Fix/grpc js CVE bump - #157
Merged
Merged
Conversation
…E-2026-48069 @grpc/grpc-js was pinned to an exact 1.13.3, which falls inside the affected range 1.13.0 - 1.13.4 for two HIGH advisories (malformed request crashes a server; malformed compressed message crashes a client or server), both fixed in 1.13.5. Because the pin was exact rather than a range, consumers of 9.34.0 could not remediate on their own -- customer static-analysis gates (Cycode) block the dependency outright. Widen to ^1.13.5 so the fixed line is picked up and future patches flow without needing an SDK release for each advisory. Verified: npm audit reports no @grpc/grpc-js advisories after the bump (two HIGH before); build clean; unit suite identical to the pre-bump control on the same commit (8 files / 73 tests failing both before and after -- all pre-existing); live App Automate run on the resolved 1.14.4 connects the bin session and drives the gRPC transport with no UNAVAILABLE / DEADLINE_EXCEEDED and session renames landing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The previous commit regenerated package-lock.json via `npm install`, which also rewrote ~197 unrelated lines: main's lockfile is stale against its own manifest (it records 9.29.1 while package.json says 9.34.0) and npm recomputes derived peer/dev reachability flags on every install (152 `"peer": true` removals). Reproducing that on a pristine clone of main with no source change produces the identical churn, so none of it belongs to this security fix. Restore those lines to main's state and keep only the grpc subtree: @grpc/grpc-js, @grpc/proto-loader, protobufjs, @protobufjs/utf8, and the mirrored constraint on packages/browserstack-service. Lockfile diff drops from 227 lines to 30. Re-verified after scoping: `npm ci` resolves cleanly and installs grpc-js 1.14.4 / proto-loader 0.8.1, npm audit reports no grpc advisories, build clean, and the unit suite is unchanged at 8 files / 73 tests failing (all pre-existing on main). The lockfile staleness on main is real but pre-existing, and is better fixed on its own. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
^1.13.5 resolved to 1.14.4, which declares "@grpc/proto-loader": "^0.8.0" and so forced proto-loader 0.7.15 -> 0.8.1; npm then also floated protobufjs 7.6.4 -> 7.6.5 and @protobufjs/utf8 1.1.1 -> 1.1.2, neither of which was required (7.6.4 already satisfies proto-loader's ^7.5.5). None of that is needed to clear the advisories. Both CVEs are fixed in 1.13.5, and grpc-js 1.13.5 still declares "@grpc/proto-loader": "^0.7.13" -- identical to 1.13.3 -- so constraining to ~1.13.5 leaves the entire transitive tree untouched. Installed tree after this change: grpc-js 1.13.5, proto-loader 0.7.15, protobufjs 7.6.4, @protobufjs/utf8 1.1.1. Lockfile diff is now a single node plus the mirrored constraint (8 lines, down from 30). ~1.13.5 still picks up future 1.13.x patches; widening across minors is a dependency-policy decision that shouldn't ride along on a security fix. Verified: npm audit reports no @grpc/grpc-js advisories (two HIGH before); `npm ci` resolves cleanly; build clean; unit suite unchanged at 8 files / 73 tests failing (all pre-existing). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
rahulpsq
requested review from
Bhargavi-BS and
rounak610
and removed request for
a team
August 18, 2026 15:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this about?
Related Jira task/s
Release (mandatory for every PR — required for the
ready-for-reviewlabel)Version bump: (required — tick exactly one)
Release notes type: (optional)
Release notes (customer-facing): (optional but encouraged)
Release notes (internal): (required — engineer-facing; what actually changed / why)
Checklist
PR Validations
Run Tests: Comment RUN_TESTS to trigger sanity tests.