npm / @grpc/grpc-js
@grpc/grpc-js
What changed in @grpc/grpc-js 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.
6 security5 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@grpc/grpc-js 111 changes
Security 6
Addresses remaining instances of the security advisory.
Clients no longer automatically transmit excessive error details by default.
getAuthContext no longer returns unverified certificates as though they were verified in some configurations.
@grpc/grpc-js: A malformed request can cause a server crash
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
Fixes and other changes 5
Fixes call status reports that could be missing expected fields.
Fixes accumulation of stale call data when a channel fails to connect for a long period of time.
Sends halfClose immediately after messages to prevent late halfClose issues with Envoy.
Fixes the server keep alive timeout so it properly destroys connections.
Fixes a regression in the settings used internally for HTTP/2 sessions.