[qt/qt/qtgrpc]: Summary of bulk changes made

Git repository change summary for qt/qt/qtgrpc
Pushed by mirror-service into branch 'dev'.
Changed from 059cb40094d731221cc4f2d0aef8235d1a418d4b to d4b8b92a2968cfd811b8a1d3f15f874f04881ccf
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 9301338272f5d90dd7955e8ed7ebd2d2cfd01dd7 by Dennis Oberst on 17/08/2026 at 13:13..
QGrpcHttp2Channel: add reconnect backoff and connect timeout

QtGrpc reconnected immediately after every connection failure, with no
delay between attempts. A flapping or malicious server could therefore
drive the client into an unbounded, tight reconnect loop, exhausting
file descriptors, CPU, and network bandwidth (availability / DoS).

Add QGrpcChannelOptions::setInitialReconnectBackoff() and
setMaximumReconnectBackoff() to rate-limit reconnection attempts with
exponential backoff and jitter, and setConnectTimeout() to bound
how long a single attempt may hang before it is aborted. Defaults match
the gRPC specification: 1 s initial, 120 s maximum, 20 s connect
timeout. The backoff resets once the server acknowledges the connection
via the HTTP/2 SETTINGS frame.

QT_GRPC_INITIAL_RECONNECT_BACKOFF_MS,
QT_GRPC_MAXIMUM_RECONNECT_BACKOFF_MS, and
QT_GRPC_CONNECT_TIMEOUT_MS provide global fallbacks.

Move QGrpcChannelOptionsPrivate into a new header. We don't want to
expose the tri-state with the env-var since this is not channel agnostic
and is kept reserved for our own h2channel implementation.

Backport to older branches manually: The env var approach will get
picked back manually, since it's the easiest to avoid conflict hell.

[ChangeLog][QtGrpc][QGrpcChannelOptions] Added
setInitialReconnectBackoff(), setMaximumReconnectBackoff(), and
setConnectTimeout() to rate-limit reconnection attempts after
a connection failure. The defaults (1 s, 120 s, and 20 s) match the
gRPC specification. The environment variables
QT_GRPC_INITIAL_RECONNECT_BACKOFF_MS,
QT_GRPC_MAXIMUM_RECONNECT_BACKOFF_MS, and
QT_GRPC_CONNECT_TIMEOUT_MS provide global overrides.

Fixes: QTBUG-147829
Change-Id: I9f7c6daa8305c69e2b3065abe139ee3ca746286c
Reviewed-by: Ivan Solovev <[email protected]>
Reviewed-by: Mate Barany <[email protected]>
https://invent.kde.org/qt/qt/qtgrpc/-/commit/9301338272f5d90dd7955e8ed7ebd2d2cfd01dd7

Git commit 3a67dac037f6cc16d6e4c059a188c1a6607b8f8e by Dennis Oberst on 17/08/2026 at 13:13..
QGrpcHttp2Channel: add a configurable maximum metadata size

QtGrpc placed no limit on the metadata received from a server, so a
misbehaving or malicious peer could send unbounded response headers and
exhaust client memory (availability / DoS).

Add QGrpcChannelOptions::setMaximumMetadataSize() to bound an incoming
header block. The limit is advertised as the HTTP/2
SETTINGS_MAX_HEADER_LIST_SIZE parameter and enforced by QHttp2Connection
as the block is received, so an oversized block is rejected before it is
fully buffered. It defaults to 16 KiB (matching gRPC), is floored at 4
KiB so the mandatory protocol headers are never rejected, and is clamped
to the 32-bit transport maximum.

The environment variable QT_GRPC_MAXIMUM_METADATA_SIZE provides a global
override useful for operational purposes and backporting without API
changes. It is sampled once at channel construction to avoid acquiring
qEnvironmentVariable's global lock on a hot path.

Backport to older branches manually: pick the default
SETTINGS_MAX_HEADER_LIST_SIZE advertisement and the environment variable,
without the QGrpcChannelOptions API. The receive-side enforcement lives
in QtNetwork (QTBUG-147564) and must be present on the target branch.

[ChangeLog][QtGrpc][QGrpcChannelOptions] Added setMaximumMetadataSize()
to limit the size of metadata received from a server. The default is
16 KiB, matching the gRPC specification. The environment variable
QT_GRPC_MAXIMUM_METADATA_SIZE provides a global override without
requiring code changes.

Task-number: QTBUG-147564
Fixes: QTBUG-147563
Change-Id: I515230205da1bdf0886d76799649dd007619091f
Reviewed-by: Ivan Solovev <[email protected]>
https://invent.kde.org/qt/qt/qtgrpc/-/commit/3a67dac037f6cc16d6e4c059a188c1a6607b8f8e

Git commit d2876ae9d8a1dd98159bedc710b4096841a13ca8 by Dennis Oberst on 17/08/2026 at 13:13..
qgrpcstream: add a messageWritten signal to pace streaming writes

The Http2Handler queues outgoing messages without a size limit. An
application that writes faster than the network transmits, or a peer
that withholds HTTP/2 flow-control credit, grows that queue without
bound and exhausts client memory (availability / DoS).

Emit a signal once per message after QHttp2Stream has fully written it
to the connection, which happens only within the send window the server
granted. Writing the next message in response to the signal therefore
bounds an application to one queued message, the same write-then-wait
discipline as seen in grpc-c++, e.g. ClientWriteReactor::OnWriteDone.

The emission is deferred by one event-loop turn because uploadFinished
fires synchronously from within writeMessage() when the window is open,
and a synchronous emission would re-enter the user's slot. The deferred
lambda re-checks the handler state so the signal never follows
finished().

The client guide's client-streaming example is rewritten to pace with
the signal, and bench_qtgrpcclient gains a --paced mode so the pacing
can be measured against burst writes.

QGrpcOperationContext::messageWritten is the channel-side counterpart;
custom channels must emit it for the stream signals to work.

[ChangeLog][QGrpcClientStream] Added the messageWritten() signal
to QGrpcClientStream and QGrpcBidiStream. It is emitted once per
outgoing message after the channel has handed the message to the
transport, and respects HTTP/2 flow control. Write the next message in
response to it to bound the outgoing queue.

Fixes: QTBUG-147934
Change-Id: Id6f3a6e8271832a8778c901180c4a26558d589a4
Reviewed-by: Ivan Solovev <[email protected]>
https://invent.kde.org/qt/qt/qtgrpc/-/commit/d2876ae9d8a1dd98159bedc710b4096841a13ca8

Git commit 842ecea3f52788aad545529069ff52c048486e92 by Dennis Oberst on 17/08/2026 at 13:13..
QGrpcHttp2Channel: warn when the outgoing message queue keeps growing

The channel queues outgoing messages without a size limit. An
application that writes faster than the network transmits them grows
the queue without bound and eventually exhausts client memory, with no
diagnostic pointing at the cause.

Track the bytes resident in the outgoing queue and warn when they
exceed 16 MiB, doubling the threshold after each report (32, 64 MiB,
...). A steady large upload thus warns once, while a runaway queue
leaves an escalating trail instead of per-write spam. Messages already
dequeued for transmission do not count, so a single large message in
transmission does not trip the warning.

Pick-to: 6.12 6.11 6.8
Task-number: QTBUG-148066
Change-Id: Iba15be8d80aae185ae2ea4d791a308d1b5af2836
Reviewed-by: Ivan Solovev <[email protected]>
https://invent.kde.org/qt/qt/qtgrpc/-/commit/842ecea3f52788aad545529069ff52c048486e92

Git commit d02cd406d5ca0ddb51703c535c9aef9b9d4a3434 by Dennis Oberst on 17/08/2026 at 13:14..
qgrpcstream: add bytesToWrite() to observe the outgoing write queue

The messageWritten() signal paces writes but gives no view of how much
data the channel still holds for an RPC; an application that keeps
several messages in flight cannot bound its memory against a byte
watermark.

Add QGrpcOperationContext::bytesToWrite()/setBytesToWrite() as the
channel-side reporting pair and expose the getter on QGrpcClientStream
and QGrpcBidiStream, mirroring QIODevice::bytesToWrite().

QGrpcHttp2Channel reports the framed wire size of the accepted messages
and decrements it progressively as QHttp2Stream reports the bytes
written, so the value includes the unsent remainder of the message in
transmission and only reads 0 once everything reached the connection.

[ChangeLog][QGrpcClientStream] Added bytesToWrite() to
QGrpcClientStream and QGrpcBidiStream. It reports how many bytes the
channel has accepted for the stream but not yet written to the
transport.

Task-number: QTBUG-148066
Change-Id: I0ef59027cfc6f95353b0a85736a8c57c43a63385
Reviewed-by: Ivan Solovev <[email protected]>
https://invent.kde.org/qt/qt/qtgrpc/-/commit/d02cd406d5ca0ddb51703c535c9aef9b9d4a3434

Git commit d4b8b92a2968cfd811b8a1d3f15f874f04881ccf by Dennis Oberst on 17/08/2026 at 13:14..
QGrpcHttp2Channel: fold the concrete-socket dispatch into a helper

The connect-timeout abort and the destructor flush duplicated the
socketType switch with its static_casts. Route both through a small
visitSocket() helper that invokes a callable with the socket downcast
to its concrete type.

Change-Id: Ie499f4fcdd0778d75fd295993fe717c7e1f5a9c0
Reviewed-by: Ivan Solovev <[email protected]>
https://invent.kde.org/qt/qt/qtgrpc/-/commit/d4b8b92a2968cfd811b8a1d3f15f874f04881ccf