Skip to content

grpc: Enable shared write buffers by default - #8957

Merged
arjan-bal merged 2 commits into
grpc:masterfrom
arjan-bal:enable-write-pool-by-default
Mar 9, 2026
Merged

grpc: Enable shared write buffers by default#8957
arjan-bal merged 2 commits into
grpc:masterfrom
arjan-bal:enable-write-pool-by-default

Conversation

@arjan-bal

@arjan-bal arjan-bal commented Mar 6, 2026

Copy link
Copy Markdown
Contributor

gRPC is already using pooled buffers extensively. These write buffers can hold more than 20% of the "in use" memory when using LB policies like roundrobin, least request etc. The pools help releasing the memory when a subchannel is inactive.

Benchmarks

There is no significant performance difference in the local benchmarks.

Before

go1.24.13/grpc1.80.0-dev
streaming-networkMode_Local-bufConn_true-keepalive_false-benchTime_2m0s-trace_false-latency_0s-kbps_0-MTU_0-maxConcurrentC
alls_120-reqSize_1024B-respSize_1024B-compressor_off-channelz_false-preloader_false-clientReadBufferSize_-1-clientWriteBuf
ferSize_-1-serverReadBufferSize_-1-serverWriteBufferSize_-1-sleepBetweenRPCs_0s-connections_1-recvBufferPool_simple-shared
WriteBuffer_false:
50_Latency: 344.0650µs  90_Latency: 478.0550µs  99_Latency: 884.7730µs  Avg_Latency: 354.6700µs Bytes/op: 4964.3704955955A
llocs/op: 19.35011915747468
Histogram (unit: µs)
Count: 40403676  Min:   9.7  Max: 213729.4  Avg: 354.67
------------------------------------------------------------
[        9.742000,         9.743000)         1    0.0%    0.0%  
[        9.743000,         9.750424)         0    0.0%    0.0%  
[        9.750424,         9.812970)         0    0.0%    0.0%  
[        9.812970,        10.339881)         3    0.0%    0.0%  
[       10.339881,        14.778782)      1522    0.0%    0.0%  
[       14.778782,        52.173796)     39748    0.1%    0.1%  
[       52.173796,       367.203851)  23974441   59.3%   59.4%  ######
[      367.203851,      3021.138790)  16383483   40.5%  100.0%  ####
[     3021.138790,     25378.912455)      3968    0.0%  100.0%  
[    25378.912455,    213729.439000)       509    0.0%  100.0%  
[   213729.439000,   1800467.071380)         1    0.0%  100.0%  
Number of requests:  40403676   Request throughput:  2.7582242816e+09 bit/s
Number of responses: 40403676   Response throughput: 2.7582242816e+09 bit/s

After

go1.24.13/grpc1.80.0-dev
streaming-networkMode_Local-bufConn_true-keepalive_false-benchTime_2m0s-trace_false-latency_0s-kbps_0-MTU_0-maxConcurrentC
alls_120-reqSize_1024B-respSize_1024B-compressor_off-channelz_false-preloader_false-clientReadBufferSize_-1-clientWriteBuf
ferSize_-1-serverReadBufferSize_-1-serverWriteBufferSize_-1-sleepBetweenRPCs_0s-connections_1-recvBufferPool_simple-shared
WriteBuffer_true:
50_Latency: 346.4820µs  90_Latency: 478.2350µs  99_Latency: 695.2270µs  Avg_Latency: 353.1640µs Bytes/op: 4972.45957928533
5       Allocs/op: 19.64101560175674
Histogram (unit: µs)
Count: 40619977  Min:  10.1  Max: 74013.3  Avg: 353.16
------------------------------------------------------------
[      10.103000,       10.104000)         1    0.0%    0.0%  
[      10.104000,       10.110488)         0    0.0%    0.0%  
[      10.110488,       10.159069)         2    0.0%    0.0%  
[      10.159069,       10.522840)         5    0.0%    0.0%  
[      10.522840,       13.246726)       612    0.0%    0.0%  
[      13.246726,       33.642970)     15498    0.0%    0.0%  
[      33.642970,      186.368403)   2763883    6.8%    6.8%  #
[     186.368403,     1329.964187)  37638929   92.7%   99.5%  #########
[    1329.964187,     9893.117609)    200384    0.5%  100.0%  
[    9893.117609,    74013.323000)       662    0.0%  100.0%  
[   74013.323000,   554140.273508)         1    0.0%  100.0%  
Number of requests:  40619977   Request throughput:  2.772990429866667e+09 bit/s
Number of responses: 40619977   Response throughput: 2.772990429866667e+09 bit/s

RELEASE NOTES:

@arjan-bal arjan-bal added this to the 1.80 Release milestone Mar 6, 2026
@arjan-bal
arjan-bal requested a review from easwars March 6, 2026 17:25
@arjan-bal arjan-bal added Type: Performance Performance improvements (CPU, network, memory, etc) Area: Transport Includes HTTP/2 client/server and HTTP server handler transports and advanced transport features. labels Mar 6, 2026
@arjan-bal
arjan-bal force-pushed the enable-write-pool-by-default branch from 6744c60 to e690776 Compare March 6, 2026 17:27
@codecov

codecov Bot commented Mar 6, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.62%. Comparing base (b6597b3) to head (0ba7506).
⚠️ Report is 7 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #8957      +/-   ##
==========================================
- Coverage   83.42%   82.62%   -0.80%     
==========================================
  Files         410      410              
  Lines       32572    32573       +1     
==========================================
- Hits        27172    26914     -258     
- Misses       4030     4065      +35     
- Partials     1370     1594     +224     
Files with missing lines Coverage Δ
dialoptions.go 87.09% <100.00%> (-1.98%) ⬇️
server.go 62.73% <ø> (-20.01%) ⬇️

... and 23 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@easwars easwars left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we have a single release note that mentions the details for both client and server instead of two separate ones. Thanks.

@easwars easwars assigned arjan-bal and unassigned easwars Mar 6, 2026
@arjan-bal
arjan-bal merged commit 1acfea8 into grpc:master Mar 9, 2026
15 checks passed
arjan-bal added a commit to arjan-bal/grpc-go that referenced this pull request Mar 24, 2026
gRPC is already using pooled buffers extensively. These write buffers
can hold more than 20% of the "in use" memory when using LB policies
like roundrobin, least request etc. The pools help releasing the memory
when a subchannel is inactive.

## Benchmarks

There is no significant performance difference in the local benchmarks.

Before
```
go1.24.13/grpc1.80.0-dev
streaming-networkMode_Local-bufConn_true-keepalive_false-benchTime_2m0s-trace_false-latency_0s-kbps_0-MTU_0-maxConcurrentC
alls_120-reqSize_1024B-respSize_1024B-compressor_off-channelz_false-preloader_false-clientReadBufferSize_-1-clientWriteBuf
ferSize_-1-serverReadBufferSize_-1-serverWriteBufferSize_-1-sleepBetweenRPCs_0s-connections_1-recvBufferPool_simple-shared
WriteBuffer_false:
50_Latency: 344.0650µs  90_Latency: 478.0550µs  99_Latency: 884.7730µs  Avg_Latency: 354.6700µs Bytes/op: 4964.3704955955A
llocs/op: 19.35011915747468
Histogram (unit: µs)
Count: 40403676  Min:   9.7  Max: 213729.4  Avg: 354.67
------------------------------------------------------------
[        9.742000,         9.743000)         1    0.0%    0.0%  
[        9.743000,         9.750424)         0    0.0%    0.0%  
[        9.750424,         9.812970)         0    0.0%    0.0%  
[        9.812970,        10.339881)         3    0.0%    0.0%  
[       10.339881,        14.778782)      1522    0.0%    0.0%  
[       14.778782,        52.173796)     39748    0.1%    0.1%  
[       52.173796,       367.203851)  23974441   59.3%   59.4%  ######
[      367.203851,      3021.138790)  16383483   40.5%  100.0%  ####
[     3021.138790,     25378.912455)      3968    0.0%  100.0%  
[    25378.912455,    213729.439000)       509    0.0%  100.0%  
[   213729.439000,   1800467.071380)         1    0.0%  100.0%  
Number of requests:  40403676   Request throughput:  2.7582242816e+09 bit/s
Number of responses: 40403676   Response throughput: 2.7582242816e+09 bit/s
```

After
```
go1.24.13/grpc1.80.0-dev
streaming-networkMode_Local-bufConn_true-keepalive_false-benchTime_2m0s-trace_false-latency_0s-kbps_0-MTU_0-maxConcurrentC
alls_120-reqSize_1024B-respSize_1024B-compressor_off-channelz_false-preloader_false-clientReadBufferSize_-1-clientWriteBuf
ferSize_-1-serverReadBufferSize_-1-serverWriteBufferSize_-1-sleepBetweenRPCs_0s-connections_1-recvBufferPool_simple-shared
WriteBuffer_true:
50_Latency: 346.4820µs  90_Latency: 478.2350µs  99_Latency: 695.2270µs  Avg_Latency: 353.1640µs Bytes/op: 4972.45957928533
5       Allocs/op: 19.64101560175674
Histogram (unit: µs)
Count: 40619977  Min:  10.1  Max: 74013.3  Avg: 353.16
------------------------------------------------------------
[      10.103000,       10.104000)         1    0.0%    0.0%  
[      10.104000,       10.110488)         0    0.0%    0.0%  
[      10.110488,       10.159069)         2    0.0%    0.0%  
[      10.159069,       10.522840)         5    0.0%    0.0%  
[      10.522840,       13.246726)       612    0.0%    0.0%  
[      13.246726,       33.642970)     15498    0.0%    0.0%  
[      33.642970,      186.368403)   2763883    6.8%    6.8%  #
[     186.368403,     1329.964187)  37638929   92.7%   99.5%  #########
[    1329.964187,     9893.117609)    200384    0.5%  100.0%  
[    9893.117609,    74013.323000)       662    0.0%  100.0%  
[   74013.323000,   554140.273508)         1    0.0%  100.0%  
Number of requests:  40619977   Request throughput:  2.772990429866667e+09 bit/s
Number of responses: 40619977   Response throughput: 2.772990429866667e+09 bit/s
```

RELEASE NOTES:
* grpc: Enable shared write buffers by default. Use the the
[WithSharedWriteBuffer](https://pkg.go.dev/google.golang.org/grpc#WithSharedWriteBuffer)
dial option or the
[SharedWriteBuffer](https://pkg.go.dev/google.golang.org/grpc#SharedWriteBuffer)
server option to disable it.
arjan-bal added a commit that referenced this pull request Mar 24, 2026
Original PR: #8957 

RELEASE NOTES:
* grpc: Enable shared write buffers by default. Use the
[WithSharedWriteBuffer](https://pkg.go.dev/google.golang.org/grpc#WithSharedWriteBuffer)
dial option or the
[SharedWriteBuffer](https://pkg.go.dev/google.golang.org/grpc#SharedWriteBuffer)
server option to disable it.
alliasgher added a commit to alliasgher/grpc-go that referenced this pull request Apr 13, 2026
Since grpc#8957 shared write buffers are always enabled by default.
Passing false is no longer beneficial, so the options are now
deprecated and will be removed in a future release.

Fixes grpc#8966

Signed-off-by: Ali <alliasgher123@gmail.com>
alliasgher added a commit to alliasgher/grpc-go that referenced this pull request Apr 14, 2026
Since grpc#8957 shared write buffers are always enabled by default.
Passing false is no longer beneficial, so the options are now
deprecated and will be removed in a future release.

Fixes grpc#8966

Signed-off-by: Ali <alliasgher123@gmail.com>
easwars pushed a commit that referenced this pull request Apr 16, 2026
Since #8957 shared write buffers are always enabled by default and
passing `false` is no longer beneficial. This PR deprecates both options
per the request in #8966, replacing the `# Experimental` notice with a
`Deprecated:` godoc comment consistent with the pattern used elsewhere
in `dialoptions.go` and `server.go`.

The options are left functional for now; removal can follow in a
subsequent release.

Fixes #8966

RELEASE NOTES:
* grpc: deprecate `WithSharedWriteBuffer` dial option and
`SharedWriteBuffer` server option; shared write buffers are now always
enabled.
goingforstudying-ctrl added a commit to goingforstudying-ctrl/grpc-go that referenced this pull request Jun 21, 2026
Since grpc#8957 shared write buffers are always enabled by default and
passing `false` is no longer beneficial. This PR deprecates both options
per the request in grpc#8966, replacing the `# Experimental` notice with a
`Deprecated:` godoc comment consistent with the pattern used elsewhere
in `dialoptions.go` and `server.go`.

The options are left functional for now; removal can follow in a
subsequent release.

Fixes grpc#8966

RELEASE NOTES:
* grpc: deprecate `WithSharedWriteBuffer` dial option and
`SharedWriteBuffer` server option; shared write buffers are now always
enabled.
nschloe pushed a commit to live-clones/forgejo that referenced this pull request Jul 23, 2026
…/forgejo) (#13580)

This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `v1.79.3` → `v1.82.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fgrpc/v1.82.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fgrpc/v1.79.3/v1.82.1?slim=true) |

---

### gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
[GHSA-hrxh-6v49-42gf](GHSA-hrxh-6v49-42gf)

<details>
<summary>More information</summary>

#### Details
Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in:

- Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing `Metadata` or `RequestedServerName` fields.
- Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream resets.
- Denial of Service (Server Panic) when parsing crafted xDS RBAC policies containing `NOT` rules around unsupported fields.

##### Impact
_What kind of vulnerability is it? Who is impacted?_

##### xDS RBAC Authorization Bypass via `Metadata` & `RequestedServerName` matchers

- Affected Component: xDS RBAC
- Impact: When building policy matchers for gRPC RBAC from xDS configurations, unsupported `permission` and `principal` rules (specifically `Metadata` and `RequestedServerName`) were silently ignored and treated as no-ops.
  - If an authorization policy relied purely on these matchers for access control, treating those rules as no-ops effectively removed the restrictions.
- If these unsupported rules were nested inside logical `NOT` rules (`Permission_NotRule` / `Principal_NotId`) or multi-condition `OR/AND` rules, silently dropping them changed the boolean logic flow of the authorization engine.

As a result, policy evaluation decisions could fail open, allowing unauthorized clients to access protected gRPC services or resources.

##### HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts

- Affected Component: HTTP/2 transport
- Impact: Earlier mitigations in grpc-go for HTTP/2 Rapid Reset only applied threshold checks to items that directly resulted in control frames being written back to the wire, such as `SETTINGS` ACKs or server-initiated `RST_STREAM`s.

When a client initiated a rapid flood of stream creation (`HEADERS`) immediately followed by stream termination `RST_STREAM`, items queued up in the control buffer without counting against the transport response frame threshold. An attacker can repeatedly trigger this flood sequence to bypass reader blocking, resulting in high CPU usage, and Denial of Service (DoS).

##### Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules

- Affected Component: xDS RBAC
- Impact: The xDS RBAC policy translators recursively generate matchers for nested rules. When a `NOT` rule wrapped an unsupported or unhandled field (such as `SourcedMetadata`), the recursive step returned an empty matcher. This could result in a runtime panic when the RBAC engine attempts to authorize an incoming request.

An attacker or misconfigured/malicious xDS management server delivering an LDS/RDS update containing a `NOT` rule around an unhandled field causes the gRPC server process to crash immediately (CWE-248 / Denial of Service).

##### Patches
_Has the problem been patched? What versions should users upgrade to?_

All three issues have been fixed in `master` and will be released in 1.82.1 shortly.

##### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

If upgrading grpc-go immediately is not possible, apply the following workarounds based on your deployment architecture:

* For xDS RBAC Vulnerabilities & Panics: Ensure that upstream xDS management servers do not push RBAC policies containing `Metadata`, `RequestedServerName`, or `NOT` rules wrapping unsupported fields (such as `SourcedMetadata`) to grpc-go servers.
* For HTTP/2 Rapid Reset DOS: Configure upstream reverse proxies or load balancers (such as Envoy) with strict HTTP/2 `max_concurrent_streams` limits and active rate limiting on `RST_STREAM` frequency per connection.

