chore: update dependency @grpc/grpc-js to v1.13.6 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@grpc/grpc-js (source)	1.6.7 → 1.13.6

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

@​grpc/grpc-js can allocate memory for incoming messages well above configured limits

CVE-2024-37168 / GHSA-7v5v-9h63-cj86

More information

Details

Impact

There are two separate code paths in which memory can be allocated per message in excess of the grpc.max_receive_message_length channel option:

1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded.
2. If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded.

Patches

This has been patched in versions 1.10.9, 1.9.15, and 1.8.22

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86
• https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650
• https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3
• https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb
• https://nvd.nist.gov/vuln/detail/CVE-2024-37168
• https://github.com/advisories/GHSA-7v5v-9h63-cj86

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

CVE-2026-48069 / GHSA-99f4-grh7-6pcq

More information

Details

Impact

An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @​grpc/grpc-js

Patches

The following version have fixes for this vulnerability:

• 1.9.16
• 1.10.12
• 1.11.4
• 1.12.7
• 1.13.5
• 1.14.4

Workarounds

There is no workaround.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16
• https://github.com/advisories/GHSA-99f4-grh7-6pcq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​grpc/grpc-js: A malformed request can cause a server crash

CVE-2026-48068 / GHSA-5375-pq7m-f5r2

More information

Details

Impact

An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @​grpc/grpc-js.

Patches

The following version have fixes for this vulnerability:

• 1.9.16
• 1.10.12
• 1.11.4
• 1.12.7
• 1.13.5
• 1.14.4

Workarounds

There is no workaround.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16
• https://github.com/advisories/GHSA-5375-pq7m-f5r2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

CVE-2026-101915 / GHSA-f596-whhp-79r4

More information

Details

Impact

If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers.

Patches

This vulnerability is fixed in 1.13.6 and 1.14.5.

Workarounds

This can be avoided by using a top-level error handler in method handlers to strip out sensitive error information.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4
• https://nvd.nist.gov/vuln/detail/CVE-2026-101915
• https://github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea
• https://github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f
• https://github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d
• https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6
• https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5
• https://github.com/advisories/GHSA-f596-whhp-79r4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

CVE-2026-101916 / GHSA-m9gg-hp2v-232j

More information

Details

Impact

When server credentials are created with the requireClientCertificate option set to false, getAuthContext does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for @grpc/grpc-js users who use the result of getAuthContext for authentication.

In particular, @grpc/grpc-js-xds can both set the requireClientCertificate option to false and use the return value of getAuthContext for RBAC authentication in some configurations.

Patches

This vulenrability is fixed in 1.13.6 and 1.14.5.

Workarounds

@grpc/grpc-js users using getAuthContext this way can avoid this problem by setting requireClientCertificate to true. @grpc/grpc-js-xds users using RBAC can avoid this by setting the require_client_certificate field to true in the DownstreamTlsContext in the xDS configuration.

Severity

• CVSS Score: 7.4 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j
• https://nvd.nist.gov/vuln/detail/CVE-2026-101916
• https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee
• https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c
• https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5
• https://github.com/advisories/GHSA-m9gg-hp2v-232j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

grpc/grpc-node (@​grpc/grpc-js)

v1.13.6: @​grpc/grpc-js 1.13.6

Compare Source

• Fix a bug that caused clients to automatically transmit excessive error details to clients by default (advisory GHSA-f596-whhp-79r4)

v1.13.5: @​grpc/grpc-js 1.13.5

Compare Source

• Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)
• Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

v1.13.4: @​grpc/grpc-js 1.13.4

Compare Source

• Fix ability to set SNI with ssl_target_name_override option (#​2956)

v1.13.3: @​grpc/grpc-js 1.13.3

Compare Source

• Disable Nagle's algorithm (#​2936)
• Avoid calling http2.getDefaultSettings (#​2937)

v1.13.2: @​grpc/grpc-js 1.13.2

Compare Source

• Fix a bug that caused clients to be unable to connect through local proxies (#​2933)

v1.13.1: @​grpc/grpc-js 1.13.1

Compare Source

• Fix a bug that caused the rejectUnauthorized channel credentials option to be handled incorrectly (#​2926)
• Fix a bug that caused the client to never send retries if any retryThrottling config was set (#​2927)
• Fix a bug that caused clients to incorrectly send retries if the feature was disabled by a channel option and a retry config was provided (#​2927)

v1.13.0: @​grpc/grpc-js 1.13.0

Compare Source

Changelog

• Add support for channel option grpc-node.flow_control_window to control HTTP/2 flow control window size (#​2864 contributed by @​rickihastings)
• Show meaningful error messages more consistently when requests fail (#​2868)
• Add support for CIDR blocks in no_proxyenvironment variable (#​2876 contributed by @​melkouri)
• Fix a bug that caused server interceptor sendMetadata methods to not be called if the server interceptor did not explicitly send metadata (#​2897)
• Fix IPv6-mapped IPv4 address parsing in channelz, and represent them as IPv4 addresses (#​2909)

