# What changed in @grpc/grpc-js

> 11 changes in @grpc/grpc-js 1 from its official release notes, upgrade guides and advisories: 6 security. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/@grpc/grpc-js/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @grpc/grpc-js 1

### Security

- Addresses remaining instances of the security advisory. (1.13.7, 1.14.6) — [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.14.6), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.13.7)
- Clients no longer automatically transmit excessive error details by default. (1.13.6, 1.14.5) — [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.14.5), [security advisory](https://github.com/advisories/GHSA-F596-WHHP-79R4), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.13.6)
- getAuthContext no longer returns unverified certificates as though they were verified in some configurations. (1.13.6, 1.14.5) — [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.14.5), [security advisory](https://github.com/advisories/GHSA-M9GG-HP2V-232J)
- @grpc/grpc-js: A malformed request can cause a server crash (1.9.16 … 1.14.4) — [security advisory](https://github.com/advisories/GHSA-5375-PQ7M-F5R2), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.14.4), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.13.5), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.12.7), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.11.4), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.10.12), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.9.16)
- @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash (1.9.16 … 1.14.4) — [security advisory](https://github.com/advisories/GHSA-99F4-GRH7-6PCQ), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.14.4), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.13.5), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.12.7), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.11.4), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.10.12), [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.9.16)
- @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches (1.14.1) — [security advisory](https://github.com/advisories/GHSA-88H9-XGVX-HVF2)

### Fixes and other changes

- Fixes call status reports that could be missing expected fields. (1.14.5) — [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.14.5)
- Fixes accumulation of stale call data when a channel fails to connect for a long period of time. (1.14.5) — [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.14.5)
- Sends halfClose immediately after messages to prevent late halfClose issues with Envoy. (1.14.3) — [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.14.3)
- Fixes the server keep alive timeout so it properly destroys connections. (1.14.2) — [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.14.2)
- Fixes a regression in the settings used internally for HTTP/2 sessions. (1.14.1) — [release notes](https://github.com/grpc/grpc-node/releases/tag/%40grpc/grpc-js%401.14.1)