##### Severity

  | Vulnerability | Qualitative Severity | Approximate CVSS v3.1 Score | Primary Impact |
  | :--- | :--- | :--- | :--- |
  | **xDS RBAC Authorization Bypass** | **High** | `8.2` | Unauthorized Access / Fail-Open |
  | **HTTP/2 Rapid Reset DOS Bypass** | **High** | `7.5` | High CPU Consumption / Denial of Service |
  | **xDS RBAC Engine Server Panic** | **Medium** | `5.9` | Process Crash / Denial of Service |

#### Severity
- CVSS Score: 8.8 / 10 (High)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N`

#### References
- [https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf](https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf)
- [https://github.com/grpc/grpc-go/pull/9236](https://github.com/grpc/grpc-go/pull/9236)
- [https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935](https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935)
- [https://github.com/grpc/grpc-go](https://github.com/grpc/grpc-go)
- [https://github.com/grpc/grpc-go/releases/tag/v1.82.1](https://github.com/grpc/grpc-go/releases/tag/v1.82.1)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>grpc/grpc-go (google.golang.org/grpc)</summary>

### [`v1.82.1`](https://github.com/grpc/grpc-go/releases/tag/v1.82.1): Release 1.82.1

[Compare Source](grpc/grpc-go@v1.82.0...v1.82.1)

### Security

- server: Stop reading from the connection when flooded by HTTP/2 frames.  The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable `GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT`.
- xds/rbac: Support `Metadata` and `RequestedServerName` permissions matcher fields.  If present in a DENY rule, previously these would be ignored and fail-open.
- xds/rbac: Fix panic when parsing unsupported fields in `NotRule`/`NotId` permissions.
- xds/rbac: Support the deprecated `source_ip` principal identifier by treating it as equivalent to `direct_remote_ip`.

### [`v1.82.0`](https://github.com/grpc/grpc-go/releases/tag/v1.82.0): Release 1.82.0

[Compare Source](grpc/grpc-go@v1.81.1...v1.82.0)

### Behavior Changes

- server: Remove support for `GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING` environment varibale. Strict incoming RPC path validation (which has been the default since `v1.79.3`) can no longer be disabled. ([#&#8203;9112](grpc/grpc-go#9112))
- transport: Add environment variable to change the default max header list size from `16MB` to `8KB`. This may be enabled by setting `GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true`. This will be enabled by default in a subsequent release. ([#&#8203;9019](grpc/grpc-go#9019))
- balancer: Load Balancing policy registry is now case-sensitive.  Set `GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false` (and file an issue) to revert to case-insensitive behavior. ([#&#8203;9017](grpc/grpc-go#9017))

### New Features

- experimental/stats: Expose a new API, `NewContextWithLabelCallback`, to register a callback that is invoked when telemetry labels are added. ([#&#8203;8877](grpc/grpc-go#8877))
  - Special Thanks: [@&#8203;seth-epps](https://github.com/seth-epps)
- client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. ([#&#8203;8929](grpc/grpc-go#8929))
  - Special Thanks: [@&#8203;chengxilo](https://github.com/chengxilo)
- server: Add environment variable `GRPC_GO_SERVER_GOROUTINE_LABELS` that controls setting `runtime/pprof.Labels` on goroutines spawned by the server. Set `GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true` to add the `grpc.method` label on goroutines spawned to handle incoming requests. ([#&#8203;9082](grpc/grpc-go#9082))
  - Special Thanks: [@&#8203;dfinkel](https://github.com/dfinkel)