Experimental API changes

Added:

• SecureConnector
• SecureConnectResult
• SUBCHANNEL_ARGS_EXCLUDE_KEY_PREFIX
• Server#experimentalRegisterListenerToChannelz protected method
• ServerexperimentalUnregisterListenerFromChannelz protected method
• Server#experimentalCreateConnectionInjectorWithChannelzRef protected method

Modified:

• LoadBalancer: Removed the ChannelCredentials constructor argument
• LoadBalancer: Removed the ChannelOptions constructor argument
• LoadBalancer#updateAddressList: Replaced the attributes argument with one of type ChannelOptions.
• ChannelControlHelper#createSubchannel: Removed the ChannelCredentials argument
• LeafLoadBalancer: Removed the ChannelCredentials constructor argument

v1.12.7: @​grpc/grpc-js 1.12.7

Compare Source

• Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)
• Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

v1.12.6

Compare Source

• Allow garbage collection of IDLE channels (#​2896)

v1.12.5: @​grpc/grpc-js 1.12.5

Compare Source

• Prioritize HTTP status errors over message decoding errors (#​2873)

v1.12.4: @​grpc/grpc-js 1.12.4

Compare Source

• Prioritize reporting UNAVAILABLE status when handing connection drops (#​2862)

v1.12.3: @​grpc/grpc-js 1.12.3

Compare Source

• Report UNAVAILABLE if possible when handling connection drops (#​2861)

v1.12.2: @​grpc/grpc-js 1.12.2

Compare Source

• Use util.promisify instead of fs/promises for Node 12 compatibility (#​2838)

v1.12.1: @​grpc/grpc-js 1.12.1

Compare Source

• Port bugfixes from 1.11.x into 1.12.x (#​2836)

v1.12.0: @​grpc/grpc-js 1.12.0

Compare Source

Changelog

• Provide the method_name for the CallCredentials callback generateMetadata (#​2814 contributed by @​becoded)
• Add an optional rejectUnauthorized field to the VerifyOptions interface, which can be passed as an argument to credentials.createSsl and createFromSecureContext (#​2812 contributed by @​vinothsa4891)

Experimental API changes

Added:

• CaCertificateUpdate
• CaCertificateUpdateListener
• IdentityCertificateUpdate
• IdentityCertificateUpdateListener
• CertificateProvider
• FileWatcherCertificateProvider
• FileWatcherCertificateProviderConfig
• createCertificateProviderChannelCredentials
• createCertificateProviderServerCredentials

Modified:

• LoadBalancer: The constructor now takes an additional argument of type ChannelCredentials.
• ChannelControlHelper#createSubchannel: Now takes an additional argument of type ChannelCredentials | null. This should be passed along if overriding this function.
• LeafLoadBalancer: The constructor now takes an additional argument of type ChannelCredentials.

v1.11.4: @​grpc/grpc-js 1.11.4

Compare Source

• Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)
• Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

v1.11.3: @​grpc/grpc-js 1.11.3

Compare Source

• Ensure the client queries the name resolver again after connections drop while using the round_robin load balancing policy (#​2825)

v1.11.2: @​grpc/grpc-js 1.11.2

Compare Source

• Fix client crash on receiving a custom error code (#​2801 contributed by @​hastom)
• Report connection errors more consistently (#​2808)
• Avoid computing the channel constructor trace log when that tracer is not enabled (#​2817 contributed by @​ygalbel)

v1.11.1: @​grpc/grpc-js 1.11.1

Compare Source

• Revert a change that used APIs that were not available in early minor versions of Node 14 (#​2799 contributed by @​xqin)

v1.11.0: @​grpc/grpc-js 1.11.0

Compare Source

Changelog

• Add Server connection injection API as described in gRFC L114 (#​2675)
• Implement support for an alternate DNS resolver that supports custom authorities (#​2776 contributed by @​gkampitakis)
• Add a channel option to configure retry attempt limits (#​2795)
• Add a getHost method to server call objects (#​2783, #​2793)
• Fix typos and omissions in service config validation errors (#​2782 contributed by @​matthewbinshtok)

Experimental API changes

Added:

