Security

• transport: block reading frames when too many transport control frames are queued (#2970)
  • Addresses CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood).

API Changes

• xds: move code to a root level xds directory (#2950)

Behavior Changes

• client: remove option to send RPCs before HTTP/2 handshake is completed (#2904)

New Features

• grpclb: enable keepalive (#2918)
• balancer: start populating weight by edsbalancer for weighted_round_robin (#2945)
  • Special Thanks: @alazarev
• wrr: add EDF implementation of weighted round robin. (#2957)
  • Special Thanks: @alazarev
• status: Implement *statusError.Is (#2868)
  • Special Thanks: @jsm

Performance Improvements

• server: avoid an unnecessary allocation per-RPC for OK status (#2920)
  • Special Thanks: @dzbarsky
• server: avoid call to trace.FromContext and resulting allocations when tracing is disabled (#2926)
  • Special Thanks: @dzbarsky
• http2client: remove unnecessary allocations for header fields (#2925)
  • Special Thanks: @dzbarsky
• status: avoid allocations when returning an OK status (#2929)
  • Special Thanks: @dzbarsky
• server: avoid allocations related to tracking excessive pings (#2923)
  • Special Thanks: @dzbarsky

Bug Fixes

• transport: call Unlock in defer to avoid data race (#2953)
  • Special Thanks: @lzhfromustc
• client: fix canceled vs deadline exceeded double-check logic (#2906)
• grpclb: recreate SubConns when switching fallback in case credentials change (#2899)
• server: populate WireLength on stats.InPayload for unary RPCs (#2932)
  • Special Thanks: @ajwerner
• client: fix race between transport draining and new RPCs (#2919)
• balancer: filter out grpclb addresses if balancer is not grpclb (#2907)

Documentation

• docs: clarify "deprecated" to indicate whether some features may be removed in 1.x (#2900)