search

mozilla-rally / rally

A monorepo for Rally project containing Rally SDK, Rally Web Platform and Extensions.
Mozilla Public License 2.0
7 stars 6 forks source link

Bump jsonwebtoken, firebase-admin and firebase-tools in /web-platform/functions #606

Open dependabot[bot] opened 1 year ago

dependabot[bot] commented 1 year ago

Bumps jsonwebtoken to 9.0.0 and updates ancestor dependencies jsonwebtoken, firebase-admin and firebase-tools. These dependencies need to be updated together.

Updates jsonwebtoken from 8.5.1 to 9.0.0

Changelog

Sourced from jsonwebtoken's changelog.

9.0.0 - 2022-12-21

Breaking changes: See Migration from v8 to v9

Breaking changes

Security fixes

  • security: fixes Arbitrary File Write via verify function - CVE-2022-23529
  • security: fixes Insecure default algorithm in jwt.verify() could lead to signature validation bypass - CVE-2022-23540
  • security: fixes Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - CVE-2022-23541
  • security: fixes Unrestricted key type could lead to legacy keys usage - CVE-2022-23539
Commits
  • e1fa9dc Merge pull request from GHSA-8cf7-32gw-wr33
  • 5eaedbf chore(ci): remove github test actions job (#861)
  • cd4163e chore(ci): configure Github Actions jobs for Tests & Security Scanning (#856)
  • ecdf6cc fix!: Prevent accidental use of insecure key sizes & misconfiguration of secr...
  • 8345030 fix(sign&verify)!: Remove default none support from sign and verify met...
  • 7e6a86b Upload OpsLevel YAML (#849)
  • 74d5719 docs: update references vercel/ms references (#770)
  • d71e383 docs: document "invalid token" error
  • 3765003 docs: fix spelling in README.md: Peak -> Peek (#754)
  • a46097e docs: make decode impossible to discover before verify
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by julien.wollscheid, a new releaser for jsonwebtoken since your current version.


Updates firebase-admin from 9.12.0 to 11.5.0

Release notes

Sourced from firebase-admin's releases.

Firebase Admin Node.js SDK v11.5.0

New Features

  • feat: Fix impersonated service account parsing exception (#1862)

Bug Fixes

  • fix(firestore): Fix PreferRest caching (#2040)

Miscellaneous

  • [chore] Release 11.5.0 (#2049)
  • chore: Increase test coverage for service account impersonation support (#2047)
  • build(deps-dev): bump @​typescript-eslint/eslint-plugin (#2045)
  • build(deps): bump jwks-rsa from 2.1.5 to 3.0.1 (#2046)
  • build(deps-dev): bump @​typescript-eslint/parser from 5.47.0 to 5.48.2 (#2044)
  • build(deps): bump @​firebase/database-types from 0.9.17 to 0.10.0 (#2030)
  • build(deps): bump json5 from 2.2.1 to 2.2.3 (#2038)
  • build(deps-dev): bump eslint from 8.29.0 to 8.31.0 (#2033)
  • build(deps): bump @​firebase/database-compat from 0.2.10 to 0.3.0 (#2029)
  • build(deps-dev): bump sinon from 14.0.2 to 15.0.1 (#2028)

Firebase Admin Node.js SDK v11.4.1

Bug Fixes

  • fix: Update jsonwebtoken to v9.0.0 (#2025)

Miscellaneous

  • [chore] Release 11.4.1 (#2026)
  • build(deps-dev): bump mocha from 10.1.0 to 10.2.0 (#2019)
  • build(deps-dev): bump @​typescript-eslint/parser from 5.42.1 to 5.47.0 (#2020)
  • build(deps-dev): bump @​typescript-eslint/eslint-plugin (#2018)

Firebase Admin Node.js SDK v11.4.0

Breaking Changes

  • change: Deprecate AutoML model support (#2013)

New Features

  • feat(fs): preferRest app option for Firestore (#1901)

Bug Fixes

  • fix(fcm): Increase batch send timeout to 15 seconds (#1999)
  • fix: Unregister socket timeout listener to prevent MaxListenersExceededWarning (#1993)

Miscellaneous

... (truncated)

Commits
  • 49251a8 [chore] Release 11.5.0 (#2049)
  • 1896500 chore: Increase test coverage for service account impersonation support (#2047)
  • dd98704 build(deps-dev): bump @​typescript-eslint/eslint-plugin (#2045)
  • 46ad67c build(deps): bump jwks-rsa from 2.1.5 to 3.0.1 (#2046)
  • 71d0d14 build(deps-dev): bump @​typescript-eslint/parser from 5.47.0 to 5.48.2 (#2044)
  • b5c4f5a build(deps): bump @​firebase/database-types from 0.9.17 to 0.10.0 (#2030)
  • 63adec1 build(deps): bump json5 from 2.2.1 to 2.2.3 (#2038)
  • 6061ff6 fix(firestore): Fix PreferRest caching (#2040)
  • c81f572 feat: Fix impersonated service account parsing exception (#1862)
  • dc1d320 build(deps-dev): bump eslint from 8.29.0 to 8.31.0 (#2033)
  • Additional commits viewable in compare view