• splitHostPort
• HostPort
• createServerCredentialsWithInterceptors

v1.10.12: @​grpc/grpc-js 1.10.12

Compare Source

• Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)
• Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

v1.10.11: @​grpc/grpc-js 1.10.11

Compare Source

• Fix a bug that caused clients to reconnect unnecessarily while no requests are pending. (#​2784)
• Fix a bug that caused clients to fail to re-establish existing connections while waiting for DNS results (#​2784)
• Fix a bug that caused servers to sometimes not close idle connections depending on timing (#​2790)
• Fix a bug that caused calls to be pending indefinitely while unable to start after a channel is closed (#​2791)

v1.10.10: @​grpc/grpc-js 1.10.10

Compare Source

• Various improvements to handling of keepalive timers (#​2760 by @​davidfiala)
• Fix a bug causing unary response client requests to hang when unexpectedly receiving multiple messages (#​2772)
• Fix a bug causing some requests to fail when making requests through a local proxy (#​2746 contributed by @​mjameswh, backported in #​2777)
• Fix handling of URL-encoded user credentials in proxy configuration (#​2761 contributed by @​brendan-myers, backported in #​2777)
• Fix missing client-side handling of the grpc.max_send_message_length channel option (#​2779)

v1.10.9: @​grpc/grpc-js 1.10.9

Compare Source

• Avoid buffering significantly more than grpc.max_receive_message_size per received message.

v1.10.8: @​grpc/grpc-js 1.10.8

Compare Source

• Fix a bug that caused channels with unix: targets to not reconnect after the channel goes idle (#​2750)

v1.10.7: @​grpc/grpc-js 1.10.7

Compare Source

• Improve reporting of HTTP error codes (#​2723)
• Update dependency on @grpc/proto-loader to the latest version (#​2732)

v1.10.6: @​grpc/grpc-js 1.10.6

Compare Source

• Fix a bug that could cause a server to sometimes send the status early (#​2708)

v1.10.5: @​grpc/grpc-js 1.10.5

Compare Source

• Resolve exception when Error.stackTraceLimit is undefined (#​2701 contributed by @​davidfiala)
• Call configured checkServerIdentity when grpc.ssl_target_name_override is set (#​2704)
• Add more information to DEADLINE_EXCEEDED error details strings (#​2692)

v1.10.4: @​grpc/grpc-js 1.10.4

Compare Source

• Fix a bug that caused server interceptors to crash when using partially-populated ResponderBuilder and ListenerBuilder objects (#​2696)
• Avoid sending RST_STREAM from the client when the server has already finished its side of the stream (#​2695)

v1.10.3: @​grpc/grpc-js 1.10.3

Compare Source

• Revert client reconnection changes in #​2680 (#​2691)

v1.10.2: @​grpc/grpc-js 1.10.2

Compare Source

• Implement server connection idle timeouts and improve channelz performance (#​2677 contributed by @​AVVS)
• Fix a bug that caused clients to automatically reconnect even when there were no active requests (#​2680)
• Modify order of server call events to more closely match pre-1.10.x behavior (#​2683)

v1.10.1: @​grpc/grpc-js 1.10.1

Compare Source

• Fix a bug causing channels using the round_robin LB policy to fail to reconnect after a connection drops (#​2667)

v1.10.0: @​grpc/grpc-js 1.10.0

Compare Source

Changelog

• Add server interceptors support (#​2650) (details in gRFC L112)
• Deprecate Server#start (#​2597) (details in gRFC L107)
• Add Server#unbind (#​2612) (details in gRFC L109)
• Add Server#drain (#​2616) (details in gRFC L111)
• Export type VerifyOptions (#​2637 contributed by @​chakhsu)

Experimental API Changes

• Added:
  • Endpoint
  • endpointToString
  • endpointHasAddress
  • LeafLoadBalancer
  • HealthListener
  • SubchannelInterface#isHealthy
  • SubchannelInterface#addHealthStateWatcher
  • SubchannelInterface#removeHealthStateWatcher
  • SubchannelWrapper#setHealthy
  • selectLbConfigFromList
  • parseLoadBalancingConfig
  • OutlierDetectionRawConfig
  • EndpointMap
• Moved out of the experimental namespace:
  • ServiceConfig
  • MethodConfig
  • LoadBalancingConfig (now a simple raw object type)
  • RetryPolicy
• Removed:
  • getFirstUsableConfig
  • validateLoadBalancingConfig
  • OutlierDetectionLoadBalancingConfig
• Modified:
  • LoadBalancer#updateAddressList: The first argument now has type Endpoint[] instead of SubchannelAddress[]
  • ResolverListener#onSuccessfulResolution: The first argument now has type Endpoint[] instead of SubchannelAddress[]
  • registerLoadBalancerType: The second argument, a LoadBalancerConstructor now takes a second argument options: ChannelOptions
  • ConfigSelector: Now accepts an additional argument channelId: number
  • QueuePicker: The constructor now accepts an additional optional argument childPicker: Picker, which the QueuePicker instance will delegate to if provided.

v1.9.16: @​grpc/grpc-js 1.9.16

Compare Source

• Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)
• Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

v1.9.15: @​grpc/grpc-js 1.9.15

Compare Source

• Avoid buffering significantly more than grpc.max_receive_message_size per received message.

v1.9.14: @​grpc/grpc-js 1.9.14

Compare Source

• Fix a bug that could rarely cause connection leaks (#​2644)
• Fix a bug that could cause clients to go IDLE incorrectly some time after calling waitForReady (#​2643)

v1.9.13: @​grpc/grpc-js 1.9.13

Compare Source

• Fix a bug that could cause the Node process to close early when establishing a connection while a request is pending (#​2626)

v1.9.12: @​grpc/grpc-js 1.9.12

Compare Source

• Fix a bug that could cause connectivity state information to become stale in some circumstances (#​2623)

v1.9.11: @​grpc/grpc-js 1.9.11

Compare Source

• Fix a busy loop when recovering from a failure to establish a connection to a unix domain socket address target (#​2618)
• Fix a bug that caused clients to stop trying to connect to a fixed IP address target after a working connection drops (#​2619)

v1.9.10: @​grpc/grpc-js 1.9.10

Compare Source

• Provide the correct port to the proxy when connecting to a target without an explicitly specified port (#​2608 contributed by @​segevfiner)
• Properly handle goaway events with no additional data attached (#​2611)

v1.9.9: @​grpc/grpc-js 1.9.9

Compare Source

• Fix a busy loop when recovering from a failure to establish a connection to a fixed IP address target (#​2609)

v1.9.8: @​grpc/grpc-js 1.9.8

Compare Source

• Fix a memory leak caused by creating and closing multiple clients (#​2606)

v1.9.7: @​grpc/grpc-js 1.9.7

Compare Source

• Fix a bug that could cause a client to not update name resolution after multiple failed connection attempts (#​2602)

v1.9.6: @​grpc/grpc-js 1.9.6

Compare Source

• Include more information in most "No connection established" errors (#​2598)
• Remove the index tracer, and add more information to other trace logs (#​2599)

v1.9.5: @​grpc/grpc-js 1.9.5

Compare Source

• Fix a type inconsistency in server-call.ts (#​2589 contributed by @​rsnullptr)
• Close ports if the server is shut down while the bind operation is ongoing (#​2590)

v1.9.4: @​grpc/grpc-js 1.9.4

Compare Source

• Fix a bug that could cause a client to sometimes incorrectly hold the process open when no longer in use (#​2586)

v1.9.3: @​grpc/grpc-js 1.9.3

Compare Source

• Make a few improvements to DNS resolving timing (#​2571)

Experimental changes:

• Added grpc.experimental.BackoffTimeout#getEndTime

v1.9.2: @​grpc/grpc-js 1.9.2

Compare Source

• Handle error when sending keepalive pings (#​2563)
• Fix a bug that could cause invalid connection states when DNS updates contained the same address the client was already connected to (#​2559 contributed by @​gusumuzhe, backported in #​2564)

v1.9.1: @​grpc/grpc-js 1.9.1

Compare Source

• Improve formatting of channelz logs (#​2535)
• Avoid sending initial request after the deadline passes in some cases (#​2536)
• Fix possible null reference in pick_first load balancing policy (#​2539)
• Allow empty method config names in service configs (#​2550)
• Defer actions in write callbacks on the client to potentially work around a Node bug (#​2552)

v1.9.0: @​grpc/grpc-js 1.9.0

Compare Source

• Implement channel idle timeout and the channel option grpc.client_idle_timeout_ms (#​2471)
• Implement gRFC A62: pick_first: sticky TRANSIENT_FAILURE and address order randomization (#​2511)
• Fix premature leaving of context due to improper Http2ServerCallStream handling (#​2501 contributed by @​CedricKassen)
• Add channel option grpc-node.tls_enable_trace to enable Node TLS tracing (#​2507)
• Cancel deadline timer on server when call is cancelled (#​2508)

Experimental changes:

• Added grpc.experimental.createResolver

v1.8.22: @​grpc/grpc-js 1.8.22

Compare Source

• Avoid buffering significantly more than grpc.max_receive_message_size per received message.