### Bug Fixes

- xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. ([#&#8203;9138](grpc/grpc-go#9138))
- grpc: In the deprecated `gzip` Compressor (used via the deprecated `WithCompressor` dial option), enforce the `MaxRecvMsgSize` limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. ([#&#8203;9114](grpc/grpc-go#9114))
  - Special Thanks: [@&#8203;evilgensec](https://github.com/evilgensec)
- stats/opentelemetry: Record retry attempts, `grpc.previous-rpc-attempts`, at the call level and not the attempt level. ([#&#8203;8923](grpc/grpc-go#8923))
- encoding: Ensure `Close()` is always called on readers returned from `Compressor.Decompress` if possible. ([#&#8203;9135](grpc/grpc-go#9135))
- channelz: Fix the `LastMessageSentTimestamp` and `LastMessageReceivedTimestamp` fields in `SocketMetrics` to ensure they contain correct timestamp values. ([#&#8203;9109](grpc/grpc-go#9109))

### [`v1.81.1`](https://github.com/grpc/grpc-go/releases/tag/v1.81.1): Release 1.81.1

[Compare Source](grpc/grpc-go@v1.81.0...v1.81.1)

### Security

- xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per [gRFC A41](https://github.com/grpc/proposal/blob/master/A41-xds-rbac.md). ([#&#8203;9111](grpc/grpc-go#9111))
  - Special Thanks: [@&#8203;al4an444](https://github.com/al4an444)

### Bug Fixes

- otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. ([#&#8203;9081](grpc/grpc-go#9081))

### [`v1.81.0`](https://github.com/grpc/grpc-go/releases/tag/v1.81.0): Release 1.81.0

[Compare Source](grpc/grpc-go@v1.80.0...v1.81.0)

### Behavior Changes

- balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. ([#&#8203;8808](grpc/grpc-go#8808))

### Dependencies

- Minimum supported Go version is now 1.25. ([#&#8203;8969](grpc/grpc-go#8969))

### Bug Fixes

- xds: Use the leaf cluster's security config for the TLS handshake instead of the aggregate cluster's config. ([#&#8203;8956](grpc/grpc-go#8956))
- transport: Send a `RST_STREAM` when receiving an `END_STREAM` when the stream is not already half-closed. ([#&#8203;8832](grpc/grpc-go#8832))
- xds: Fix ADS resource name validation to prevent a panic. ([#&#8203;8970](grpc/grpc-go#8970))

### New Features

- grpc/stats: Add support for custom labels in per-call metrics ([gRFC A108](https://github.com/grpc/proposal/blob/master/A108-otel-custom-per-call-label.md)). ([#&#8203;9008](grpc/grpc-go#9008))
- xds: Add support for Server Name Indication (SNI) and SAN validation ([gRFC A101](https://github.com/grpc/proposal/blob/master/A101-SNI-setting-and-SNI-SAN-validation.md)). Disabled by default. To enable, set `GRPC_EXPERIMENTAL_XDS_SNI=true` environment variable. ([#&#8203;9016](grpc/grpc-go#9016))
- xds: Add support to control which fields get propagated from ORCA backend metric reports to LRS load reports ([gRFC A85](https://github.com/grpc/proposal/blob/master/A85-lrs-custom-metrics-changes.md)). Disabled by default. To enable, set `GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION=true`. ([#&#8203;9005](grpc/grpc-go#9005))
- xds: Add metrics to track xDS client connectivity and cached resource state ([gRFC A78](https://github.com/grpc/proposal/blob/master/A78-grpc-metrics-wrr-pf-xds.md)). ([#&#8203;8807](grpc/grpc-go#8807))
- stats/otel: Enhance `grpc.subchannel.disconnections` metric by adding disconnection reason to the `grpc.disconnect_error` label ([gRFC A94](https://github.com/grpc/proposal/blob/master/A94-subchannel-otel-metrics.md)). This provides granular insights into why subchannels are closing. ([#&#8203;8973](grpc/grpc-go#8973))
- mem: Add `mem.Buffer.Slice()` API to slice the buffer like a slice. ([#&#8203;8977](grpc/grpc-go#8977))
  - Special Thanks: [@&#8203;ash2k](https://github.com/ash2k)

### Performance Improvements

- alts: Pool read buffers to lower memory utilization when sockets are unreadable. ([#&#8203;8964](grpc/grpc-go#8964))
- transport: Pool HTTP/2 framer read buffers to reduce idle memory consumption. Currently limited to Linux for ALTS and non-encrypted transports (TCP, Unix). To disable, set `GRPC_GO_EXPERIMENTAL_HTTP_FRAMER_READ_BUFFER_POOLING=false` and report any issues. ([#&#8203;9032](grpc/grpc-go#9032))

### [`v1.80.0`](https://github.com/grpc/grpc-go/releases/tag/v1.80.0): Release 1.80.0

[Compare Source](grpc/grpc-go@v1.79.3...v1.80.0)

### Behavior Changes

- balancer: log a warning if a balancer is registered with uppercase letters, as balancer names should be lowercase. In a future release, balancer names will be treated as case-insensitive; see [#&#8203;5288](grpc/grpc-go#5288) for details. ([#&#8203;8837](grpc/grpc-go#8837))
- xds: update resource error handling and re-resolution logic ([#&#8203;8907](grpc/grpc-go#8907))
  - Re-resolve all `LOGICAL_DNS` clusters simultaneously when re-resolution is requested.
  - Fail all in-flight RPCs immediately upon receipt of listener or route resource errors, instead of allowing them to complete.

### Bug Fixes

- xds: support the LB policy configured in `LOGICAL_DNS` cluster resources instead of defaulting to `pick_first`. ([#&#8203;8733](grpc/grpc-go#8733))
- credentials/tls: perform per-RPC authority validation against the leaf certificate instead of the entire peer certificate chain. ([#&#8203;8831](grpc/grpc-go#8831))
- xds: enabling A76 ring hash endpoint keys no longer causes EDS resources with invalid proxy metadata to be NACKed when HTTP CONNECT (gRFC A86) is disabled. ([#&#8203;8875](grpc/grpc-go#8875))
- xds: validate that the sum of endpoint weights in a locality does not exceed the maximum `uint32` value. ([#&#8203;8899](grpc/grpc-go#8899))
  - Special Thanks: [@&#8203;RAVEYUS](https://github.com/RAVEYUS)
- xds: fix incorrect proto field access in the weighted round robin (WRR) configuration where `blackout_period` was used instead of `weight_expiration_period`. ([#&#8203;8915](grpc/grpc-go#8915))
  - Special Thanks: [@&#8203;gregbarasch](https://github.com/gregbarasch)
- xds/rbac: handle addresses with ports in IP matchers. ([#&#8203;8990](grpc/grpc-go#8990))

### New Features

- ringhash: enable gRFC A76 (endpoint hash keys and request hash headers) by default. ([#&#8203;8922](grpc/grpc-go#8922))

### Performance Improvements

- credentials/alts: pool write buffers to reduce memory allocations and usage. ([#&#8203;8919](grpc/grpc-go#8919))
- grpc: enable the use of pooled write buffers for buffering HTTP/2 frame writes by default. This reduces memory usage when connections are idle. Use the [WithSharedWriteBuffer](https://pkg.go.dev/google.golang.org/grpc#WithSharedWriteBuffer) dial option or the [SharedWriteBuffer](https://pkg.go.dev/google.golang.org/grpc#SharedWriteBuffer) server option to disable this feature. ([#&#8203;8957](grpc/grpc-go#8957))
- xds/priority: stop caching child LB policies removed from the configuration. This will help reduce memory and cpu usage when localities are constantly switching between priorities. ([#&#8203;8997](grpc/grpc-go#8997))
- mem: add a faster tiered buffer pool; use the experimental [mem.NewBinaryTieredBufferPool](https://pkg.go.dev/google.golang.org/grpc/mem@master#NewBinaryTieredBufferPool) function to create such pools. ([#&#8203;8775](grpc/grpc-go#8775))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzIuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI3Mi4wIiwidGFyZ2V0QnJhbmNoIjoidjE2LjAvZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13580
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Area: Transport Includes HTTP/2 client/server and HTTP server handler transports and advanced transport features. Type: Performance Performance improvements (CPU, network, memory, etc)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants