gRPC for Node.js 1.13

Apply the Node.js 24 and JavaScript ES2026 prompts first. These rules cover the @grpc/grpc-js 1.13 release line: its credential APIs, the resource limits its defaults leave open, retry and deadline behavior, proxy and name resolution, interceptors, channelz, and the experimental API shape specific to this line.

Version scope

• Run the newest grpc-js 1.13 patch and take each one as it ships. gRPC supports only its newest release line and the one before it, backporting security fixes to both and further back only for severe flaws, so plan the move to a newer line before 1.13 falls out of that window.
• Treat engines.node >= 12.10.0 as a floor the library tolerates, not a target. Run 1.13 on a Node release still receiving security updates and inherit that runtime's TLS and HTTP/2 fixes.
• 1.13 depends on @grpc/proto-loader at ^0.7.13, which resolves protobufjs inside ^7.2.5. That range will never pick up proto-loader 0.8.x, so audit every resolved copy of both packages against advisories rather than assuming that upgrading grpc-js or adding a newer top-level proto-loader updates the decoder actually used.
• Do not write against 1.14 APIs on this line. getAuthContext on call objects, custom backend metrics reporting, the weighted_round_robin load balancing policy, and ServerInterceptingCall#getConnectionInfo do not exist in 1.13; code that needs them belongs on 1.14, not on a shim.

Transport credentials

• Use ChannelCredentials.createSsl and ServerCredentials.createSsl for every channel and listener outside a loopback development boundary.