search

google / pprof-nodejs

pprof support for Node.js
Apache License 2.0
251 stars 26 forks source link

fix(deps): update dependency protobufjs to ~7.2.0 [security] #254

Closed renovate-bot closed 11 months ago

renovate-bot commented 1 year ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
protobufjs (source) ~7.0.0 -> ~7.2.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-36665

protobuf.js (aka protobufjs) 6.10.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about Object.constructor.prototype.<new-property> = ...; whereas CVE-2022-25878 was about Object.__proto__.<new-property> = ...; instead.

Release Notes

protobufjs/protobuf.js (protobufjs) ### [`v7.2.4`](https://togithub.com/protobufjs/protobuf.js/blob/HEAD/CHANGELOG.md#724-2023-06-23) [Compare Source](https://togithub.com/protobufjs/protobuf.js/compare/protobufjs-v7.2.3...protobufjs-v7.2.4) ##### Bug Fixes - do not let setProperty change the prototype ([#​1899](https://togithub.com/protobufjs/protobuf.js/issues/1899)) ([e66379f](https://togithub.com/protobufjs/protobuf.js/commit/e66379f451b0393c27d87b37fa7d271619e16b0d)) ### [`v7.2.3`](https://togithub.com/protobufjs/protobuf.js/blob/HEAD/CHANGELOG.md#723-2023-03-27) [Compare Source](https://togithub.com/protobufjs/protobuf.js/compare/protobufjs-v7.2.2...protobufjs-v7.2.3) ##### Bug Fixes - type names can be split into multiple tokens ([#​1877](https://togithub.com/protobufjs/protobuf.js/issues/1877)) ([8817ee6](https://togithub.com/protobufjs/protobuf.js/commit/8817ee613dfcf55f7f6fa8704f3fdd3e68c0e1d8)) ### [`v7.2.2`](https://togithub.com/protobufjs/protobuf.js/blob/HEAD/CHANGELOG.md#722-2023-02-07) [Compare Source](https://togithub.com/protobufjs/protobuf.js/compare/protobufjs-v7.2.1...protobufjs-v7.2.2) ##### Bug Fixes - do not allow to extend same field twice to prevent the error ([#​1784](https://togithub.com/protobufjs/protobuf.js/issues/1784)) ([14f0536](https://togithub.com/protobufjs/protobuf.js/commit/14f05364a04fe1ca0bfb278b3407e058c6b5a1ab)) ### [`v7.2.1`](https://togithub.com/protobufjs/protobuf.js/blob/HEAD/CHANGELOG.md#721-2023-02-02) [Compare Source](https://togithub.com/protobufjs/protobuf.js/compare/protobufjs-v7.2.0...protobufjs-v7.2.1) ##### Bug Fixes - **cli:** fix relative path to Google pb files ([#​1859](https://togithub.com/protobufjs/protobuf.js/issues/1859)) ([e42eea4](https://togithub.com/protobufjs/protobuf.js/commit/e42eea4868b11f4a07934804a56683321ed191e2)) - Revert "fix: error should be thrown" ([4489fa7](https://togithub.com/protobufjs/protobuf.js/commit/4489fa771464bcb49b57149760e9cc4131e8077e)) - use bundled filename to fix common pb includes ([#​1860](https://togithub.com/protobufjs/protobuf.js/issues/1860)) ([dce9a2e](https://togithub.com/protobufjs/protobuf.js/commit/dce9a2ef92d363752e40b295b0da9bd178f82e83)) - use ES5 style function syntax ([#​1830](https://togithub.com/protobufjs/protobuf.js/issues/1830)) ([64e8936](https://togithub.com/protobufjs/protobuf.js/commit/64e8936ad9f73c68b3fa1e57857dd38323b5a745)) ### [`v7.2.0`](https://togithub.com/protobufjs/protobuf.js/blob/HEAD/CHANGELOG.md#720-2023-01-24) [Compare Source](https://togithub.com/protobufjs/protobuf.js/compare/protobufjs-v7.1.2...protobufjs-v7.2.0) ##### Features - **cli:** generate static files at the granularity of proto messages ([#​1840](https://togithub.com/protobufjs/protobuf.js/issues/1840)) ([32f2d6a](https://togithub.com/protobufjs/protobuf.js/commit/32f2d6a68b27997bd0f7619998695a9fa7a4fd70)) ##### Bug Fixes - error should be thrown ([#​1817](https://togithub.com/protobufjs/protobuf.js/issues/1817)) ([e7a3489](https://togithub.com/protobufjs/protobuf.js/commit/e7a34897a122342485468999a507626f1ea91507)) ### [`v7.1.2`](https://togithub.com/protobufjs/protobuf.js/blob/HEAD/CHANGELOG.md#712-2022-09-22) [Compare Source](https://togithub.com/protobufjs/protobuf.js/compare/protobufjs-v7.1.1...protobufjs-v7.1.2) ##### Bug Fixes - **types:** nested object can be a oneof ([#​1812](https://togithub.com/protobufjs/protobuf.js/issues/1812)) ([119d90a](https://togithub.com/protobufjs/protobuf.js/commit/119d90aa1ce14d7bff20bb1dcc1ddc4544a80c23)) ### [`v7.1.1`](https://togithub.com/protobufjs/protobuf.js/blob/HEAD/CHANGELOG.md#711-2022-09-09) [Compare Source](https://togithub.com/protobufjs/protobuf.js/compare/protobufjs-v7.1.0...protobufjs-v7.1.1) ##### Bug Fixes - add import long to the generated .d.ts ([#​1802](https://togithub.com/protobufjs/protobuf.js/issues/1802)) ([7c27b5a](https://togithub.com/protobufjs/protobuf.js/commit/7c27b5ad5d161c9f3711aa053ca704f8e1224e90)) - generate valid js code for aliased enum values ([#​1801](https://togithub.com/protobufjs/protobuf.js/issues/1801)) ([7120e93](https://togithub.com/protobufjs/protobuf.js/commit/7120e93b7980728614779c50f40877da57e3cf37)) ### [`v7.1.0`](https://togithub.com/protobufjs/protobuf.js/blob/HEAD/CHANGELOG.md#710-2022-08-26) [Compare Source](https://togithub.com/protobufjs/protobuf.js/compare/protobufjs-v7.0.0...protobufjs-v7.1.0) ##### Features - accept unknown enum values in fromObject ([#​1793](https://togithub.com/protobufjs/protobuf.js/issues/1793)) ([ef24ae4](https://togithub.com/protobufjs/protobuf.js/commit/ef24ae4e93cf8635ff38398b37f3597e5d478330)) - valuesOptions for enums ([#​1358](https://togithub.com/protobufjs/protobuf.js/issues/1358)) ([bb6b1d4](https://togithub.com/protobufjs/protobuf.js/commit/bb6b1d4942d924bcb4ee3ad15f4823f2d9c1ab22)) ##### Bug Fixes - **deps:** update dependency glob to v8 ([#​1750](https://togithub.com/protobufjs/protobuf.js/issues/1750)) ([8303a64](https://togithub.com/protobufjs/protobuf.js/commit/8303a648bc12dcea5aa8e7efa042de39011857f9)) - extensions broke oneof ([#​1789](https://togithub.com/protobufjs/protobuf.js/issues/1789)) ([d7f501c](https://togithub.com/protobufjs/protobuf.js/commit/d7f501c49d523cda423a3ab8bcaeb59a0216b350)) - remove unused `@types/long` ([#​1785](https://togithub.com/protobufjs/protobuf.js/issues/1785)) ([0f4af83](https://togithub.com/protobufjs/protobuf.js/commit/0f4af83e4ed3cef1ec035c2833e0b06cab0bd87f)) - support for nested messages and enums within group blocks ([#​1790](https://togithub.com/protobufjs/protobuf.js/issues/1790)) ([f36d4e4](https://togithub.com/protobufjs/protobuf.js/commit/f36d4e4a2df809b47ff85f87aba319b86be90878)) - **types:** update type deps ([#​1776](https://togithub.com/protobufjs/protobuf.js/issues/1776)) ([d87978b](https://togithub.com/protobufjs/protobuf.js/commit/d87978b8eb2a176676c58379a89206b94a6d926a))

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

â™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.

aabmass commented 11 months ago

It looks like the protobuf type definitions just need to be regenerated

codecov-commenter commented 11 months ago

Codecov Report

Merging #254 (48b413b) into main (b945686) will decrease coverage by 0.27%. The diff coverage is 48.14%.

@@            Coverage Diff             @@
##             main     #254      +/-   ##
==========================================
- Coverage   42.21%   41.94%   -0.27%     
==========================================
  Files          14       14              
  Lines        2061     2093      +32     
  Branches       42       42              
==========================================
+ Hits          870      878       +8     
- Misses       1173     1197      +24     
  Partials       18       18
Impacted Files Coverage Δ
proto/profile.js 23.55% <48.14%> (+0.03%) :arrow_up:
forking-renovate[bot] commented 11 months ago

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

âš  Warning: custom changes will be lost.