chore: update dependency @grpc/grpc-js to v1.9.16 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@grpc/grpc-js (source)	1.6.7 → 1.9.16

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

@​grpc/grpc-js can allocate memory for incoming messages well above configured limits

CVE-2024-37168 / GHSA-7v5v-9h63-cj86

More information

Details

Impact

There are two separate code paths in which memory can be allocated per message in excess of the grpc.max_receive_message_length channel option:

1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded.
2. If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded.

Patches

This has been patched in versions 1.10.9, 1.9.15, and 1.8.22

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86
• https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650
• https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3
• https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb
• https://nvd.nist.gov/vuln/detail/CVE-2024-37168
• https://github.com/advisories/GHSA-7v5v-9h63-cj86

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

CVE-2026-48069 / GHSA-99f4-grh7-6pcq

More information

Details

Impact

An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @​grpc/grpc-js

Patches

The following version have fixes for this vulnerability:

• 1.9.16
• 1.10.12
• 1.11.4
• 1.12.7
• 1.13.5
• 1.14.4

Workarounds

There is no workaround.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16
• https://github.com/advisories/GHSA-99f4-grh7-6pcq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​grpc/grpc-js: A malformed request can cause a server crash

CVE-2026-48068 / GHSA-5375-pq7m-f5r2

More information

Details

Impact

An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @​grpc/grpc-js.

Patches

The following version have fixes for this vulnerability:

• 1.9.16
• 1.10.12
• 1.11.4
• 1.12.7
• 1.13.5
• 1.14.4

Workarounds

There is no workaround.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4
• https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16
• https://github.com/advisories/GHSA-5375-pq7m-f5r2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

grpc/grpc-node (@​grpc/grpc-js)

v1.9.16: @​grpc/grpc-js 1.9.16

Compare Source

• Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)
• Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

v1.9.15: @​grpc/grpc-js 1.9.15

Compare Source

• Avoid buffering significantly more than grpc.max_receive_message_size per received message.

v1.9.14: @​grpc/grpc-js 1.9.14

Compare Source

• Fix a bug that could rarely cause connection leaks (#​2644)
• Fix a bug that could cause clients to go IDLE incorrectly some time after calling waitForReady (#​2643)

v1.9.13: @​grpc/grpc-js 1.9.13

Compare Source

• Fix a bug that could cause the Node process to close early when establishing a connection while a request is pending (#​2626)

v1.9.12: @​grpc/grpc-js 1.9.12

Compare Source

• Fix a bug that could cause connectivity state information to become stale in some circumstances (#​2623)

v1.9.11: @​grpc/grpc-js 1.9.11

Compare Source

• Fix a busy loop when recovering from a failure to establish a connection to a unix domain socket address target (#​2618)
• Fix a bug that caused clients to stop trying to connect to a fixed IP address target after a working connection drops (#​2619)

v1.9.10: @​grpc/grpc-js 1.9.10

Compare Source

• Provide the correct port to the proxy when connecting to a target without an explicitly specified port (#​2608 contributed by @​segevfiner)
• Properly handle goaway events with no additional data attached (#​2611)

v1.9.9: @​grpc/grpc-js 1.9.9

Compare Source

• Fix a busy loop when recovering from a failure to establish a connection to a fixed IP address target (#​2609)

v1.9.8: @​grpc/grpc-js 1.9.8

Compare Source

• Fix a memory leak caused by creating and closing multiple clients (#​2606)

v1.9.7: @​grpc/grpc-js 1.9.7

Compare Source

• Fix a bug that could cause a client to not update name resolution after multiple failed connection attempts (#​2602)

v1.9.6: @​grpc/grpc-js 1.9.6

Compare Source

• Include more information in most "No connection established" errors (#​2598)
• Remove the index tracer, and add more information to other trace logs (#​2599)

v1.9.5: @​grpc/grpc-js 1.9.5

Compare Source

• Fix a type inconsistency in server-call.ts (#​2589 contributed by @​rsnullptr)
• Close ports if the server is shut down while the bind operation is ongoing (#​2590)

v1.9.4: @​grpc/grpc-js 1.9.4

Compare Source

• Fix a bug that could cause a client to sometimes incorrectly hold the process open when no longer in use (#​2586)

v1.9.3: @​grpc/grpc-js 1.9.3

Compare Source

• Make a few improvements to DNS resolving timing (#​2571)

Experimental changes:

• Added grpc.experimental.BackoffTimeout#getEndTime

v1.9.2: @​grpc/grpc-js 1.9.2

Compare Source

• Handle error when sending keepalive pings (#​2563)
• Fix a bug that could cause invalid connection states when DNS updates contained the same address the client was already connected to (#​2559 contributed by @​gusumuzhe, backported in #​2564)

v1.9.1: @​grpc/grpc-js 1.9.1

Compare Source

• Improve formatting of channelz logs (#​2535)
• Avoid sending initial request after the deadline passes in some cases (#​2536)
• Fix possible null reference in pick_first load balancing policy (#​2539)
• Allow empty method config names in service configs (#​2550)
• Defer actions in write callbacks on the client to potentially work around a Node bug (#​2552)

v1.9.0: @​grpc/grpc-js 1.9.0

Compare Source

• Implement channel idle timeout and the channel option grpc.client_idle_timeout_ms (#​2471)
• Implement gRFC A62: pick_first: sticky TRANSIENT_FAILURE and address order randomization (#​2511)
• Fix premature leaving of context due to improper Http2ServerCallStream handling (#​2501 contributed by @​CedricKassen)
• Add channel option grpc-node.tls_enable_trace to enable Node TLS tracing (#​2507)
• Cancel deadline timer on server when call is cancelled (#​2508)

Experimental changes:

• Added grpc.experimental.createResolver

v1.8.22: @​grpc/grpc-js 1.8.22

Compare Source

• Avoid buffering significantly more than grpc.max_receive_message_size per received message.

v1.8.21

Compare Source

• Fix propagation of UNIMPLEMENTED error messages (#​2528)

v1.8.20: @​grpc/grpc-js 1.8.20

Compare Source

• Fix a crash when the channel option grpc.keepalive_permit_without_calls is set (#​2519)

v1.8.19: @​grpc/grpc-js 1.8.19

Compare Source

• Update keepalive behavior to more correctly handle short calls and long periods of inactivity (#​2513)

v1.8.18: @​grpc/grpc-js 1.8.18

Compare Source

• Fix reporting of call stacks in unary request errors (#​2503)
• Fix reporting of proxy info in channelz socket responses (#​2503)

v1.8.17: @​grpc/grpc-js 1.8.17

Compare Source

• Disallow pick_first LB policy as the direct child of an outlier_detection LB policy (#​2476)

v1.8.16: @​grpc/grpc-js 1.8.16

Compare Source

• Fix missing transport trace logs (#​2470)

v1.8.15: @​grpc/grpc-js 1.8.15

Compare Source

• Fix a memory leak that could result from a specific pattern of recursive function calls (#​2456)
• Ensure status and error events are consistently emitted asynchronously (#​2456)

v1.8.14: @​grpc/grpc-js 1.8.14

Compare Source

• Fix sequencing of some events related to connectivity state changes (#​2421)

v1.8.13: @​grpc/grpc-js 1.8.13

Compare Source

• Fix memory leak in channelz socket tracking (#​2394)

v1.8.12

Compare Source

• Fix an occasional type error when receiving DNS updates (#​2380)
• Fix ordering of events when handing requests on the server (#​2376 contributed by @​phoenix741)

v1.8.11: @​grpc/grpc-js 1.8.11

Compare Source

• Avoid accumulating placeholder objects when sending many messages on a long-running stream (#​2372)

v1.8.10: @​grpc/grpc-js 1.8.10

Compare Source

• Fix bugs in "pick first" load balancing policy that caused incorrect reconnection behavior (#​2369)

v1.8.9: @​grpc/grpc-js 1.8.9

Compare Source

• Fix a bug where clients would continue to send pings at the original configured rate after receiving a backoff request from the server (#​2363)

v1.8.8: @​grpc/grpc-js 1.8.8

Compare Source

• Remove progress field in returned status object (#​2350)
• Export InterceptingListener and NextCall types (#​2351)
• Fix a bug that could cause a crash when sending messages that exceed the outgoing message buffer size while a retry is in progress (#​2349)

v1.8.7: @​grpc/grpc-js 1.8.7

Compare Source

• Make handling of HTTP2 session references work independent of keepalive settings (#​2337)

v1.8.6: @​grpc/grpc-js 1.8.6

Compare Source

• Hold a reference to transport from call to avoid premature garbage collection (#​2336)

v1.8.5: @​grpc/grpc-js 1.8.5

Compare Source

• Cancel deadline timer when the call ends (#​2335)

v1.8.4

Compare Source

• Fix a bug that would sometimes allow the Node process to exit even though a gRPC request is active (#​2322)

v1.8.3: @​grpc/grpc-js 1.8.3

Compare Source

• Fix bug that caused streams to fail early when receiving a GOAWAY (#​2319)

v1.8.2

Compare Source

• Continue keepalive pings after receiving a GOAWAY on the client (#​2308)
• Fix handling of keepalive timers when the timeout is longer than the interval (#​2304 contributed by @​nicknotfun, included in #​2308)
• Ensure the last received message is fully handled before outputting status (#​2316)

v1.8.1

Compare Source

• Implement support for the grpc.service_config_disable_resolution channel option (#​2277 contributed by @​kleinsch)
• Include standard headers in trailers-only responses (#​2305)
• Fix a memory leak in the retry implementation (#​2306)

v1.8.0: @​grpc/grpc-js 1.8.0

Compare Source

• Implement retries (specified in gRFC A6) (#​2243, #​2278)
• Enable servers to send trailers-only responses (#​2278)
• Add server connection management options (#​2272)

v1.7.3: @​grpc/grpc-js 1.7.3

Compare Source

• Server performance improvements (#​2249 contributed by @​AVVS)

v1.7.2: @​grpc/grpc-js 1.7.2

Compare Source

• Make the default value of the grpc-node.max_session_memory option Number.MAX_SAFE_INTEGER on the server (#​2245)

v1.7.1: Node gRPC v1.7.1

Compare Source

Changes

• Publish prebuilt binaries for Node 9
• Fix file permissions issue with Linux prebuilt binaries (reported in #​76).

v1.7.0: @​grpc/grpc-js 1.7.0

Compare Source

• Enable outlier detection support by default (#​2221)
• Expose path and callEnd event in ServerSurfaceCall (#​2132 contributed by @​ajmath)
• Make graceful switch happen more quickly in some cases when service config is updated (#​2199)

v1.6.12: @​grpc/grpc-js 1.6.12

Compare Source

• Fix typo in the error handling fix released in 1.6.11 (#​2216, contributed by @​clww in #​2213)

v1.6.11

Compare Source

• Fix handling of malformed status messages (#​2210)

v1.6.10: @​grpc/grpc-js 1.6.10

Compare Source

• Fix a memory leak of Node http2 stream objects when cancelling streaming requests (#​2193)

v1.6.9: @​grpc/grpc-js 1.6.9

• Fix bugs in the Outlier Detection implementation (#​2173, #​2181)
• Handle errors when sending keepalive pings (#​2188)
• Fix Typescript reference tag generation (#​2126)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: packages/shopping/package-lock.json

npm ERR! code ETARGET
npm ERR! notarget No matching version found for loopback4-example-recommender@1.1.1.
npm ERR! notarget In most cases you or one of your dependencies are requesting
npm ERR! notarget a package version that doesn't exist.

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2026-08-26T11_49_20_471Z-debug-0.log