Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade: , google-protobuf #282

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

thiswayman
Copy link
Owner

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

@grpc/grpc-js
from 1.5.4 to 1.11.1 | 76 versions ahead of your current version | 2 months ago
on 2024-07-16
google-protobuf
from 3.19.4 to 3.21.4 | 9 versions ahead of your current version | 2 months ago
on 2024-07-15

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Prototype Pollution
SNYK-JS-PROTOBUFJS-5756498
559 Proof of Concept
medium severity Uncontrolled Resource Consumption
SNYK-JS-GRPCGRPCJS-7242922
559 No Known Exploit
Release notes
Package name: @grpc/grpc-js
  • 1.11.1 - 2024-07-16
    • Fixed an issue where building from source would sometimes fail (#304)
    • Added NodeJS 10 pre-built binaries (#302)
    • Added Electron 2 pre-built binaries (#291)
    • Added TypeScript type definitions for APIs added in v1.11.x (#306)
  • 1.11.0 - 2024-07-15

    @ grpc/proto-loader v0.1.0

    This is a new library for loading .proto files for use with gRPC using the latest version of Protobuf.js. The output of this package is intended to be loaded using the new loadPackageDefinition function in the grpc library.

    @ grpc/grpc-js v0.1.0

    This is the first alpha release of the new pure JavaScript implementation of gRPC. It implements the same API as the existing grpc library. Currently only the client is implemented, with the following functionality:

    • loadPackageDefinition
    • Unary and streaming calls
    • Cancellation
    • Deadlines
    • Metadata
    • Basic automatic reconnection logic
    • Channel and call credentials

    grpc v1.11.0

    Node changes:

    • Add client interceptors API (#59 contributed by @ drobertduke)
    • Add loadPackageDefintion function (#196)
    • Publish ARM64 binaries (#200)
    • Improve function type test in a client method (#204 contributed by @ arcana261)
    • Add details to UNIMPLEMENTED response status (#207 contributed by @ theogravity)
    • Add error handling for missing files when calling grpc.load (#228 contributed by @ cblair)
    • Fix error message in grpc.loadObject when failing to detect Protobuf.js version (#253 contributed by @ kellycampbell)
    • Remove -zdefs flag from binding.gyp to enable building on FreeBSD (#266)
  • 1.10.11 - 2024-07-10
  • 1.10.10 - 2024-06-24
  • 1.10.9 - 2024-06-10
  • 1.10.8 - 2024-05-15
  • 1.10.7 - 2024-05-01
  • 1.10.6 - 2024-04-03
  • 1.10.5 - 2024-04-01
  • 1.10.4 - 2024-03-26
  • 1.10.3 - 2024-03-15
  • 1.10.2 - 2024-03-11
  • 1.10.1 - 2024-02-15

    Node changes:

    • Update dependency on node-pre-gyp to version 0.7.0 (#245)

    C core changes:

  • 1.10.0 - 2024-02-06

    C Core Changes

  • 1.9.15 - 2024-06-10
  • 1.9.14 - 2024-01-16
  • 1.9.13 - 2023-12-12
  • 1.9.12 - 2023-11-27
  • 1.9.11 - 2023-11-16
  • 1.9.10 - 2023-11-14
  • 1.9.9 - 2023-10-30
  • 1.9.8 - 2023-10-27
  • 1.9.7 - 2023-10-19
  • 1.9.6 - 2023-10-17
  • 1.9.5 - 2023-10-02
  • 1.9.4 - 2023-09-26
  • 1.9.3 - 2023-09-13
  • 1.9.2 - 2023-08-31
  • 1.9.1 - 2023-08-22
    • Fix usage of Protobuf.js Message type in TypeScript type definitions file (#177)
    • Fix handling of undefined values for optional call arguments (#179)
  • 1.9.0 - 2023-08-01
    • Further improve the error output when failing to load an installed precompiled binary (#175)
    • Fix type definition documentation for KeyCertPair (#171)
    • Fix server segfault on invalid HTTP/2 (grpc/grpc#14199)
    • LB policies request re-resolution without shutting down (grpc/grpc#12829)
    • On server, include receiving HTTP/2 settings in handshake timeout (grpc/grpc#13336)
    • Fix max connection idleness crash (grpc/grpc#14122)
    • Report metadata plugin auth errors with an UNAVAILABLE status instead of UNAUTHENTICATED (grpc/grpc#13363).
  • 1.8.22 - 2024-06-10
  • 1.8.21 - 2023-07-28
  • 1.8.20 - 2023-07-25
  • 1.8.19 - 2023-07-24
  • 1.8.18 - 2023-07-13
  • 1.8.17 - 2023-06-27
  • 1.8.16 - 2023-06-20
  • 1.8.15 - 2023-06-05
  • 1.8.14 - 2023-04-12
  • 1.8.13 - 2023-03-23
  • 1.8.12 - 2023-03-07
  • 1.8.11 - 2023-02-24
  • 1.8.10 - 2023-02-22
  • 1.8.9 - 2023-02-15
  • 1.8.8 - 2023-02-08
  • 1.8.7 - 2023-01-25
  • 1.8.6 - 2023-01-25
  • 1.8.5 - 2023-01-23
  • 1.8.4 - 2023-01-12
    • Add error code name and number to status Error objects for easier debugging. The status details string is now available in the Error object's details field. (#126)
    • Made a build process change that may fix some installation errors
    • Add more informative error for a missing callback to the Server#tryShutdown method (#143)
    • Removed extraneous files from published package
    • Mark some network errors with an UNAVAILABLE status (grpc/grpc#13917)
    • Fix HTTP/2 PING issues (grpc/grpc#13950)
  • 1.8.3 - 2023-01-11
  • 1.8.2 - 2023-01-09
  • 1.8.1 - 2023-01-03
  • 1.8.0 - 2022-12-07
    • Publish precompiled binaries for Alpine Linux
    • Improve the error output when failing to load an installed precompiled binary (#106).
  • 1.7.3 - 2022-10-21
  • 1.7.2 - 2022-10-14
    • Separate precompiled binaries for glibc and musl libc (#82, courtesy of @ bkw)
      • Precompiled binaries are not yet distributed for musl libc. Installations on Alpine Linux will result in compiling the binary locally.
    • Remove incorrect assertion (#92)
  • 1.7.1 - 2022-09-21
  • 1.7.0 - 2022-09-08
  • 1.6.12 - 2022-08-31
  • 1.6.11 - 2022-08-29
  • 1.6.10 - 2022-08-15
  • 1.6.9 - 2022-08-09
  • 1.6.8 - 2022-07-21
  • 1.6.7 - 2022-04-20
  • 1.6.6 - 2022-04-18
  • 1.6.5 - 2022-04-15
  • 1.6.4 - 2022-04-14
  • 1.6.3 - 2022-04-11
  • 1.6.2 - 2022-04-04
  • 1.6.1 - 2022-04-01
  • 1.6.0 - 2022-03-31
  • 1.5.10 - 2022-03-24
  • 1.5.9 - 2022-03-16
  • 1.5.8 - 2022-03-14
  • 1.5.7 - 2022-02-24
  • 1.5.6 - 2022-02-23
  • 1.5.5 - 2022-02-10
  • 1.5.4 - 2022-01-31
from @grpc/grpc-js GitHub release notes
Package name: google-protobuf
  • 3.21.4 - 2024-07-15

    Release to fix bazel build layering issue in 3.21.3.

  • 3.21.2 - 2022-10-10

    This is a hotfix release for #141

  • 3.21.1 - 2022-10-07
    • Enable Closure's advanced optimization mode by default. This should reduce code size (#124).
    • Replace goog.testing.asserts in tests with Jasmine expectations (#136).
    • Bring in the subset of the goog.asserts we use as jspb.asserts. This code retains an Apache 2.0 license.
    • Fix decoding of signed varint32s (#31).
    • Add license files to NPM package.

    This will also be our first release to have cross-compiled protoc-gen-js binaries. Please note that they use dynamic linking (similar to the protobuf protoc releases).

  • 3.21.0 - 2022-07-28

    First release of protobuf-javascript as a standalone project.

    This release mostly consists of BUILD and documentation fixes to account for new repository.
    Various bug fixes.

  • 3.20.1 - 2022-04-21
  • 3.20.1-rc.1 - 2022-04-06
  • 3.20.0 - 2022-04-01
  • 3.20.0-rc.2 - 2022-03-17
  • 3.20.0-rc.1 - 2022-03-04
  • 3.19.4 - 2022-01-28
from google-protobuf GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

Snyk has created this PR to upgrade:
  - @grpc/grpc-js from 1.5.4 to 1.11.1.
    See this package in npm: https://www.npmjs.com/package/@grpc/grpc-js
  - google-protobuf from 3.19.4 to 3.21.4.
    See this package in npm: https://www.npmjs.com/package/google-protobuf

See this project in Snyk:
https://app.snyk.io/org/jwayman/project/43aad472-0f3a-4e57-934e-2cf46df5eef8?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants