrift_streaming/exitserver/go.mod
index b11d672..ade2cbb 100644
--- a/thrift_streaming/exitserver/go.mod
+++ b/thrift_streaming/exitserver/go.mod
@@ -42,10 +42,10 @@ require (
 	github.com/tidwall/pretty v1.2.0 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	golang.org/x/arch v0.2.0 // indirect
-	golang.org/x/net v0.0.0-20221014081412-f15817d10f9b // indirect
+	golang.org/x/net v0.23.0 // indirect
 	golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 // indirect
-	golang.org/x/sys v0.0.0-20220817070843-5a390386f1f2 // indirect
-	golang.org/x/text v0.6.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
 	google.golang.org/genproto v0.0.0-20210513213006-bf773b8c8384 // indirect
 	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/thrift_streaming/exitserver/go.sum b/thrift_streaming/exitserver/go.sum
index 1465fcb..977451e 100644
--- a/thrift_streaming/exitserver/go.sum
+++ b/thrift_streaming/exitserver/go.sum
@@ -282,8 +282,9 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20221014081412-f15817d10f9b h1:tvrvnPFcdzp294diPnrdZZZ8XUt2Tyj7svb7X52iDuU=
 golang.org/x/net v0.0.0-20221014081412-f15817d10f9b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
+golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
+golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -318,8 +319,9 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220817070843-5a390386f1f2 h1:fqTvyMIIj+HRzMmnzr9NtpHP6uVpvB5fkHcgPDC4nu8=
 golang.org/x/sys v0.0.0-20220817070843-5a390386f1f2/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -327,8 +329,9 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.6.0 h1:3XmdazWV+ubf7QgHSTWeykHOci5oeekaGJBLkrkaw4k=
 golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
diff --git a/thrift_streaming/exitserver/update_go_mod.sh b/thrift_streaming/exitserver/update_go_mod.sh
index 383e5a2..17f5b93 100755
--- a/thrift_streaming/exitserver/update_go_mod.sh
+++ b/thrift_streaming/exitserver/update_go_mod.sh
@@ -25,6 +25,7 @@ go mod init github.com/cloudwego/kitex-tests/thrift_streaming/exitserver
 # using legacy kitex version on purpose
 go get github.com/cloudwego/kitex@v0.9.0-rc4
 go get github.com/apache/thrift@v0.13.0
+go get golang.org/x/net@v0.23.0 # fix security issues
 go mod edit -replace github.com/apache/thrift=github.com/apache/thrift@v0.13.0
 
 # updating tricky packages to make sure it works ...