New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 8 vulnerabilities #35

Open

takeratta wants to merge 1 commit into master from snyk-fix-05938cabf400db8a19c3829e1a7f0830

Owner

takeratta commented Nov 29, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- packages/logging/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	No	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	No	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	No	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	No	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	No	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	No	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gcp-metadata

The new version differs by 46 commits.

1841f3c 0.5.0
9686277 feat: add isAvailable method ([Snyk] Fix for 8 vulnerabilities #23)
a042275 feat: switch to promises ([Snyk] Security upgrade @google-cloud/common from 0.13.6 to 0.23.0 #24)
ee6713b fix: use the v1 path and remove trailing dot ([Snyk] Fix for 21 vulnerabilities #28)
2b107a1 test: switch to ava ([Snyk] Fix for 8 vulnerabilities #27)
99f29c9 fix: use v1beta1 instead of v1 to support GCF ([Snyk] Fix for 7 vulnerabilities #25)
d6d4454 feat: Export host name and use `.` at the end ([Snyk] Security upgrade google-gax from 0.14.5 to 1.0.0 #22)
b830edb chore: switch to axios ([Snyk] Security upgrade google-gax from 0.13.5 to 1.0.0 #20)
0bfe4b0 test: add tests for node 9 ([Snyk] Security upgrade google-gax from 0.13.5 to 1.0.0 #21)
85a471d chore: reorganize structure a bit ([Snyk] Security upgrade @google-cloud/common from 0.13.6 to 0.23.0 #19)
73913c8 0.4.1
d9cd9f6 Merge pull request [Snyk] Fix for 2 vulnerabilities #16 from kjin/err-code-2
7d187a1 remove Error from type of callback error object
c18cd8c Merge pull request [Snyk] Security upgrade @google-cloud/logging from 1.2.0 to 4.1.0 #15 from kjin/err-code
5e8b1e8 fix: make callback error NodeJS.ErrnoException type
3964c62 0.4.0
75bd2db Merge pull request [Snyk] Security upgrade @google-cloud/video-intelligence from 0.3.2 to 4.0.0 #9 from kjin/ts
3194790 bump clang-format and re-run
afb0d94 changes on top
4e9c2b1 run clang-format
6489985 convert test file to es6
05a2cf6 rename index.test.js
30db5fa run clang-format
326755c add the semicolons

See the full diff

Package name: google-auto-auth

The new version differs by 21 commits.

765c8a0 0.9.4
862344d Use gcp-metadata with promises. ([Snyk] Security upgrade @google-cloud/common-grpc from 0.4.3 to 1.0.0 #43)
39ae031 chore(deps): update dependency mocha to ^5.0.0 ([Snyk] Security upgrade google-gax from 0.13.5 to 1.0.0 #42)
0ee3b99 fix(deps): update dependency gcp-metadata to ^0.6.1 ([Snyk] Fix for 1 vulnerabilities #41)
2a1bff1 Configure Renovate ([Snyk] Security upgrade @google-cloud/logging from 1.2.0 to 5.0.0 #40)
dc5315d Add integration test. ([Snyk] Security upgrade @google-cloud/logging from 1.2.0 to 5.0.0 #37)
d8d97e2 Add circle
c698069 0.9.3
83b265a Revert "Update dependencies ([Snyk] Fix for 2 vulnerabilities #34)"
51137e0 0.9.2
aa3b2cf Update dependencies ([Snyk] Fix for 2 vulnerabilities #34)
5f2fbc0 0.9.1
0af0d83 chore(package): update dep gcp-metadata ([Snyk] Security upgrade google-gax from 0.13.5 to 1.0.0 #33)
252db3e 0.9.0
423cf05 Accept and cache project ID. ([Snyk] Fix for 15 vulnerabilities #30)
616028b 0.8.2
961112f fix: silence spurious warning from bluebird ([Snyk] Security upgrade @google-cloud/common from 0.13.6 to 0.23.0 #29)
2d172a0 0.8.1
729b236 Properly return errors from SignBlob API.
0eabee3 0.8.0
4659b4e Prepare for googleAuthLibrary#getCredentials. ([Snyk] Fix for 8 vulnerabilities #26)

See the full diff

Package name: google-gax

The new version differs by 246 commits.

941d41b chore: release 1.0.0 (Storage File.download error googleapis/google-cloud-node#494)
03236f4 fix(deps): update dependency google-auth-library to v4 (Support Google analytics API googleapis/google-cloud-node#493)
981b1ed fix(deps): update dependency @ grpc/grpc-js to ^0.4.0 (Final review for PubSub by Google PubSub team googleapis/google-cloud-node#487)
88dd64f chore(deps): update dependency google-proto-files to v1 (Update CRC module to SSE4_CRC32 v3.1.0 googleapis/google-cloud-node#488)
430bd8a build: allow Node 10 on presubmit to push to codecov (support uploading directories googleapis/google-cloud-node#492)
43d591b build: allow Node 10 to push to codecov (callback for bucket.getFiles doesn't return prefixes googleapis/google-cloud-node#491)
b872f2b feat!: use @ grpc/grpc-js instead of grpc (Change GCLOUD_TESTS_KEY to "./key.json" in Travis googleapis/google-cloud-node#484)
b0dbafb chore: do not run CI on grpc-js (Final review for Storage googleapis/google-cloud-node#485)
97f48f7 chore(deps): update dependency eslint-plugin-node to v9 (Support Google DNS API googleapis/google-cloud-node#486)
728678a build!: upgrade engines field to >=8.10.0 (Overview of Authentication in docs googleapis/google-cloud-node#483)
6331def chore(deps): update dependency gts to v1 (Fix rate limit requests googleapis/google-cloud-node#472)
3ee3044 chore: removing node6 CI (Final review for BigQuery by someone from Google googleapis/google-cloud-node#482)
1159242 Release v0.26.0 (List Bucket and List File googleapis/google-cloud-node#478)
880c4ab test: use npm pack instead of npm link (Add async to deps googleapis/google-cloud-node#481)
0ed2084 feat: do not use legacy grpc loadObject (docs: fix dox parsing issue by using RegExp object googleapis/google-cloud-node#477)
b9e7073 update to .nycrc with --all enabled (Remove bullet points from parameters googleapis/google-cloud-node#476)
6693d5d chore(deps): unpin grpc (docs: fix markup for dox. googleapis/google-cloud-node#475)
73e0a45 feat: turned google-proto-files into a dev dependency (impossible to upload files to google storage with v0.12.0 googleapis/google-cloud-node#470)
55b4d3b test: end-to-end system test (Do not run regression tests on tagged release commits googleapis/google-cloud-node#471)
b7ea19a fix: pin grpc 1.20.0 (Switch Protocol Buffers lib googleapis/google-cloud-node#474)
8210ab2 chore(deps): update dependency nyc to v14 (Exponential backoff and retry certain requests googleapis/google-cloud-node#468)
3ba689b refactor: a huge refactor of call handling (Fix makePublic and makePrivate steps to occur in series googleapis/google-cloud-node#467)
80c5b27 fix(deps): update dependency @ grpc/proto-loader to ^0.5.0 (pubsub error - Cannot read property 'onAuthorized' of undefined googleapis/google-cloud-node#466)
e37ee7e chore(deps): update dependency mocha to ~6.1.0 (Change Alpha to Beta for Pub/Sub googleapis/google-cloud-node#464)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn


          fix: packages/logging/package.json to reduce vulnerabilities

e64ffab

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2330875
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2331908
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430337
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430339
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430341
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet