New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 8 vulnerabilities #28

Open

snyk-bot wants to merge 1 commit into master from snyk-fix-61260858446226a633f826c87b0d6ae9

snyk-bot commented Apr 27, 2023

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	539/1000 Why? Has a fix available, CVSS 6.5	Improper Restriction of Security Token Assignment SNYK-JS-JSONWEBTOKEN-3180024	Yes	No Known Exploit
	554/1000 Why? Has a fix available, CVSS 6.8	Use of a Broken or Risky Cryptographic Algorithm SNYK-JS-JSONWEBTOKEN-3180026	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	Yes	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	Yes	No Known Exploit
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-NODEFORGE-598677	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @google-cloud/firestore

The new version differs by 66 commits.

7c3bdaa Preparing 0.12.0 release (Removing unused dependency firebase/firebase-admin-node#145)
ef2730d Allowing empty merge calls (ThenableReference returning PromiseLike - should be Promise? firebase/firebase-admin-node#144)
f23c167 Adding isEqual to the public API (Adding the RTDB typings back firebase/firebase-admin-node#140)
25067bb chore: removing node7 job from CircleCI (Implemented IID Delete API firebase/firebase-admin-node#142)
35c1af0 100% Test coverage and misc cleanup (Upgraded Firestore dependency to 0.10.0 firebase/firebase-admin-node#139)
463fbfc Rejecting custom types from the API surface (admin.intializeApp returns Raw server response firebase/firebase-admin-node#137)
843a5d1 Test refactor (Type names not found firebase/firebase-admin-node#138)
a620ada Accept strings in where(FieldPath.documentId(), ...) (Wrong "typings" key in package.json after monorepo refactor. firebase/firebase-admin-node#136)
59f738a Updating Conformance Tests (Firestore cursor methods not working with document snapshots firebase/firebase-admin-node#135)
0d71ae5 chore(package): update @ types/node to version 9.4.5 (Fix Database Statistics Reporting firebase/firebase-admin-node#134)
c9f4146 Updating variable name for Transactions reads (Bumped version to 5.5.0 firebase/firebase-admin-node#133)
8788cb5 Update eslint-plugin-node to the latest version 🚀 (FR: Add util function "encodeAsFirebaseKey" firebase/firebase-admin-node#126)
b81c45d Update @ google-cloud/common to the latest version 🚀 (missing kid in createCustomToken token header firebase/firebase-admin-node#128)
d66d66e Adding Transactions.getAll() (Events called synchronously after write operation firebase/firebase-admin-node#125)
a4c5508 Update google-proto-files to the latest version 🚀 (Removed skrinkwrap File firebase/firebase-admin-node#124)
51e076e Exporting all API types (Adding Firestore.setLogFunction() to the typings firebase/firebase-admin-node#123)
a16c3eb Preparing 0.11.2 release (npm update firebase-admin fails with ENOENT: no such file or directory, rename firebase/firebase-admin-node#121)
a175370 chore: run circle as non-root user (The email address is already in use by another account firebase/firebase-admin-node#120)
f8e1d23 Including previous data when we encounter a transform (Firestore Realtime listener drops a connection and does not reconnect firebase/firebase-admin-node#119)
0f7a975 Adding Query Conformance Tests (NodeJS crashes while running in cloud due to --> Error: Failed to import the Cloud Storage client library for Node.js. firebase/firebase-admin-node#118)
f2cccfe Using the GRPC dependency as exposed from google-gax (self signed certificate in certificate chain error firebase/firebase-admin-node#115)
19c3a15 Allow newlines in Resource Paths (Upgraded @types/request to latest and removed deprecated typings firebase/firebase-admin-node#114)
5be8477 Update dependencies (5.4 regression firebase/firebase-admin-node#113)
6ac1947 Updating System Test to use the new error message (Importing RTDB code via @firebase/database firebase/firebase-admin-node#112)

See the full diff

Package name: jsonwebtoken

The new version differs by 154 commits.

e1fa9dc Merge pull request from GHSA-8cf7-32gw-wr33
5eaedbf chore(ci): remove github test actions job ([chore] Release 8.11.0 firebase/firebase-admin-node#861)
cd4163e chore(ci): configure Github Actions jobs for Tests & Security Scanning (Too much contention on these documents firebase/firebase-admin-node#856)
ecdf6cc fix!: Prevent accidental use of insecure key sizes & misconfiguration of secrets (fix(auth): Defines missing DecodedIdToken types. firebase/firebase-admin-node#852)
8345030 fix(sign&verify)!: Remove default `none` support from `sign` and `verify` methods, and require it to be explicitly configured (Ml merge firebase/firebase-admin-node#851)
7e6a86b Upload OpsLevel YAML (cannot deploy to firebase due to sharp.node firebase/firebase-admin-node#849)
74d5719 docs: update references vercel/ms references (feat(auth): Add ability to link a federated ID with the updateUser() method. firebase/firebase-admin-node#770)
d71e383 docs: document "invalid token" error
3765003 docs: fix spelling in README.md: Peak -> Peek (Setting up a CI pipeline based on GitHub Actions firebase/firebase-admin-node#754)
a46097e docs: make decode impossible to discover before verify
15a1bc4 refactor: make decode non-enumerable
5f10bf9 docs: add jwtid to options of jwt.verify (⚠ Error: Cannot find module 'firebase-admin' firebase/firebase-admin-node#704)
88cb9df Replace tilde-indexOf with includes ([FR] add support for reusing firebase-tools credentials firebase/firebase-admin-node#647)
a6235fa Adds not to README on decoded payload validation (How can I logout a user firebase/firebase-admin-node#646)
5ed1f06 docs: fix tiny style change in readme (Implemented the listRulesetMetadata() API firebase/firebase-admin-node#622)
9fb90ca style: add missing semicolon (Bumped version to 8.5.0 firebase/firebase-admin-node#641)
a9e38b8 ci: use circleci (add environment variable to point admin sdk at rtdb emulator firebase/firebase-admin-node#589)
7f1f8b4 8.5.1
e5874ae fix: ensure correct PS signing and verification (onSnapshot exceeds retries? firebase/firebase-admin-node#585)
84e03ef README: fix markdown for algorithms table
1c0de55 8.5.0
eefb9d9 feat: add PS JWA support for applicable node versions (Fix type defs for Credential interface firebase/firebase-admin-node#573)
8737789 Add complete option in jwt.verify (ServiceAccount interface definition errors firebase/firebase-admin-node#522)
7b60c12 Force use_strict during testing (Enforce UserImportOptions when importing users with passwords firebase/firebase-admin-node#577)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Use of a Broken or Risky Cryptographic Algorithm
🦉 Open Redirect
🦉 Prototype Pollution


          fix: package.json to reduce vulnerabilities

048b924

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180024
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180026
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2330875
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2331908
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430337
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430339
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430341
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet