[w1am]

No description provided.

[coderabbitai]

Walkthrough

The secure gRPC connector removes servername when it contains an IP address. The .nvmrc file now selects the latest Node.js LTS release.

Changes: Secure gRPC Connector

Layer / File(s)	Summary
Secure connector IP handling .github/files/.nvmrc, packages/db-client/src/Client/index.ts	The secure connector wrapper removes servername when isIP identifies it as an IP address. The Node.js version selection changes from 24 to lts/*.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related PRs

• kurrent-io/KurrentDB-Client-NodeJS#529: Pins Node 24 for a gRPC TLS server-name behavior that this change addresses.
• kurrent-io/KurrentDB-Client-NodeJS#531: Uses .github/files/.nvmrc to select Node.js in the publishing workflow.

Merge Risk: Moderate · up to a14b0

The Windows build fails with the selected Node version. Fix Corepack setup before merging.

Security architecture risk: Low · up to a14b0

The change is narrowly scoped and preserves configured certificate and verification inputs. No certificate-verification bypass was demonstrated, but the workaround depends on undocumented gRPC connector internals whose compatibility across supported versions is not fully established.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The directly affected boundary is each Client’s outbound secure grpc-js traffic to configured or discovered endpoints. The wrapper does not modify a global TLS implementation or introduce an inbound entrypoint. Deployment-specific tenant, asset, and credential exposure cannot be quantified from the supplied scope.

Trust Boundaries and Controls

• inferred — Attributed upstream inspections indicate that grpc-js retains the endpoint host and Node 26 uses host for certificate identity verification when servername is absent. For that inspected behavior, deleting an IP-valued servername does not itself let an endpoint present an unrelated certificate. This conclusion remains conditional on the dependency retaining those semantics and on the caller’s existing verification configuration.

Resilience and Maintainability Implications

• inferred — The mutation occurs synchronously after the original connector returns and is idempotent once servername is absent. Attributed grpc-js 1.14.3 inspection supports per-connector option allocation, limiting cross-attempt contamination despite credential reuse. Equivalent ownership and property-shape guarantees across future permitted dependency versions remain unproven.

Hardening Proposals

• proposed — Validate the workaround against supported Node and resolved grpc-js versions with both matching and mismatching IP certificates, custom verification callbacks, and repeated or concurrent connector creation. This would provide executable evidence for identity enforcement and option ownership rather than relying solely on private implementation details.

Pre-merge checks: 3

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[w1am]

Waiting on the upstream fix instead: grpc/grpc-node#3127. Unpin .nvmrc once a grpc-js release includes it