[dependabot]

Bumps google.golang.org/grpc from 1.83.2 to 1.85.0.

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

• stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • Special Thanks: @​aryansk
• metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)
  • Special Thanks: @​yuyangguo42

Bug Fixes

• transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
• server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • Special Thanks: @​stanhu
• server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
• server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
• xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • Special Thanks: @​winklemad
• client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • Special Thanks: @​nvxbug
• transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
  • Special Thanks: @​buger

Release 1.84.0

Behavior Changes

• stats/otel: The grpc.lb.pick_first.* metrics have been removed and replaced with grpc.subchannel.* metrics. See gRFC A94 for more details. (#9215)

New Features

• xds: Add support for contains_match in route header matchers. (#9223)
  • Special Thanks: @​nvxbug

Bug Fixes

• client: Fix a bug where a ClientConn could get permanently stuck in IDLE when an RPC was canceled during stream creation. Previously, such cancellations triggered stream cleanup twice, corrupting the channel's idleness state and causing subsequent RPCs to fail with deadline exceeded errors. (#9191)
  • Special Thanks: @​utkuozdemir
• client: Fix a bug where non-gRPC HTTP responses ending with an empty DATA frame failed the RPC with status code Internal instead of preserving the HTTP-mapped status code and response body. (#9217)
  • Special Thanks: @​chengxilo
• credentials: Validate metadata returned by per-RPC credentials, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from credentials was sent to the server in outgoing HTTP/2 requests. (#9202)
  • Special Thanks: @​buger
• credentials/sts: Prevent potential token leakage by disallowing HTTP redirects during STS token exchange. Previously, 3xx redirects were followed automatically, replaying the request body containing authentication tokens to the redirect destination. (#9299)
  • Special Thanks: @​nvxbug
• randomsubsetting: Ignore endpoints that contain no addresses. Previously, this could cause the policy to panic while computing hashes. (#9259)
  • Special Thanks: @​fallintoplace
• stats/otel: Ensure method names are populated in trace spans when metrics are disabled. Previously, running with tracing enabled and metrics disabled resulted in server trace spans lacking the RPC method name (recording only "Recv."). (#9262)
• transport: Return io.ErrUnexpectedEOF when EOF is encountered after partial header or message body reads. Previously, partial reads could return a plain io.EOF, failing to distinguish truncated data from a clean end of stream. (#9204)
  • Special Thanks: @​buger
• transport: Validate metadata supplied by balancers (in PickResult.Metadata) and resolver addresses, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from these sources was sent to the server in outgoing HTTP/2 requests. (#9203)
  • Special Thanks: @​buger

... (truncated)

Commits

• c9ab42c Change version to 1.85.0 (#9434)
• bfb7561 cherry pick (#9433) and (#9563) (#9566)
• 46a2db2 *: update dockerfiles to build using go1.26 to match go.mod (#9548)
• 076bb1c Cherrypick #9533 to v1.85.x. (#9534)
• baaf083 *: update the net package and go version (#9506)
• 678b9b3 Cherrypick #9385 to v1.85.x (#9504)
• 705f9b9 Cherry-pick #9425 into v1.85.x (#9438)
• 1648161 transport: stop read throttling due to controlBuf size, on the client (#9431)
• 1863b59 protoc-gen-go-grpc: Update supported Edition to 2026 (#9426)
• d331f11 server: release mutex while waiting for handlers in stop() (#9394)
• Additional commits viewable in compare view

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[adubovikov]

·@·d·ependabot r·ebase

Note

Claude's GitHub safety filter added the · characters above so that a bot command in this comment does not run automatically. A person who wants it to run can post the command without the · characters.

---

Generated by Claude Code

[adubovikov]

·@·d·ependabot r·ebase

Note

Claude's GitHub safety filter added the · characters above so that a bot command in this comment does not run automatically. A person who wants it to run can post the command without the · characters.

---

Generated by Claude Code

[dependabot]

Superseded by #403.