Gathering detailed insights and metrics for @grpc/grpc-js
Gathering detailed insights and metrics for @grpc/grpc-js
Installations
npm install @grpc/grpc-jsDeveloper Guide
BETA
Typescript
✅ Yes
Module System
CommonJS
Min. Node Version
>=12.10.0
Node Version
18.14.0
NPM Version
9.3.1
Score
64.1
Supply Chain
95.8
Quality
94.7
Maintenance
100
Vulnerability
99.6
License
Releases
@grpc/grpc-js 1.12.4
@grpc/grpc-js@1.12.4
Published on 04 Dec 2024
@grpc/grpc-js 1.12.3
@grpc/grpc-js@1.12.3
Published on 02 Dec 2024
@grpc/grpc-js 1.12.2
@grpc/grpc-js@1.12.2
Published on 09 Oct 2024
@grpc/grpc-js 1.12.1
@grpc/grpc-js@1.12.1
Published on 08 Oct 2024
@grpc/grpc-js-xds 1.12.0
@grpc/grpc-js-xds@1.12.0
Published on 03 Oct 2024
@grpc/grpc-js 1.12.0
@grpc/grpc-js@1.12.0
Published on 03 Oct 2024
Developer
Statistics
Updated on 06 Dec 2024
Languages
TypeScript (84.92%)
JavaScript (12.13%)
C++ (1.46%)
Shell (0.98%)
CMake (0.14%)
Batchfile (0.13%)
Dockerfile (0.13%)
PowerShell (0.11%)
Total Downloads
Cumulative downloads
Total Downloads
1,359,518,0171,359,518,017
Last day
35.2%
Compared to previous day
Last week
0.8%
Compared to previous week
Last month
4.9%
Compared to previous month
Last year
48.6%
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
2
Dev Dependencies
30
@grpc/proto-loader@types/gulp@types/gulp-mocha@types/lodash@types/mocha@types/ncp@types/node@types/pify@types/semver@typescript-eslint/eslint-plugin@typescript-eslint/parser@typescript-eslint/typescript-estreeclang-formateslinteslint-config-prettiereslint-plugin-nodeeslint-plugin-prettierexecagulpgulp-mochalodashmadgemocha-jenkins-reporterncppifyprettierrimrafsemverts-nodetypescript
Versions
Pure JavaScript gRPC Client
Installation
Node 12 is recommended. The exact set of compatible Node versions can be found in the engines field of the package.json file.
1npm install @grpc/grpc-js
Documentation
Documentation specifically for the @grpc/grpc-js package is currently not available. However, documentation is available for the grpc package, and the two packages contain mostly the same interface. There are a few notable differences, however, and these differences are noted in the "Migrating from grpc" section below.
Features
- Clients
- Automatic reconnection
- Servers
- Streaming
- Metadata
- Partial compression support: clients can compress and decompress messages, and servers can decompress request messages
- Pick first and round robin load balancing policies
- Client Interceptors
- Connection Keepalives
- HTTP Connect support (proxies)
If you need a feature from the grpc package that is not provided by the @grpc/grpc-js, please file a feature request with that information.
This library does not directly handle .proto files. To use .proto files with this library we recommend using the @grpc/proto-loader package.
Migrating from grpc
@grpc/grpc-js is almost a drop-in replacement for grpc, but you may need to make a few code changes to use it:
- If you are currently loading
.protofiles usinggrpc.load, that function is not available in this library. You should instead load your.protofiles using@grpc/proto-loaderand load the resulting package definition objects into@grpc/grpc-jsusinggrpc.loadPackageDefinition. - If you are currently loading packages generated by
grpc-tools, you should instead generate your files using thegenerate_package_definitionoption ingrpc-tools, then load the object exported by the generated file into@grpc/grpc-jsusinggrpc.loadPackageDefinition. - If you have a server and you are using
Server#bindto bind ports, you will need to useServer#bindAsyncinstead. - If you are using any channel options supported in
grpcbut not supported in@grpc/grpc-js, you may need to adjust your code to handle the different behavior. Refer to the list of supported options below. - Refer to the detailed package comparison for more details on the differences between
grpcand@grpc/grpc-js.
Supported Channel Options
Many channel arguments supported in grpc are not supported in @grpc/grpc-js. The channel arguments supported by @grpc/grpc-js are:
grpc.ssl_target_name_overridegrpc.primary_user_agentgrpc.secondary_user_agentgrpc.default_authoritygrpc.keepalive_time_msgrpc.keepalive_timeout_msgrpc.keepalive_permit_without_callsgrpc.service_configgrpc.max_concurrent_streamsgrpc.initial_reconnect_backoff_msgrpc.max_reconnect_backoff_msgrpc.use_local_subchannel_poolgrpc.max_send_message_lengthgrpc.max_receive_message_lengthgrpc.enable_http_proxygrpc.default_compression_algorithmgrpc.enable_channelzgrpc.dns_min_time_between_resolutions_msgrpc.enable_retriesgrpc.max_connection_age_msgrpc.max_connection_age_grace_msgrpc.max_connection_idle_msgrpc.per_rpc_retry_buffer_sizegrpc.retry_buffer_sizegrpc.service_config_disable_resolutiongrpc.client_idle_timeout_msgrpc-node.max_session_memorygrpc-node.tls_enable_tracegrpc-node.retry_max_attempts_limitchannelOverridechannelFactoryOverride
Some Notes on API Guarantees
The public API of this library follows semantic versioning, with some caveats:
- Some methods are prefixed with an underscore. These methods are internal and should not be considered part of the public API.
