fix(deps): update dependency @grpc/grpc-js to v1.10.9 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@grpc/grpc-js (source)	1.10.4 -> 1.10.9

GitHub Vulnerability Alerts

CVE-2024-37168

Impact

There are two separate code paths in which memory can be allocated per message in excess of the grpc.max_receive_message_length channel option:

1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded.
2. If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded.

Patches

This has been patched in versions 1.10.9, 1.9.15, and 1.8.22

---

Release Notes

grpc/grpc-node (@​grpc/grpc-js)

v1.10.9: @​grpc/grpc-js 1.10.9

Compare Source

• Avoid buffering significantly more than grpc.max_receive_message_size per received message.

v1.10.8: @​grpc/grpc-js 1.10.8

Compare Source

• Fix a bug that caused channels with unix: targets to not reconnect after the channel goes idle (#​2750)

v1.10.7: @​grpc/grpc-js 1.10.7

Compare Source

• Improve reporting of HTTP error codes (#​2723)
• Update dependency on @grpc/proto-loader to the latest version (#​2732)

v1.10.6

Compare Source

v1.10.5: @​grpc/grpc-js 1.10.5

Compare Source

• Resolve exception when Error.stackTraceLimit is undefined (#​2701 contributed by @​davidfiala)
• Call configured checkServerIdentity when grpc.ssl_target_name_override is set (#​2704)
• Add more information to DEADLINE_EXCEEDED error details strings (#​2692)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled because a matching PR was automerged previously.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[github-actions]

🚀 Snapshot Release (alpha)

The latest changes of this PR are available as alpha on npm (based on the declared changesets):

Package	Version	Info
@graphql-mesh/fusion-runtime	0.5.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/cli	0.91.3-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/grpc	0.101.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/json-schema	0.102.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/mysql	0.100.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/neo4j	0.100.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/openapi	0.102.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/raml	0.102.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/soap	0.101.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/thrift	0.101.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@omnigraph/json-schema	0.102.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@omnigraph/mysql	0.4.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@omnigraph/neo4j	0.4.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@omnigraph/openapi	0.102.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@omnigraph/raml	0.102.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@omnigraph/soap	0.101.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@omnigraph/thrift	0.4.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/plugin-operation-headers	0.3.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/plugin-prometheus	0.102.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/serve-cli	0.7.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/serve-runtime	0.5.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/transport-common	0.4.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/transport-http	0.3.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/transport-mysql	0.4.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/transport-neo4j	0.4.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/transport-rest	0.4.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/transport-soap	0.4.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎
@graphql-mesh/transport-thrift	0.4.0-alpha-20240709121809-83204490c6874974fe0384a5b6e96393ad2b35df	npm ↗︎ unpkg ↗︎

[github-actions]

💻 Website Preview

The latest changes are available as preview in: https://4c4f9329.graphql-mesh.pages.dev