v1.8.21

Compare Source

• Fix propagation of UNIMPLEMENTED error messages (#​2528)

v1.8.20: @​grpc/grpc-js 1.8.20

Compare Source

• Fix a crash when the channel option grpc.keepalive_permit_without_calls is set (#​2519)

v1.8.19: @​grpc/grpc-js 1.8.19

Compare Source

• Update keepalive behavior to more correctly handle short calls and long periods of inactivity (#​2513)

v1.8.18: @​grpc/grpc-js 1.8.18

Compare Source

• Fix reporting of call stacks in unary request errors (#​2503)
• Fix reporting of proxy info in channelz socket responses (#​2503)

v1.8.17: @​grpc/grpc-js 1.8.17

Compare Source

• Disallow pick_first LB policy as the direct child of an outlier_detection LB policy (#​2476)

v1.8.16: @​grpc/grpc-js 1.8.16

Compare Source

• Fix missing transport trace logs (#​2470)

v1.8.15: @​grpc/grpc-js 1.8.15

Compare Source

• Fix a memory leak that could result from a specific pattern of recursive function calls (#​2456)
• Ensure status and error events are consistently emitted asynchronously (#​2456)

v1.8.14: @​grpc/grpc-js 1.8.14

Compare Source

• Fix sequencing of some events related to connectivity state changes (#​2421)

v1.8.13: @​grpc/grpc-js 1.8.13

Compare Source

• Fix memory leak in channelz socket tracking (#​2394)

v1.8.12

Compare Source

• Fix an occasional type error when receiving DNS updates (#​2380)
• Fix ordering of events when handing requests on the server (#​2376 contributed by @​phoenix741)

v1.8.11: @​grpc/grpc-js 1.8.11

Compare Source

• Avoid accumulating placeholder objects when sending many messages on a long-running stream (#​2372)

v1.8.10: @​grpc/grpc-js 1.8.10

Compare Source

• Fix bugs in "pick first" load balancing policy that caused incorrect reconnection behavior (#​2369)

v1.8.9: @​grpc/grpc-js 1.8.9

Compare Source

• Fix a bug where clients would continue to send pings at the original configured rate after receiving a backoff request from the server (#​2363)

v1.8.8: @​grpc/grpc-js 1.8.8

Compare Source

• Remove progress field in returned status object (#​2350)
• Export InterceptingListener and NextCall types (#​2351)
• Fix a bug that could cause a crash when sending messages that exceed the outgoing message buffer size while a retry is in progress (#​2349)

v1.8.7: @​grpc/grpc-js 1.8.7

Compare Source

• Make handling of HTTP2 session references work independent of keepalive settings (#​2337)

v1.8.6: @​grpc/grpc-js 1.8.6

Compare Source

• Hold a reference to transport from call to avoid premature garbage collection (#​2336)

v1.8.5: @​grpc/grpc-js 1.8.5

Compare Source

• Cancel deadline timer when the call ends (#​2335)

v1.8.4

Compare Source

• Fix a bug that would sometimes allow the Node process to exit even though a gRPC request is active (#​2322)

v1.8.3: @​grpc/grpc-js 1.8.3

Compare Source

• Fix bug that caused streams to fail early when receiving a GOAWAY (#​2319)

v1.8.2

Compare Source

• Continue keepalive pings after receiving a GOAWAY on the client (#​2308)
• Fix handling of keepalive timers when the timeout is longer than the interval (#​2304 contributed by @​nicknotfun, included in #​2308)
• Ensure the last received message is fully handled before outputting status (#​2316)

v1.8.1

Compare Source

• Implement support for the grpc.service_config_disable_resolution channel option (#​2277 contributed by @​kleinsch)
• Include standard headers in trailers-only responses (#​2305)
• Fix a memory leak in the retry implementation (#​2306)

v1.8.0: @​grpc/grpc-js 1.8.0

Compare Source

• Implement retries (specified in gRFC A6) (#​2243, #​2278)
• Enable servers to send trailers-only responses (#​2278)
• Add server connection management options (#​2272)

v1.7.3: @​grpc/grpc-js 1.7.3

Compare Source

• Server performance improvements (#​2249 contributed by @​AVVS)

[v1.7.2](https://redirect.github.com/grp

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: packages/shopping/package-lock.json

npm ERR! code ETARGET
npm ERR! notarget No matching version found for loopback4-example-recommender@1.1.1.
npm ERR! notarget In most cases you or one of your dependencies are requesting
npm ERR! notarget a package version that doesn't exist.

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2026-10-05T20_35_00_427Z-debug-0.log