- The class
Callis only exposed due to limitations of TypeScript. It should not be considered part of the public API. - In general, any API that is exposed by this library but is not exposed by the
grpclibrary is likely an error and should not be considered part of the public API. - The
grpc.experimentalnamespace contains APIs that have not stabilized. Any API in that namespace may break in any minor version update.
Stable Version
Stable Version
1.12.4
HIGH
1
HIGH
7.5/10
Summary
Prototype pollution in grpc and @grpc/grpc-js
Affected Versions
< 1.1.8
Patched Versions
1.1.8
MODERATE
3
MODERATE
5.3/10
Summary
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
Affected Versions
< 1.8.22
Patched Versions
1.8.22
MODERATE
5.3/10
Summary
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
Affected Versions
>= 1.9.0, < 1.9.15
Patched Versions
1.9.15
MODERATE
5.3/10
Summary
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
Affected Versions
>= 1.10.0, < 1.10.9
Patched Versions
1.10.9
Reason
30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Reason
no dangerous workflow patterns detected
Reason
GitHub workflow tokens follow principle of least privilege
Details
- Info: topLevel 'contents' permission set to 'read': .github/workflows/grpc-tools-build.yml:12
- Info: no jobLevel write permissions found
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
0 existing vulnerabilities detected
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy
- Info: Found text in security policy: SECURITY.md:1
Reason
Found 2/12 approved changesets -- score normalized to 1
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: containerImage not pinned by hash: packages/grpc-js-xds/interop/Dockerfile:19
- Warn: containerImage not pinned by hash: packages/grpc-js-xds/interop/Dockerfile:32: pin your Docker image by updating gcr.io/distroless/nodejs18-debian11:latest to gcr.io/distroless/nodejs18-debian11:latest@sha256:c3627dd28e9e031c6b562eb7cb77c324b9c4635a1c05eaf8e89d2eaa364fa6f0
- Warn: containerImage not pinned by hash: tools/release/native/Dockerfile:6: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:0e5e4a57c2499249aafc3b40fcd541e9a456aab7296681a3994d631587203f97
- Warn: npmCommand not pinned by hash: packages/grpc-js-xds/interop/Dockerfile:26
- Warn: npmCommand not pinned by hash: packages/grpc-js-xds/interop/Dockerfile:28
- Warn: npmCommand not pinned by hash: packages/grpc-js-xds/interop/Dockerfile:30
- Warn: downloadThenRun not pinned by hash: tools/release/native/Dockerfile:23
- Warn: downloadThenRun not pinned by hash: packages/grpc-js-xds/scripts/xds.sh:22
- Warn: npmCommand not pinned by hash: packages/grpc-js-xds/scripts/xds.sh:38
- Warn: npmCommand not pinned by hash: packages/grpc-js-xds/scripts/xds.sh:41
- Warn: npmCommand not pinned by hash: packages/grpc-js-xds/scripts/xds.sh:46
- Warn: downloadThenRun not pinned by hash: run-tests.sh:20
- Warn: npmCommand not pinned by hash: run-tests.sh:42
- Warn: npmCommand not pinned by hash: run-tests.sh:67
- Warn: npmCommand not pinned by hash: setup_interop.sh:16
- Warn: npmCommand not pinned by hash: setup_interop.sh:17
- Warn: npmCommand not pinned by hash: setup_interop_purejs.sh:16
- Warn: npmCommand not pinned by hash: setup_interop_purejs.sh:17
- Warn: npmCommand not pinned by hash: test/client-libraries-integration/init.sh:16
- Warn: npmCommand not pinned by hash: test/client-libraries-integration/init.sh:23
- Warn: npmCommand not pinned by hash: test/distrib/run-distrib-test.sh:29
- Warn: npmCommand not pinned by hash: test/distrib/run-distrib-test.sh:30
- Warn: npmCommand not pinned by hash: test/distrib/run-distrib-test.sh:31
- Info: 0 out of 8 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 3 containerImage dependencies pinned
- Info: 0 out of 17 npmCommand dependencies pinned
- Info: 0 out of 3 downloadThenRun dependencies pinned
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 30 are checked with a SAST tool
Score
6.6
/10
Last Scanned on 2024-12-02
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More