New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade @google-cloud/logging from 1.2.0 to 5.0.0 #37

Open

takeratta wants to merge 1 commit into master from snyk-fix-bd934f36bf496eb33958d23ccb211794

Owner

takeratta commented Nov 29, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- packages/logging-bunyan/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	616/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.9	Server-Side Request Forgery (SSRF) SNYK-JS-AXIOS-1038255	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-1579269	Yes	Proof of Concept
	676/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.1	Cross-site Request Forgery (CSRF) SNYK-JS-AXIOS-6032459	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Information Exposure SNYK-JS-FOLLOWREDIRECTS-2332181	Yes	Proof of Concept
	344/1000 Why? Has a fix available, CVSS 2.6	Information Exposure SNYK-JS-FOLLOWREDIRECTS-2396346	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	Yes	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @google-cloud/logging

The new version differs by 250 commits.

8206ff5 chore: release 5.0.0 (Final review for PubSub by Google PubSub team googleapis/google-cloud-node#487)
22f529f build: updated kokoro config for coverage and release-please (Support Google DNS API googleapis/google-cloud-node#486)
063b01d chore(deps): update dependency @ google-cloud/pubsub to ^0.29.0 (Final review for Storage googleapis/google-cloud-node#485)
e1042c7 build: add new kokoro config for coverage and release-please (Change GCLOUD_TESTS_KEY to "./key.json" in Travis googleapis/google-cloud-node#484)
0ee71bd fix: use originalUrl for Express middleware's request url (Remove bullet points from parameters googleapis/google-cloud-node#476)
afe89de fix(deps): update dependency @ opencensus/propagation-stackdriver to v0.0.12 (Overview of Authentication in docs googleapis/google-cloud-node#483)
ee5d17f fix(deps): update dependency type-fest to ^0.5.0 (Final review for BigQuery by someone from Google googleapis/google-cloud-node#482)
b782177 chore(deps): update dependency jsdoc to v3.6.2 (Add async to deps googleapis/google-cloud-node#481)
58e6154 fix(deps): update dependency @ google-cloud/common-grpc to v1 (Lack of developer documentation googleapis/google-cloud-node#479)
c732969 docs: update jsdoc formatting (async is not included in package.json googleapis/google-cloud-node#480)
558bfc5 fix(deps): update dependency google-auth-library to v4 (docs: fix markup for dox. googleapis/google-cloud-node#475)
4fdb8c1 fix: DEADLINE_EXCEEDED retry code is idempotent (List Bucket and List File googleapis/google-cloud-node#478)
535aedb fix(deps): update dependency google-gax to v1 (docs: fix dox parsing issue by using RegExp object googleapis/google-cloud-node#477)
473d145 fix: DEADLINE_EXCEEDED no longer listed as idempotent
125b356 fix(deps): update dependency gcp-metadata to v2 (Switch Protocol Buffers lib googleapis/google-cloud-node#474)
aae0c5e chore(docs): formatting updates (Access Denied: Cannot delete BigQuery dataset in regression test. googleapis/google-cloud-node#454)
3d5111f chore(deps): update dependency google-proto-files to v1 (pubsub error - Cannot read property 'onAuthorized' of undefined googleapis/google-cloud-node#466)
90d74bd fix(deps): update dependency @ google-cloud/paginator to v1 (Fix makePublic and makePrivate steps to occur in series googleapis/google-cloud-node#467)
af0994f refactor: log.ts to async-first (Fix variable in documentation of README.md googleapis/google-cloud-node#453)
9a9d3db build: allow Node 10 on presubmit to push to codecov (impossible to upload files to google storage with v0.12.0 googleapis/google-cloud-node#470)
5a295a3 build: allow Node 10 to push to codecov (fix #466 googleapis/google-cloud-node#469)
0d3921f build: patch Windows container, fixing Node 10 (Exponential backoff and retry certain requests googleapis/google-cloud-node#468)
7fd4049 chore(deps): update dependency gts to v1 (Do not autoAck when no messages are pulled googleapis/google-cloud-node#456)
97fdb00 chore: do not run CI on grpc-js (Uncaught Error: The metadata for bucket "gcloud-test-bucket-temp..." was edited during the operation. Please try again. googleapis/google-cloud-node#462)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Server-Side Request Forgery (SSRF)
🦉 Cross-site Request Forgery (CSRF)
🦉 More lessons are available in Snyk Learn


          fix: packages/logging-bunyan/package.json to reduce vulnerabilities

17ba859

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-AXIOS-1038255
- https://snyk.io/vuln/SNYK-JS-AXIOS-1579269
- https://snyk.io/vuln/SNYK-JS-AXIOS-6032459
- https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2332181
- https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2396346
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2330875
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2331908
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430337
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430339
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430341
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet