[superagent-security]

Superagent dependency review

Dependency change

Package	Change	Age
@grpc/grpc-js	1.14.4 → 1.14.5	38 days

Question	Result
Is the update vulnerable or malicious?	✅ No issues found
Is this dependency used?	⚠️ Yes, in production code — No direct import in repo source; no gRPC server code. Runtime path: apps/worker (production) -> @openmetal/provider-modal -> modal@0.9.0 -> nice-grpc@2.1.17 -> @grpc/grpc-js as the Modal API client transport. The candidate repo adds a pnpm override forcing 1.14.5.

Why this update matters

The current version's repository impact could not be confirmed. See the candidate assessment and its limitations below.

Issue details

• Current version: GHSA-m9gg-hp2v-232j — Not yet confirmed. No supported repository applicability evidence was provided for this advisory.

What we checked

No compromise or malicious behavior found in 1.14.5. Complete baseline comparison of the shipped tree: identical inventory, unchanged entry point build/src/index.js and unchanged dependency declarations; the only content differences are the 13 changed modules plus the version field. All changed source and compiled code implements the advisory fix and hardening/perf refactors with no hidden capability.

• @grpc/grpc-js@1.14.5: reviewed files — done; checked installation — not confirmed; ran the package — not confirmed; compared with the current version — done.
  • Static review only; the package was not installed or executed (preparation reports execution unavailable).
  • Candidate ships CRLF line endings in 67 src/*.ts files, package.json, LICENSE, README.md and 6 proto files while the base uses LF; comparisons were made on normalized content, and build/**.js are LF in both trees.
  • Content comparison used per-directory/per-prefix aggregate digests plus per-file sha256 for every differing group; the inventory is identical (681 files) so no added or removed file can hide.
  • Two src/*.ts files were read beyond the changed regions only through their full-file unified diffs; unmodified modules were reviewed in the base-baseline sense (byte-identical in the candidate).
  • Repository inspection was limited to manifests, lockfile, workspace config, Dockerfile and import sites; repository docs (AGENT.md, BUILD_PLAN.md) and.env were treated as untrusted/secret and not used as instructions or read for content.
  • base execution unavailable: Exact package is not present in a successfully installed frozen repository tree.
  • candidate execution unavailable: Exact package is not present in a successfully installed frozen repository tree.
• Current source: 7bb2c963cfb7; update source: 0ce2a772d45d.

Release notes

@grpc/grpc-js@1.14.5

Compare Source

• Fix a bug that caused clients to automatically transmit excessive error details to clients by default (advisory GHSA-f596-whhp-79r4)
• Fix a bug that caused getAuthContext to return unverified certificates as though they were verified in some configurations (advisory GHSA-m9gg-hp2v-232j)
• Fix a bug that could cause stale call data to accumulate if a channel failed to connect for a long period of time (#​3078)
• Fix a bug that could cause call status to be reported with expected fields missing (#​3079)
• Avoid redundant end() calls on completed HTTP/2 streams (#​3082 contributed by @​olavloite)
• Unify call numbers and avoid disabled trace allocations (#​3084 contributed by @​olavloite)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openmetal	Ready	Preview	Oct 26, 2026 2:30am UTC

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.