Conversation
fix: bump protobufjs to ^7.5.5 (critical CVE)
…tobufjs to 7.5.8 Resolves runtime CVEs pulled transitively through the dependency tree: - form-data (critical), jws, gaxios, retry-request, teeny-request, uuid -> via google-gax 4->5 and google-auth-library 9->10 - protobufjs <=7.5.7 (code injection, DoS, prototype pollution) -> via protobufjs ^7.5.8 No source changes required: the gax/auth API surface consumed by pubsub is unchanged across the major bumps. Verified `tsc --noEmit` passes and prod audit drops from 8 vulns to 1. engines.node raised to >=18 (required by gax 5 / auth 10). protos regenerated by the newer protobufjs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
chore(security): bump google-gax→5, google-auth-library→10, protobufjs→7.5.8
The lockfile lagged package.json after the security dep release (PR #4): root version stayed 5.2.1 and engines stayed >=14. Regenerated to match (version 5.2.2, engines >=18). Lockfile-only; does not ship to consumers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Resolves the last prod audit finding: cross-spawn ReDoS (GHSA-3xgq-45jj-v275). cross-spawn is a deep transitive (gax->rimraf->glob->foreground-child) gated by foreground-child's ^7.0.0 range, so no parent bump moves it; updated the lock entry directly to the in-range fix 7.0.6. Also picks up gax 5.0.7. Lockfile-only. Prod audit now: 0 vulnerabilities. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
gax 5.0.7 pins google-auth-library to exactly 10.5.0, but pubsub declared ^10.5.0 (resolves 10.6.2) -> two auth-library versions -> incompatible AuthClient types -> build fails at src/pubsub.ts:338 (new GoogleAuth). Pinning to 10.5.0 dedupes them so tsc/build passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix: pin auth-library 10.5.0 (build fix) + lock sync + cross-spawn ReDoS
@grpc/grpc-js was pinned to 1.12.2, vulnerable to GHSA server crash via malformed request (affects 1.12.0-1.12.6, fixed 1.14.4). It's a direct dependency that ships to consumers. Bumped to ^1.14.4 — same major, fixed, and dedupes with gax 5.0.7's ^1.12.6. prod audit: 0 vulnerabilities. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(security): bump @grpc/grpc-js to ^1.14.4 (server-crash CVE)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:
Fixes #<issue_number_goes_here> 🦕
Note: If you are opening a pull request against a
legacybranch, PLEASE BE AWARE that we generally won't accept these except for things like important security fixes, and only for a limited time.