chore(deps): bump @grpc/grpc-js from 1.14.3 to 1.14.6 in /nodejs

[dependabot]

Bumps @grpc/grpc-js from 1.14.3 to 1.14.6.

Release notes

Sourced from @​grpc/grpc-js's releases.

@​grpc/grpc-js 1.14.6

• Address remaining instances of advisory GHSA-f596-whhp-79r4 (#3105)
• Avoid Date allocations on request and channelz tracking paths (#3090 contributed by @​olavloite)
• Avoid throwaway timer allocation in ResolvingCall (#3092 contributed by @​olavloite)
• Avoid building metadata map when parsing trailers (#3093 contributed by @​olavloite)
• Lazily allocate Metadata opaqueData map (#3095 contributed by @​olavloite)
• Cache precomputed serviceUrl in InternalChannel (#3097 contributed by @​olavloite)
• Memoize method config lookup in default config selector (#3098 contributed by @​olavloite)
• Avoid array allocation for single-value metadata headers (#3099 contributed by @​olavloite)
• Avoid allocations for empty CallCredentials on the RPC hot path (#3100 contributed by @​olavloite)
• Avoid redundant metadata clone in RetryingCall on initial attempt (#3101 contributed by @​olavloite)

@​grpc/grpc-js 1.14.5

• Fix a bug that caused clients to automatically transmit excessive error details to clients by default (advisory GHSA-f596-whhp-79r4)
• Fix a bug that caused getAuthContext to return unverified certificates as though they were verified in some configurations (advisory GHSA-m9gg-hp2v-232j)
• Fix a bug that could cause stale call data to accumulate if a channel failed to connect for a long period of time (#3078)
• Fix a bug that could cause call status to be reported with expected fields missing (#3079)
• Avoid redundant end() calls on completed HTTP/2 streams (#3082 contributed by @​olavloite)
• Unify call numbers and avoid disabled trace allocations (#3084 contributed by @​olavloite)

@​grpc/grpc-js 1.14.4

• Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)
• Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

Commits

• c63ed15 Merge pull request #3105 from murgatroid99/grpc-js_error_details_1.14
• 025cc24 Merge pull request #3107 from olavloite/backport-perf-to-1.14.x
• 9b50778 grpc-js: Increment version to 1.14.6
• 1126061 grpc-js: Don't transmit error details by default in server interceptors
• 40b61a0 perf(grpc-js): avoid allocations for empty CallCredentials on the RPC hot pat...
• aed1745 test(grpc-js): stabilize weighted round robin tests on slow runners (#3104)
• 8db8a06 perf(grpc-js): avoid redundant metadata clone in RetryingCall on initial atte...
• 2aa8b88 perf(grpc-js): memoize method config lookup in default config selector (#3098)
• e4ccd66 perf(grpc-js): cache precomputed serviceUrl in InternalChannel (#3097)
• 17c61a5 test(grpc-js): fix Windows CI test failures (#3094)
• Additional commits viewable in compare view

[RockteMQ-AI]

Review by github-manager-bot

Summary

Dependabot patch bump of @grpc/grpc-js from 1.14.3 → 1.14.6 in the Node.js client module. The release notes indicate this addresses security advisory GHSA-f596-whhp-79r4.

Findings

• [Info] package-lock.json — Version bump is clean; only the @grpc/grpc-js entry is modified (version, resolved URL, integrity hash, and added license field). No transitive dependency changes.
• [Info] Security — Upgrading addresses a known security advisory. This is a recommended update.
• [Info] Compatibility — Patch-level bump (1.14.x) should be backward-compatible per semver. No API changes expected.

Verdict

✅ Approve — Low-risk security patch. No concerns.

---

Automated review by github-manager-bot

[RockteMQ-AI]

Review by github-manager-bot

Summary

Dependabot patch bump of @grpc/grpc-js from 1.14.3 to 1.14.6 in the Node.js client module. The release notes indicate this addresses security advisory GHSA-f596-whhp-79r4.

Findings

• [Info] package-lock.json — Version bump is clean; only the grpc/grpc-js entry is modified (version, resolved URL, integrity hash, and added license field). No transitive dependency changes.
• [Info] Security — Upgrading addresses a known security advisory. This is a recommended update.
• [Info] Compatibility — Patch-level bump (1.14.x) should be backward-compatible per semver. No API changes expected.

Verdict

Approve — Low-risk security patch. No concerns.

---

Automated review by github-manager-bot

[RockteMQ-AI]

Review by github-manager-bot

Summary

Dependabot patch update: @grpc/grpc-js 1.14.3 → 1.14.6 in /nodejs.

Findings

• [Info] This is a patch-level bump with security fixes (GHSA-f596-whhp-79r4) and performance improvements (reduced allocations on hot paths).
• [Info] Change is limited to package-lock.json version/integrity fields — no code changes.
• [Info] The 1.14.6 release also includes lazy allocation and memoization optimizations that benefit gRPC client performance.

Verdict

Low risk, recommended to merge. The security advisory fix alone justifies the update.

---

Automated review by github-manager-bot

[RockteMQ-AI]

Review by github-manager-bot

Summary

Dependabot security update: @grpc/grpc-js 1.14.3 → 1.14.6. Fixes three security advisories (GHSA-4x9q-692r-mwxj, GHSA-j32p-98fj-v48g, GHSA-j32r-692h-g7pf).

Assessment

• Correctness: ✅ Patch version bump within 1.x semver range; no breaking API changes expected.
• Compatibility: ✅ Drop-in replacement; package-lock.json integrity hash updated correctly.
• Security: ✅ Addresses known vulnerabilities in the gRPC transport layer.

Approved — low-risk security fix.