Fix CVE-2023-36665, CVE-2022-35177

metrico / qryn

⭐️ All-in-One Polyglot Observability with OLAP Storage for Logs, Metrics, Traces & Profiles. Drop-in Grafana Cloud replacement compatible with Loki, Prometheus, Tempo, Pyroscope, Opentelemetry, Datadog and beyond :rocket:

https://qryn.dev

GNU Affero General Public License v3.0

1.19k stars 67 forks source link

Fix CVE-2023-36665, CVE-2022-35177 #430

Closed deathalt closed 8 months ago

deathalt commented 8 months ago

Update protobufjs to 7.0.5 to avoid CVE-2023-36665, remove dev dependencies to fix CVE-2022-35177, make production container non root

CLAassistant commented 8 months ago

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

Андрей Лалаев seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

socket-security[bot] commented 8 months ago

Updated dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
protobufjs	7.2.4...7.2.5	None	`+0/-0`	2.77 MB	google-wombot

lmangani commented 8 months ago

Thanks @deathalt for your contribution ⭐