Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump the npm_and_yarn group across 1 directory with 12 updates #14

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Bump the npm_and_yarn group across 1 directory with 12 updates #14

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jun 16, 2024

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package From To
@google-cloud/firestore 3.7.3 7.8.0
firebase-admin 8.10.0 12.1.1
semver 5.7.1 5.7.2
bl 1.2.2 1.2.3
ansi-regex 3.0.0 3.0.1
braces 3.0.2 3.0.3
debug 4.1.1 4.3.5
lodash 4.17.19 4.17.21
minimist 1.2.5 1.2.8

Updates @google-cloud/firestore from 3.7.3 to 7.8.0

Release notes

Sourced from @​google-cloud/firestore's releases.

v7.8.0

7.8.0 (2024-05-28)

Features

  • Query profiling for VectorQuery (d406f14)
  • Update Nodejs generator to send API versions in headers for GAPICs (#2041) (6dbe4b0)

v7.7.0

7.7.0 (2024-05-07)

Features

  • Add several fields to manage state of database encryption update (5811492)
  • Lazy-started transactions (#2017) (2c726a1)

Bug Fixes

v7.6.0

7.6.0 (2024-04-02)

Features

v7.5.0

7.5.0 (2024-03-25)

Features

v7.4.0

7.4.0 (2024-03-15)

Features

  • A new message Backup is added (#2021) (6bced86)
  • A new message BackupSchedule is added (6bced86)
  • A new message CreateBackupScheduleRequest is added (6bced86)

... (truncated)

Changelog

Sourced from @​google-cloud/firestore's changelog.

7.8.0 (2024-05-28)

Features

  • Query profiling for VectorQuery (d406f14)
  • Update Nodejs generator to send API versions in headers for GAPICs (#2041) (6dbe4b0)

7.7.0 (2024-05-07)

Features

  • Add several fields to manage state of database encryption update (5811492)
  • Lazy-started transactions (#2017) (2c726a1)

Bug Fixes

7.6.0 (2024-04-02)

Features

7.5.0 (2024-03-25)

Features

7.4.0 (2024-03-15)

Features

  • A new message Backup is added (#2021) (6bced86)
  • A new message BackupSchedule is added (6bced86)
  • A new message CreateBackupScheduleRequest is added (6bced86)
  • A new message DailyRecurrence is added (6bced86)
  • A new message DeleteBackupRequest is added (6bced86)
  • A new message DeleteBackupScheduleRequest is added (6bced86)
  • A new message GetBackupRequest is added (6bced86)
  • A new message GetBackupScheduleRequest is added (6bced86)

... (truncated)

Commits

Updates firebase-admin from 8.10.0 to 12.1.1

Release notes

Sourced from firebase-admin's releases.

Firebase Admin Node.js SDK v12.1.1

Bug Fixes

  • fix: Export error classes (#2151)

Miscellaneous

  • [chore] Release 12.1.1 (#2561)
  • build(deps): updgrade jwks-rsa (#2570)
  • --- (#2568)
  • --- (#2566)
  • --- (#2567)
  • --- (#2569)
  • build(deps-dev): bump @​firebase/auth-types from 0.12.1 to 0.12.2 (#2556)
  • build(deps-dev): bump @​microsoft/api-extractor from 7.43.2 to 7.43.7 (#2559)
  • chore: upgrade firestore to 7.7.0 (#2560)
  • build(deps-dev): bump @​firebase/app-compat from 0.2.32 to 0.2.33 (#2555)
  • build(deps): bump @​google-cloud/firestore from 7.6.0 to 7.7.0 (#2558)
  • Fix api extractor issues to expose error types (#2549)
  • build(deps-dev): bump @​types/lodash from 4.17.0 to 4.17.1 (#2546)
  • build(deps): bump @​google-cloud/storage from 7.10.2 to 7.11.0 (#2547)
  • build(deps-dev): bump @​microsoft/api-extractor from 7.43.1 to 7.43.2 (#2545)
  • build(deps): bump @​types/node from 20.12.7 to 20.12.10 (#2544)
  • build(deps-dev): bump @​firebase/app-compat from 0.2.31 to 0.2.32 (#2540)
  • build(deps): bump @​google-cloud/storage from 7.10.1 to 7.10.2 (#2541)
  • build(deps): bump @​google-cloud/storage from 7.10.0 to 7.10.1 (#2536)
  • Update package.json to use farmhash 3.3.1 (#2534)

Firebase Admin Node.js SDK v12.1.0

New Features

  • feat(rc): Add server side Remote Config support (#2529)

Miscellaneous

  • [chore] Release 12.1.0 (#2532)
  • Fix minor typo (#2533)
  • chore: Excluding certain event_types from processing uid (#2370)
  • build(deps-dev): bump gulp from 4.0.2 to 5.0.0 (#2526)
  • build(deps-dev): bump @​firebase/app-compat from 0.2.29 to 0.2.30 (#2527)
  • build(deps): bump @​google-cloud/firestore from 7.5.0 to 7.6.0 (#2528)
  • build(deps): bump undici in /.github/actions/send-email (#2521)
  • build(deps-dev): bump @​firebase/auth-types from 0.12.0 to 0.12.1 (#2514)
  • build(deps-dev): bump mocha from 10.3.0 to 10.4.0 (#2513)
  • build(deps): bump @​types/node from 20.11.30 to 20.12.2 (#2516)
  • build(deps): bump @​google-cloud/firestore from 7.4.0 to 7.5.0 (#2517)
  • build(deps-dev): bump @​firebase/app-compat from 0.2.28 to 0.2.29 (#2510)
  • build(deps): bump @​google-cloud/storage from 7.7.0 to 7.9.0 (#2509)

... (truncated)

Commits

Updates @grpc/grpc-js from 0.7.6 to 1.10.9

Release notes

Sourced from @​grpc/grpc-js's releases.

@​grpc/grpc-js 1.10.9

  • Avoid buffering significantly more than grpc.max_receive_message_size per received message.

@​grpc/grpc-js 1.10.8

  • Fix a bug that caused channels with unix: targets to not reconnect after the channel goes idle (#2750)

@​grpc/grpc-js 1.10.7

  • Improve reporting of HTTP error codes (#2723)
  • Update dependency on @grpc/proto-loader to the latest version (#2732)

@​grpc/grpc-js 1.10.6

  • Fix a bug that could cause a server to sometimes send the status early (#2708)

@​grpc/grpc-js 1.10.5

  • Resolve exception when Error.stackTraceLimit is undefined (#2701 contributed by @​davidfiala)
  • Call configured checkServerIdentity when grpc.ssl_target_name_override is set (#2704)
  • Add more information to DEADLINE_EXCEEDED error details strings (#2692)

@​grpc/grpc-js 1.10.4

  • Fix a bug that caused server interceptors to crash when using partially-populated ResponderBuilder and ListenerBuilder objects (#2696)
  • Avoid sending RST_STREAM from the client when the server has already finished its side of the stream (#2695)

@​grpc/grpc-js 1.10.3

  • Revert client reconnection changes in #2680 (#2691)

@​grpc/grpc-js 1.10.2

  • Implement server connection idle timeouts and improve channelz performance (#2677 contributed by @​AVVS)
  • Fix a bug that caused clients to automatically reconnect even when there were no active requests (#2680)
  • Modify order of server call events to more closely match pre-1.10.x behavior (#2683)

@​grpc/grpc-js 1.10.1

  • Fix a bug causing channels using the round_robin LB policy to fail to reconnect after a connection drops (#2667)

@​grpc/grpc-js-xds 1.10.1

  • Update dependency on @grpc/proto-loader to the latest version (#2732)

@​grpc/grpc-js-xds 1.10.0

@​grpc/grpc-js 1.10.0

Changelog

... (truncated)

Commits
  • 674f4e3 Merge pull request from GHSA-7v5v-9h63-cj86
  • 7ecaa2d grpc-js: Bump to 1.10.9
  • e64d816 grpc-js: Avoid buffering significantly more than max_receive_message_size per...
  • 45e5fe5 Merge pull request #2750 from murgatroid99/grpc-js_idle_uds_fix
  • 87a3541 grpc-js: Fix UDS channels not reconnecting after going idle
  • 3105791 Merge pull request #2740 from sergiitk/backport-1.10-psm-interop-common-prod-...
  • fec135a Merge pull request #2729 from sergiitk/psm-interop-common-prod-tests
  • 76fe802 Merge pull request #2739 from murgatroid99/backport-1.10-grpc-js_linkify-it_fix
  • d5edf49 Merge pull request #2735 from murgatroid99/grpc-js_linkify-it_fix
  • 23c05fc Merge pull request #2732 from murgatroid99/grpc-js_proto-loader_update
  • Additional commits viewable in compare view

Updates semver from 5.7.1 to 5.7.2

Release notes

Sourced from semver's releases.

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

Changelog

Sourced from semver's changelog.

5.7.2 (2023-07-10)

Bug Fixes

5.7

  • Add minVersion method

5.6

  • Move boolean loose param to an options object, with backwards-compatibility protection.
  • Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

  • Add version coercion capabilities

5.4

  • Add intersection checking

5.3

  • Add minSatisfying method

5.2

  • Add prerelease(v) that returns prerelease components

5.1

  • Add Backus-Naur for ranges
  • Remove excessively cute inspection methods

5.0

  • Remove AMD/Browserified build artifacts
  • Fix ltr and gtr when using the * range
  • Fix for range * with a prerelease identifier
Commits
Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.


Updates bl from 1.2.2 to 1.2.3

Commits

Updates ansi-regex from 3.0.0 to 3.0.1

Commits

Updates braces from 3.0.2 to 3.0.3

Commits

Updates debug from 4.1.1 to 4.3.5

Release notes

Sourced from debug's releases.

4.3.5

Patch

  • cac39b1c5b018b0fe93a53a05f084eee543d17f5 Fix/debug depth (#926)

Thank you @​calvintwr for the fix.

4.3.4

What's Changed

New Contributors

Full Changelog: debug-js/debug@4.3.3...4.3.4

4.3.3

Patch Release 4.3.3

This is a documentation-only release. Further, the repository was transferred. Please see notes below.

Thank you to @​taylor1791 and @​kristofkalocsai for their contributions.

Repository Migration Information

I've formatted this as a FAQ, please feel free to open an issue for any additional question and I'll add the response here.

Q: What impact will this have on me?

In most cases, you shouldn't notice any change.

The only exception I can think of is if you pull code directly from https://github.com/visionmedia/debug, e.g. via a "debug": "visionmedia/debug"-type version entry in your package.json - in which case, you should still be fine due to the automatic redirection Github sets up, but you should also update any references as soon as possible.

Q: What are the security implications of this change?

If you pull code directly from the old URL, you should update the URL to https://github.com/debug-js/debug as soon as possible. The old organization has many approved owners and thus a new repository could (in theory) be created at the old URL, circumventing Github's automatic redirect that is in place now and serving malicious code. I (@​qix-) also wouldn't have access to that repository, so while I don't think it would happen, it's still something to consider.

Even in such a case, however, the officially released package on npm (debug) would not be affected. That package is still very much under control (even more than it used to be).

Q: What should I do if I encounter an issue related to the migration?

Search the issues first to see if someone has already reported it, and then open a new issue if someone has not.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by qix, a new releaser for debug since your current version.


Updates node-forge from 0.7.4 to 1.3.1

Changelog

Sourced from node-forge's changelog.

1.3.1 - 2022-03-29

Fixes

  • RFC 3447 and RFC 8017 allow for optional DigestAlgorithm NULL parameters for sha* algorithms and require NULL paramters for md2 and md5 algorithms.

