[Snyk] Upgrade @grpc/grpc-js from 1.10.3 to 1.11.3 #436

j-mendez · 2024-10-18T07:02:16Z

Snyk has created this PR to upgrade @grpc/grpc-js from 1.10.3 to 1.11.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 12 versions ahead of your current version.
The recommended version was released a month ago, on 2024-09-17.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Uncontrolled Resource Consumption SNYK-JS-GRPCGRPCJS-7242922	559/1000 Why? Has a fix available, CVSS 6.9	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: @grpc/grpc-js

1.11.3 - 2024-09-17
- Ensure the client queries the name resolver again after connections drop while using the round_robin load balancing policy (#2825)
1.11.2 - 2024-09-05
- Fix client crash on receiving a custom error code (#2801 contributed by @ hastom)
- Report connection errors more consistently (#2808)
- Avoid computing the channel constructor trace log when that tracer is not enabled (#2817 contributed by @ ygalbel)
1.11.1 - 2024-07-16
- Revert a change that used APIs that were not available in early minor versions of Node 14 (#2799 contributed by @ xqin)
1.11.0 - 2024-07-15
- Add xDS Servers (#2783)
  - Note: this is primarily a foundation for future features. It doesn't actually do much right now.
- Add support for dualstack socket support in xDS clients (#2665)
1.10.11 - 2024-07-10
- Fix a bug that caused clients to reconnect unnecessarily while no requests are pending. (#2784)
- Fix a bug that caused clients to fail to re-establish existing connections while waiting for DNS results (#2784)
- Fix a bug that caused servers to sometimes not close idle connections depending on timing (#2790)
- Fix a bug that caused calls to be pending indefinitely while unable to start after a channel is closed (#2791)
1.10.10 - 2024-06-24
1.10.9 - 2024-06-10
1.10.8 - 2024-05-15
1.10.7 - 2024-05-01
1.10.6 - 2024-04-03
1.10.5 - 2024-04-01
1.10.4 - 2024-03-26
1.10.3 - 2024-03-15

from @grpc/grpc-js GitHub release notes

Commit messages

Package name: @grpc/grpc-js

8841efe Merge pull request #2825 from murgatroid99/grpc-js_round_robin_reresolve
a1b8972 Merge pull request #2806 from murgatroid99/grpc-js_connectivity_management_fixes
b3c24d0 grpc-js: round_robin: Request resolution on connection drop
0c5ab98 Merge pull request #2803 from murgatroid99/grpc-js_1.11.2
bb4496b Merge pull request #2817 from ygalbel/tracer-slow
90e472e made the call to trace to be called only when tracer is enabled
c63bdae Merge pull request #2808 from murgatroid99/grpc-js_transport_error_reporting
3d43b1a Further reduce pick_first state space
d409311 grpc-js: Report session error events instead of waiting for close
a6575c3 grpc-js: Simplify pick_first behavior
b763f98 grpc-js: Bump to 1.11.2
f5ea6ce Merge pull request #2801 from hastom/master
33073d0 Fix test case
15d422d Fix client crash on custom error code
43032b1 Merge pull request #2800 from murgatroid99/grpc-js_1.11.1
2ecd53d grpc-js: Bump to 1.11.1
4da4fdc Merge pull request #2799 from xqin/master
996a637 support node v14 again
87ea7ce Merge pull request #2797 from murgatroid99/grpc-js_1.11.0_real
2ee8911 grpc-js: Bump packages to 1.11.0, and update documentation
7e4c8f0 Merge pull request #2796 from murgatroid99/grpc-js_1.11.0
bf8e071 grpc-js: Bump packages to 1.11.0, and update documentation
e13d5e7 Merge pull request #2793 from murgatroid99/grpc-js_server_call_get_host
d60f516 Merge pull request #2795 from murgatroid99/grpc-js_retry_limit_option