[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@grpc/grpc-js (source)	1.13.5 → 1.13.6

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

@​grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

CVE-2026-101915 / GHSA-f596-whhp-79r4

More information

Details

Impact

If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers.

Patches

This vulnerability is fixed in 1.13.6 and 1.14.5.

Workarounds

This can be avoided by using a top-level error handler in method handlers to strip out sensitive error information.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-f596-whhp-79r4
• https://nvd.nist.gov/vuln/detail/CVE-2026-101915
• https://github.com/grpc/grpc-node/commit/350de32860428cc62473a00bee4035360690ffea
• https://github.com/grpc/grpc-node/commit/7c5c5181159c6ddd292805881ef2cdec29bb475f
• https://github.com/grpc/grpc-node/commit/e8329b122ca99ba10877e990c2f6edd40224fd0d
• https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.13.6
• https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5
• https://github.com/advisories/GHSA-f596-whhp-79r4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

CVE-2026-101916 / GHSA-m9gg-hp2v-232j

More information

Details

Impact

When server credentials are created with the requireClientCertificate option set to false, getAuthContext does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for @grpc/grpc-js users who use the result of getAuthContext for authentication.

In particular, @grpc/grpc-js-xds can both set the requireClientCertificate option to false and use the return value of getAuthContext for RBAC authentication in some configurations.

Patches

This vulenrability is fixed in 1.13.6 and 1.14.5.

Workarounds

@grpc/grpc-js users using getAuthContext this way can avoid this problem by setting requireClientCertificate to true. @grpc/grpc-js-xds users using RBAC can avoid this by setting the require_client_certificate field to true in the DownstreamTlsContext in the xDS configuration.

Severity

• CVSS Score: 7.4 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j
• https://nvd.nist.gov/vuln/detail/CVE-2026-101916
• https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee
• https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c
• https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5
• https://github.com/advisories/GHSA-m9gg-hp2v-232j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

grpc/grpc-node (@​grpc/grpc-js)

v1.13.6: @​grpc/grpc-js 1.13.6

Compare Source

• Fix a bug that caused clients to automatically transmit excessive error details to clients by default (advisory GHSA-f596-whhp-79r4)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

🦋 Changeset detected

Latest commit: 2417e17

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@chainlink/kaiko-state-adapter	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.