1.3.0 - 2022-03-17

Security

  • Three RSA PKCS#1 v1.5 signature verification issues were reported by Moosa Yahyazadeh (moosa-yahyazadeh@uiowa.edu).
  • HIGH: Leniency in checking digestAlgorithm structure can lead to signature forgery.
  • HIGH: Failing to check tailing garbage bytes can lead to signature forgery.
  • MEDIUM: Leniency in checking type octet.
    • DigestInfo is not properly checked for proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.
    • CVE ID: CVE-2022-24773
    • GHSA ID: GHSA-2r2c-g63r-vccr

Fixed

  • [asn1] Add fallback to pretty print invalid UTF8 data.
  • [asn1] fromDer is now more strict and will default to ensuring all input bytes are parsed or throw an error. A new option parseAllBytes can disable this behavior.
    • NOTE: The previous behavior is being changed since it can lead to security issues with crafted inputs. It is possible that code doing custom DER parsing may need to adapt to this new behavior and optional flag.
  • [rsa] Add and use a validator to check for proper structure of parsed ASN.1

... (truncated)

Commits

Updates jsonwebtoken from 8.1.0 to 9.0.2

Changelog

Sourced from jsonwebtoken's changelog.

9.0.2 - 2023-08-30

  • security: updating semver to 7.5.4 to resolve CVE-2022-25883, closes #921.
  • refactor: reduce library size by using lodash specific dependencies, closes #878.

9.0.1 - 2023-07-05

  • fix(stubs): allow decode method to be stubbed

9.0.0 - 2022-12-21

Breaking changes: See Migration from v8 to v9

Breaking changes

  • Removed support for Node versions 11 and below.
  • The verify() function no longer accepts unsigned tokens by default. ([834503079514b72264fd13023a3b8d648afd6a16]auth0/node-jsonwebtoken@8345030)
  • RSA key size must be 2048 bits or greater. ([ecdf6cc6073ea13a7e71df5fad043550f08d0fa6]auth0/node-jsonwebtoken@ecdf6cc)
  • Key types must be valid for the signing / verification algorithm

Security fixes

  • security: fixes Arbitrary File Write via verify function - CVE-2022-23529
  • security: fixes Insecure default algorithm in jwt.verify() could lead to signature validation bypass - CVE-2022-23540
  • security: fixes Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - CVE-2022-23541
  • security: fixes Unrestricted key type could lead to legacy keys usage - CVE-2022-23539

8.5.1 - 2019-03-18

Bug fix

Docs

8.5.0 - 2019-02-20

New Functionality

Test Improvements

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by charlesrea, a new releaser for jsonwebtoken since your current version.


Updates lodash from 4.17.19 to 4.17.21

Commits
  • f299b52 Bump to v4.17.21
  • c4847eb Improve performance of toNumber, trim and trimEnd on large input strings
  • 3469357 Prevent command injection through _.template's variable option
  • ded9bc6 Bump to v4.17.20.
  • 63150ef Documentation fixes.
  • 00f0f62 test.js: Remove trailing comma.
  • 846e434 Temporarily use a custom fork of lodash-cli.
  • 5d046f3 Re-enable Travis tests on 4.17 branch.
  • aa816b3 Remove /npm-package.
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by bnjmnt4n, a new releaser for lodash since your current version.


Updates minimist from 1.2.5 to 1.2.8

Changelog

Sourced from minimist's changelog.

v1.2.8 - 2023-02-09

Merged

Fixed

Commits

  • Merge tag 'v0.2.3' a026794
  • [eslint] fix indentation and whitespace 5368ca4
  • [eslint] fix indentation and whitespace e5f5067
  • [eslint] more cleanup 62fde7d
  • [eslint] more cleanup 36ac5d0
  • [meta] add auto-changelog 73923d2
  • [actions] add reusable workflows d80727d
  • [eslint] add eslint; rules to enable later are warnings 48bc06a
  • [eslint] fix indentation 34b0f1c
  • [readme] rename and add badges 5df0fe4
  • [Dev Deps] switch from covert to nyc a48b128
  • [Dev Deps] update covert, tape; remove unnecessary tap f0fb958
  • [meta] create FUNDING.yml; add funding in package.json 3639e0c
  • [meta] use npmignore to autogenerate an npmignore file be2e038
  • Only apps should have lockfiles 282b570
  • isConstructorOrProto adapted from PR ef9153f
  • [Dev Deps] update @ljharb/eslint-config, aud 098873c
  • [Dev Deps] update @ljharb/eslint-config, aud 3124ed3
  • [meta] add safe-publish-latest 4b927de
  • [Tests] add aud in posttest b32d9bd
  • [meta] update repo URLs f9fdfc0
  • [actions] Avoid 0.6 tests du...

    Description has been truncated

@dependabot
Bump the npm_and_yarn group across 1 directory with 12 updates
089d322 
Bumps the npm_and_yarn group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@google-cloud/firestore](https://github.com/googleapis/nodejs-firestore) | `3.7.3` | `7.8.0` |
| [firebase-admin](https://github.com/firebase/firebase-admin-node) | `8.10.0` | `12.1.1` |
| [semver](https://github.com/npm/node-semver) | `5.7.1` | `5.7.2` |
| [bl](https://github.com/rvagg/bl) | `1.2.2` | `1.2.3` |
| [ansi-regex](https://github.com/chalk/ansi-regex) | `3.0.0` | `3.0.1` |
| [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` |
| [debug](https://github.com/debug-js/debug) | `4.1.1` | `4.3.5` |
| [lodash](https://github.com/lodash/lodash) | `4.17.19` | `4.17.21` |
| [minimist](https://github.com/minimistjs/minimist) | `1.2.5` | `1.2.8` |



Updates `@google-cloud/firestore` from 3.7.3 to 7.8.0
- [Release notes](https://github.com/googleapis/nodejs-firestore/releases)
- [Changelog](https://github.com/googleapis/nodejs-firestore/blob/main/CHANGELOG.md)
- [Commits](googleapis/nodejs-firestore@v3.7.3...v7.8.0)

Updates `firebase-admin` from 8.10.0 to 12.1.1
- [Release notes](https://github.com/firebase/firebase-admin-node/releases)
- [Commits](firebase/firebase-admin-node@v8.10.0...v12.1.1)

Updates `@grpc/grpc-js` from 0.7.6 to 1.10.9
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@0.7.6...@grpc/grpc-js@1.10.9)

Updates `semver` from 5.7.1 to 5.7.2
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md)
- [Commits](npm/node-semver@v5.7.1...v5.7.2)

Updates `bl` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/rvagg/bl/releases)
- [Changelog](https://github.com/rvagg/bl/blob/master/CHANGELOG.md)
- [Commits](rvagg/bl@v1.2.2...v1.2.3)

Updates `ansi-regex` from 3.0.0 to 3.0.1
- [Release notes](https://github.com/chalk/ansi-regex/releases)
- [Commits](chalk/ansi-regex@v3.0.0...v3.0.1)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `debug` from 4.1.1 to 4.3.5
- [Release notes](https://github.com/debug-js/debug/releases)
- [Commits](debug-js/debug@4.1.1...4.3.5)

Updates `node-forge` from 0.7.4 to 1.3.1
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@0.7.4...v1.3.1)

Updates `jsonwebtoken` from 8.1.0 to 9.0.2
- [Changelog](https://github.com/auth0/node-jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jsonwebtoken@v8.1.0...v9.0.2)

Updates `lodash` from 4.17.19 to 4.17.21
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.19...4.17.21)

Updates `minimist` from 1.2.5 to 1.2.8
- [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md)
- [Commits](minimistjs/minimist@v1.2.5...v1.2.8)

---
updated-dependencies:
- dependency-name: "@google-cloud/firestore"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: firebase-admin
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@grpc/grpc-js"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: semver
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: bl
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ansi-regex
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: debug
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: node-forge
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: jsonwebtoken
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimist
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jun 16, 2024
@dependabot dependabot bot mentioned this pull request Jun 16, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
0 participants