Updates firebase-tools from 10.9.2 to 11.25.2

Release notes

Sourced from firebase-tools's releases.

v11.25.2

  • Releases Cloud Firestore emulator v1.16.1, which adds support for read_time in ListCollectionIds.
  • Fixes auth:export with csv format for users with custom claims. (#3319)

v11.25.1

  • Fixes a missing dependency on p-limit. (#5619)

v11.25.0

  • Adds support for optional --database argument in Firestore commands (#5548).
  • Adds multiple firestore database targets support in firebase.json (#5548).
  • Removes call to Cloud Run API and set CPU & concurrency in GCF API instead. (#5605)
  • Fixes function deploy retry after quota exceeded bug and increase backoff. (#5601)
  • Fixes bug where EVENTARC_CLOUD_EVENT_SOURCE environment variable was correctly set for some functions. (#5597)
  • Adds 2nd gen firestore triggers to firebase deploy (#5592).
  • Adds Extension emulator support for system params.
  • Adds database:import command for non-atomic imports (#5396).

v11.24.1

  • Fixes an issue where ext:dev:init would fail due to a missing CHANGELOG.md file (#5530).

v11.24.0

  • Allow configuration of the Cloud Function generated for full-stack web frameworks (#5504)
  • Fixes bug where passing --port flag in functions:shell does not set which port to emulate functions (#5521)
  • Improve error message during deploy when given invalid hosting rewrite rule (#5533)
  • Generate ESM-compatible SSR function for web frameworks (#5540)
  • Fix bug emulators:exec script didn't populate FIREBASE_CONFIG environment variable (#5544)

v11.23.1

  • Fix bug where CLI couldn't discover functions for monorepo setups. (#5518)
  • Fix bug where --inspect-functions flag always fails. #5516

v11.23.0

  • Fix storage download name issue #5478
  • Refactor the way timeouts are enforced by the Functions Emulator (#5464)
  • Fix bug where cloudevent emitted by various emulators didn't conform to spec (#5466)
  • Upgrade the emulator suite UI to 1.11.3 to capture some bug fixes (#5479)
  • Web frameworks deploys can once again bundle local NPM dependencies (#5440)
  • Catches error when attempting to deploy without a project (#5415)
  • Fixes a number of issues and outdated dependencies in templates for init --only functions and ext:dev:init
  • Adds integration tests and useful scripts to the extension directory created by ext:dev:init.
  • Support private network access (CORS-RFC1918) in Firestore Emulator (#4227)
  • Fix some edge cases where Emulator UI cannot reach the emulators (#912)
  • Fix various accessibility and usability issues in Emulator UI.
  • Support .env when deploying a web framework (#5501)
  • Fix various issues with "init hosting" and web frameworks (#5500)
  • Fix Next.js deployments on Windows (#5499)

v11.22.0

  • Refactors Functions Emulator. (#5422)
  • Fixes race condition when discovering functions. (#5444)

... (truncated)

Commits
  • 4c95535 11.25.2
  • 9b65124 Fix typo in Extensions docs (#5632)
  • bff5da7 quote entire custom claims object and escape inner quotes (#5630)
  • b14b5f3 Update more import assignments (#5628)
  • f200dcb Release Cloud Firestore Emulator v1.16.1. (#5575)
  • 8484e4a [firebase-release] Removed change log and reset repo after 11.25.1 release
  • 159498f 11.25.1
  • 48e18f9 Adding p-limit as a direct dependency (#5620)
  • 010c433 [firebase-release] Removed change log and reset repo after 11.25.0 release
  • 4da61f6 11.25.0
  • Additional commits viewable in compare view


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/mozilla-rally/rally/network/alerts).
netlify[bot] commented 1 year ago

Deploy Preview for rally-prod canceled.

Name Link
Latest commit 7c811e30564be9313ddd22ae56c3bf5eb1b64169
Latest deploy log https://app.netlify.com/sites/rally-prod/deploys/642b0bab253f5c000838665b
netlify[bot] commented 1 year ago

Deploy Preview for rally-staging canceled.

Name Link
Latest commit 7c811e30564be9313ddd22ae56c3bf5eb1b64169
Latest deploy log https://app.netlify.com/sites/rally-staging/deploys/642b0bab9f3bc500087dab48