fix(deps): update dependency protobufjs to ~7.2.0 [security] #254
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Jul 14, 2023
|
It looks like the protobuf type definitions just need to be regenerated |
aabmass
approved these changes
Jul 20, 2023
Codecov Report
@@ Coverage Diff @@
## main #254 +/- ##
==========================================
- Coverage 42.21% 41.94% -0.27%
==========================================
Files 14 14
Lines 2061 2093 +32
Branches 42 42
==========================================
+ Hits 870 878 +8
- Misses 1173 1197 +24
Partials 18 18
|
48acf49 to
d542e91
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. ⚠ Warning: custom changes will be lost. |
psx95
reviewed
Jul 20, 2023
psx95
approved these changes
Jul 20, 2023
aabmass
added a commit
that referenced
this pull request
Jul 21, 2023
* chore(deps): update golang docker tag to v1.17 (#182) * test: change base Debian image from Debian 9 to Debian 11 to include a supported Python3 version for node-gyp (#187) * fix(deps): update dependency protobufjs to ~7.2.0 [security] (#254) * fix(deps): update dependency protobufjs to ~7.2.0 [security] * Pull in protobufjs-cli tools (pbjs and pbts) and regen proto stubs * Explicitly upgrade protobufjs past vulnerability, regenerate package-lock.json --------- Co-authored-by: Aaron Abbott <aaronabbott@google.com> * Update package-lock so there are no prod vulnerabilities * chore(deps): update dependency sinon to v15 (#237) * npm run fix with new package-lock.json * chore: remove testing in windows from workflow (#202) * Fix system test to use older npm for compat * test: bump debian version in system test (#251) * test: specify python3 when building docker image (#192) * Use alpine version with python < 3.11 --------- Co-authored-by: WhiteSource Renovate <bot@renovateapp.com> Co-authored-by: Garrett Wang <garrettwang@google.com> Co-authored-by: Amarin (Um) Phaosawasdi <amchiclet@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
~7.0.0->~7.2.0GitHub Vulnerability Alerts
CVE-2023-36665
protobuf.js (aka protobufjs) 6.10.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about
Object.constructor.prototype.<new-property> = ...;whereas CVE-2022-25878 was aboutObject.__proto__.<new-property> = ...;instead.Release Notes
protobufjs/protobuf.js (protobufjs)
v7.2.4Compare Source
Bug Fixes
v7.2.3Compare Source
Bug Fixes
v7.2.2Compare Source
Bug Fixes
v7.2.1Compare Source
Bug Fixes
v7.2.0Compare Source
Features
Bug Fixes
v7.1.2Compare Source
Bug Fixes
v7.1.1Compare Source
Bug Fixes
v7.1.0Compare Source
Features
Bug Fixes
@types/long(#1785) (0f4af83)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.