chore(deps): bump the npm_and_yarn group across 10 directories with 9 updates - #934
Open
dependabot[bot] wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Sorry @dependabot[bot], you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
… updates Bumps the npm_and_yarn group with 2 updates in the /core/generator/gapic-generator-typescript directory: [js-yaml](https://github.com/nodeca/js-yaml) and [@grpc/grpc-js](https://github.com/grpc/grpc-node). Bumps the npm_and_yarn group with 1 update in the /core/packages/gax/test/test-application directory: [@grpc/grpc-js](https://github.com/grpc/grpc-node). Bumps the npm_and_yarn group with 1 update in the /core/packages/gaxios directory: [tmp](https://github.com/raszi/node-tmp). Bumps the npm_and_yarn group with 1 update in the /core/packages/gcp-metadata directory: [tmp](https://github.com/raszi/node-tmp). Bumps the npm_and_yarn group with 1 update in the /core/packages/nodejs-googleapis-common directory: [tmp](https://github.com/raszi/node-tmp). Bumps the npm_and_yarn group with 1 update in the /handwritten/bigtable directory: [uuid](https://github.com/uuidjs/uuid). Bumps the npm_and_yarn group with 2 updates in the /handwritten/cloud-profiler directory: [protobufjs](https://github.com/protobufjs/protobuf.js) and [tmp](https://github.com/raszi/node-tmp). Bumps the npm_and_yarn group with 2 updates in the /handwritten/pubsub directory: [protobufjs](https://github.com/protobufjs/protobuf.js) and [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js). Bumps the npm_and_yarn group with 1 update in the /handwritten/spanner directory: [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core). Bumps the npm_and_yarn group with 1 update in the /packages/google-cloud-compute/samples directory: [nodemailer](https://github.com/nodemailer/nodemailer). Updates `js-yaml` from 4.1.1 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `protobufjs-cli` from 1.2.0 to 1.3.3 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-cli-v1.2.0...protobufjs-cli-v1.3.3) Updates `@grpc/grpc-js` from 1.13.3 to 1.14.4 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.13.3...@grpc/grpc-js@1.14.4) Updates `@grpc/grpc-js` from 1.13.3 to 1.14.3 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.13.3...@grpc/grpc-js@1.14.4) Updates `@grpc/grpc-js` from 1.13.3 to 1.14.3 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.13.3...@grpc/grpc-js@1.14.4) Updates `@grpc/grpc-js` from 1.13.3 to 1.14.3 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.13.3...@grpc/grpc-js@1.14.4) Updates `@grpc/grpc-js` from 1.6.12 to 1.14.4 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.13.3...@grpc/grpc-js@1.14.4) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `uuid` from 8.0.0 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v8.0.0...v14.0.0) Updates `uuid` from 8.0.0 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v8.0.0...v14.0.0) Updates `protobufjs` from 7.5.9 to 8.7.1 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.5.9...protobufjs-v8.7.1) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `tmp` from 0.2.6 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.6...v0.2.7) Updates `protobufjs` from 7.5.9 to 8.7.1 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.5.9...protobufjs-v8.7.1) Updates `@opentelemetry/core` from 1.30.1 to 2.10.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v1.30.1...v2.10.0) Updates `@babel/core` from 7.27.7 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `@babel/core` from 7.27.7 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `nodemailer` from 8.0.11 to 9.0.3 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v8.0.11...v9.0.3) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:production - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:production - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.3 dependency-type: indirect - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.3 dependency-type: indirect - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.3 dependency-type: indirect - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.4 dependency-type: indirect - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.4 dependency-type: direct:production - dependency-name: "@opentelemetry/core" dependency-version: 2.10.0 dependency-type: direct:production - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: direct:production - dependency-name: nodemailer dependency-version: 9.0.3 dependency-type: direct:production - dependency-name: protobufjs dependency-version: 8.7.1 dependency-type: direct:production - dependency-name: protobufjs dependency-version: 8.7.1 dependency-type: direct:development - dependency-name: protobufjs-cli dependency-version: 1.3.3 dependency-type: direct:production - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: tmp dependency-version: 0.2.7 dependency-type: direct:development - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:development - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/core/generator/gapic-generator-typescript/npm_and_yarn-5c42ca6480
branch
from
July 31, 2026 04:55
c774f56 to
6c7c3d0
Compare
Comment on lines
+510
to
+533
| "node_modules/@grpc/grpc-js/node_modules/protobufjs": { | ||
| "version": "7.6.5", | ||
| "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz", | ||
| "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==", | ||
| "dev": true, | ||
| "hasInstallScript": true, | ||
| "license": "BSD-3-Clause", | ||
| "dependencies": { | ||
| "@protobufjs/aspromise": "^1.1.2", | ||
| "@protobufjs/base64": "^1.1.2", | ||
| "@protobufjs/codegen": "^2.0.5", | ||
| "@protobufjs/eventemitter": "^1.1.1", | ||
| "@protobufjs/fetch": "^1.1.1", | ||
| "@protobufjs/float": "^1.0.2", | ||
| "@protobufjs/path": "^1.1.2", | ||
| "@protobufjs/pool": "^1.1.0", | ||
| "@protobufjs/utf8": "^1.1.1", | ||
| "@types/node": ">=13.7.0", | ||
| "long": "^5.3.2" | ||
| }, | ||
| "engines": { | ||
| "node": ">=12.0.0" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-41242): protobufjs: Arbitrary code execution via injected protobuf definition type fields
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
Source: trivy
Comment on lines
+510
to
+533
| "node_modules/@grpc/grpc-js/node_modules/protobufjs": { | ||
| "version": "7.6.5", | ||
| "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz", | ||
| "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==", | ||
| "dev": true, | ||
| "hasInstallScript": true, | ||
| "license": "BSD-3-Clause", | ||
| "dependencies": { | ||
| "@protobufjs/aspromise": "^1.1.2", | ||
| "@protobufjs/base64": "^1.1.2", | ||
| "@protobufjs/codegen": "^2.0.5", | ||
| "@protobufjs/eventemitter": "^1.1.1", | ||
| "@protobufjs/fetch": "^1.1.1", | ||
| "@protobufjs/float": "^1.0.2", | ||
| "@protobufjs/path": "^1.1.2", | ||
| "@protobufjs/pool": "^1.1.0", | ||
| "@protobufjs/utf8": "^1.1.1", | ||
| "@types/node": ">=13.7.0", | ||
| "long": "^5.3.2" | ||
| }, | ||
| "engines": { | ||
| "node": ">=12.0.0" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-44289): protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.
Source: trivy
Comment on lines
+510
to
+533
| "node_modules/@grpc/grpc-js/node_modules/protobufjs": { | ||
| "version": "7.6.5", | ||
| "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz", | ||
| "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==", | ||
| "dev": true, | ||
| "hasInstallScript": true, | ||
| "license": "BSD-3-Clause", | ||
| "dependencies": { | ||
| "@protobufjs/aspromise": "^1.1.2", | ||
| "@protobufjs/base64": "^1.1.2", | ||
| "@protobufjs/codegen": "^2.0.5", | ||
| "@protobufjs/eventemitter": "^1.1.1", | ||
| "@protobufjs/fetch": "^1.1.1", | ||
| "@protobufjs/float": "^1.0.2", | ||
| "@protobufjs/path": "^1.1.2", | ||
| "@protobufjs/pool": "^1.1.0", | ||
| "@protobufjs/utf8": "^1.1.1", | ||
| "@types/node": ">=13.7.0", | ||
| "long": "^5.3.2" | ||
| }, | ||
| "engines": { | ||
| "node": ">=12.0.0" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-44290): protobufjs: Denial of Service via crafted schema
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.
Source: trivy
Comment on lines
+510
to
+533
| "node_modules/@grpc/grpc-js/node_modules/protobufjs": { | ||
| "version": "7.6.5", | ||
| "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz", | ||
| "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==", | ||
| "dev": true, | ||
| "hasInstallScript": true, | ||
| "license": "BSD-3-Clause", | ||
| "dependencies": { | ||
| "@protobufjs/aspromise": "^1.1.2", | ||
| "@protobufjs/base64": "^1.1.2", | ||
| "@protobufjs/codegen": "^2.0.5", | ||
| "@protobufjs/eventemitter": "^1.1.1", | ||
| "@protobufjs/fetch": "^1.1.1", | ||
| "@protobufjs/float": "^1.0.2", | ||
| "@protobufjs/path": "^1.1.2", | ||
| "@protobufjs/pool": "^1.1.0", | ||
| "@protobufjs/utf8": "^1.1.1", | ||
| "@types/node": ">=13.7.0", | ||
| "long": "^5.3.2" | ||
| }, | ||
| "engines": { | ||
| "node": ">=12.0.0" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-44291): protobufjs: Arbitrary Code Execution via prototype pollution
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.
Source: trivy
Comment on lines
+510
to
+533
| "node_modules/@grpc/grpc-js/node_modules/protobufjs": { | ||
| "version": "7.6.5", | ||
| "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz", | ||
| "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==", | ||
| "dev": true, | ||
| "hasInstallScript": true, | ||
| "license": "BSD-3-Clause", | ||
| "dependencies": { | ||
| "@protobufjs/aspromise": "^1.1.2", | ||
| "@protobufjs/base64": "^1.1.2", | ||
| "@protobufjs/codegen": "^2.0.5", | ||
| "@protobufjs/eventemitter": "^1.1.1", | ||
| "@protobufjs/fetch": "^1.1.1", | ||
| "@protobufjs/float": "^1.0.2", | ||
| "@protobufjs/path": "^1.1.2", | ||
| "@protobufjs/pool": "^1.1.0", | ||
| "@protobufjs/utf8": "^1.1.1", | ||
| "@types/node": ">=13.7.0", | ||
| "long": "^5.3.2" | ||
| }, | ||
| "engines": { | ||
| "node": ">=12.0.0" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-44293): protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.
Source: trivy
Comment on lines
+510
to
+533
| "node_modules/@grpc/grpc-js/node_modules/protobufjs": { | ||
| "version": "7.6.5", | ||
| "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz", | ||
| "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==", | ||
| "dev": true, | ||
| "hasInstallScript": true, | ||
| "license": "BSD-3-Clause", | ||
| "dependencies": { | ||
| "@protobufjs/aspromise": "^1.1.2", | ||
| "@protobufjs/base64": "^1.1.2", | ||
| "@protobufjs/codegen": "^2.0.5", | ||
| "@protobufjs/eventemitter": "^1.1.1", | ||
| "@protobufjs/fetch": "^1.1.1", | ||
| "@protobufjs/float": "^1.0.2", | ||
| "@protobufjs/path": "^1.1.2", | ||
| "@protobufjs/pool": "^1.1.0", | ||
| "@protobufjs/utf8": "^1.1.1", | ||
| "@types/node": ">=13.7.0", | ||
| "long": "^5.3.2" | ||
| }, | ||
| "engines": { | ||
| "node": ">=12.0.0" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-48712): protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON. This vulnerability is fixed in 7.6.1 and 8.4.1.
Source: trivy
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 2 updates in the /core/generator/gapic-generator-typescript directory: js-yaml and @grpc/grpc-js.
Bumps the npm_and_yarn group with 1 update in the /core/packages/gax/test/test-application directory: @grpc/grpc-js.
Bumps the npm_and_yarn group with 1 update in the /core/packages/gaxios directory: tmp.
Bumps the npm_and_yarn group with 1 update in the /core/packages/gcp-metadata directory: tmp.
Bumps the npm_and_yarn group with 1 update in the /core/packages/nodejs-googleapis-common directory: tmp.
Bumps the npm_and_yarn group with 1 update in the /handwritten/bigtable directory: uuid.
Bumps the npm_and_yarn group with 2 updates in the /handwritten/cloud-profiler directory: protobufjs and tmp.
Bumps the npm_and_yarn group with 2 updates in the /handwritten/pubsub directory: protobufjs and @opentelemetry/core.
Bumps the npm_and_yarn group with 1 update in the /handwritten/spanner directory: @babel/core.
Bumps the npm_and_yarn group with 1 update in the /packages/google-cloud-compute/samples directory: nodemailer.
Updates
js-yamlfrom 4.1.1 to 4.3.0Changelog
Sourced from js-yaml's changelog.
... (truncated)
Commits
33d05b54.3.0 released663bfabDrop demo publish, to not override new v5 one.1cb8c7bAdd v4-legacy tag for publish02f27afRestore umd builds back to es58be84edFix es5 compatibility59423c6ReplacemaxMergeSeqLengthoption withmaxTotalMergeKeys(more robust). Ba...6842ef6doc polish590dbab4.2.0 releasedf944dc5Add package.json funding fieldf692719Changelog updateUpdates
protobufjs-clifrom 1.2.0 to 1.3.3Release notes
Sourced from protobufjs-cli's releases.
Commits
1d3796dchore: release protobufjs-v7.x (#2317)df91652fix: Preserve null conversion behavior for fieldless messages (#2312)78a9576fix: Avoid name collisions in generated code (#2311)ec90ef9chore: release protobufjs-v7.x (#2295)a92f72efix: Backport consistency and correctness fixes (#2294)f0b50d2chore: release protobufjs-v7.x (#2268)8a45c13fix: Backport misc utility hardening (#2280)479dfdcfix: Treat fixed64 as unsigned in converters (#2266)e30c334chore: release protobufjs-v7.x (#2260)f769242feat: Support BigInt conversions (7.x) (#2258)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for protobufjs-cli since your current version.
Updates
@grpc/grpc-jsfrom 1.13.3 to 1.14.4Release notes
Sourced from @grpc/grpc-js's releases.
Commits
a380735Merge pull request #3052 from murgatroid99/grpc-js_1.14.45b8d37bMerge commit from fork6a97456Merge commit from forke5e0b1dgrpc-js: Bump version to 1.14.45029a26Make compression error a static string2fe55fdFix crashes when receiving malformed compressed data234f917Fix server crash when handling invalid requestsacef8d4Merge pull request #3043 from murgatroid99/rbac_types_change_fix_1.144f3c58fgrpc-js-xds: Update RBAC code to handle Node type change, pin@types/nodeccd29b2Merge pull request #3032 from murgatroid99/grpc-js_retry_half_close_1.14Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
@grpc/grpc-jsfrom 1.13.3 to 1.14.3Release notes
Sourced from @grpc/grpc-js's releases.
Commits
a380735Merge pull request #3052 from murgatroid99/grpc-js_1.14.45b8d37bMerge commit from fork6a97456Merge commit from forke5e0b1dgrpc-js: Bump version to 1.14.45029a26Make compression error a static string2fe55fdFix crashes when receiving malformed compressed data234f917Fix server crash when handling invalid requestsacef8d4Merge pull request #3043 from murgatroid99/rbac_types_change_fix_1.144f3c58fgrpc-js-xds: Update RBAC code to handle Node type change, pin@types/nodeccd29b2Merge pull request #3032 from murgatroid99/grpc-js_retry_half_close_1.14Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
@grpc/grpc-jsfrom 1.13.3 to 1.14.3Release notes
Sourced from @grpc/grpc-js's releases.
Commits
a380735Merge pull request #3052 from murgatroid99/grpc-js_1.14.45b8d37bMerge commit from fork6a97456Merge commit from forke5e0b1dgrpc-js: Bump version to 1.14.45029a26Make compression error a static string2fe55fdFix crashes when receiving malformed compressed data234f917Fix server crash when handling invalid requestsacef8d4Merge pull request #3043 from murgatroid99/rbac_types_change_fix_1.144f3c58fgrpc-js-xds: Update RBAC code to handle Node type change, pin@types/nodeccd29b2Merge pull request #3032 from murgatroid99/grpc-js_retry_half_close_1.14Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
@grpc/grpc-jsfrom 1.13.3 to 1.14.3Release notes
Sourced from @grpc/grpc-js's releases.
Commits
a380735Merge pull request #3052 from murgatroid99/grpc-js_1.14.45b8d37bMerge commit from fork6a97456Merge commit from forke5e0b1dgrpc-js: Bump version to 1.14.45029a26Make compression error a static string2fe55fdFix crashes when receiving malformed compressed data234f917Fix server crash when handling invalid requestsacef8d4Merge pull request #3043 from murgatroid99/rbac_types_change_fix_1.144f3c58fgrpc-js-xds: Update RBAC code to handle Node type change, pin@types/nodeccd29b2Merge pull request #3032 from murgatroid99/grpc-js_retry_half_close_1.14Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
@grpc/grpc-jsfrom 1.6.12 to 1.14.4Release notes
Sourced from @grpc/grpc-js's releases.
Commits
a380735Merge pull request #3052 from murgatroid99/grpc-js_1.14.45b8d37bMerge commit from fork6a97456Merge commit from forke5e0b1dgrpc-js: Bump version to 1.14.45029a26Make compression error a static string2fe55fdFix crashes when receiving malformed compressed data234f917Fix server crash when handling invalid requestsacef8d4Merge pull request #3043 from murgatroid99/rbac_types_change_fix_1.144f3c58fgrpc-js-xds: Update RBAC code to handle Node type change, pin@types/nodeccd29b2Merge pull request #3032 from murgatroid99/grpc-js_retry_half_close_1.14Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
tmpfrom 0.2.6 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.6 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.6 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.6 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.6 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.6 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.6 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.5 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.5 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.5 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.5 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.5 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.5 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.5 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.5 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.5 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.5 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.5 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.5 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, templateUpdates
tmpfrom 0.2.5 to 0.2.7Commits
8ea1f37Bump up the version8f24f78Merge commit from forkce787f3Reject non-string prefix, postfix, template