New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade google-auth-library from 0.9.10 to 1.0.0 #22

Open

MrXmit wants to merge 1 commit into master from snyk-fix-f7b802892a1902c5c392b33c4afa6dda

Owner

MrXmit commented Dec 20, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- slides/snippets/package.json
- slides/snippets/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	706/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.7	Remote Memory Exposure SNYK-JS-BL-608877	Yes	Proof of Concept
	584/1000 Why? Has a fix available, CVSS 7.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-HAWK-2808852	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ISMYJSONVALID-597165	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Arbitrary Code Execution SNYK-JS-ISMYJSONVALID-597167	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-JSONPOINTER-1577288	Yes	Proof of Concept
	811/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.8	Prototype Pollution SNYK-JS-JSONPOINTER-598804	Yes	Proof of Concept
	644/1000 Why? Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	Yes	Proof of Concept
	579/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution npm:extend:20180424	Yes	No Known Exploit
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:hoek:20180212	Yes	Proof of Concept
	571/1000 Why? Mature exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:is-my-json-valid:20180214	Yes	Mature
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:sshpk:20180409	Yes	Proof of Concept
	646/1000 Why? Mature exploit, Has a fix available, CVSS 5.2	Uninitialized Memory Exposure npm:stringstream:20180511	Yes	Mature
	576/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.1	Uninitialized Memory Exposure npm:tunnel-agent:20170305	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: google-auth-library

The new version differs by 74 commits.

b6324ce 1.0.0
10b4d5d feat: generate reference docs (chore(deps): bump googleapis from 105.0.0 to 108.0.0 in /apps-script/quickstart googleworkspace/node-samples#237)
0bc61e3 chore: cleanup samples and readme (chore(deps): bump googleapis from 105.0.0 to 108.0.0 in /gmail/quickstart googleworkspace/node-samples#240)
b8a47ca chore(package): update @ types/node to version 9.3.0 (chore(deps): bump googleapis from 105.0.0 to 108.0.0 in /drive/quickstart googleworkspace/node-samples#238)
bc5ddd6 chore: accept options objects in constructors (chore(deps): bump @google-cloud/local-auth from 2.1.0 to 2.1.1 in /tasks/quickstart googleworkspace/node-samples#230)
f388b8c chore(package): regen package-lock after merge
811293a fix: cache promise instead of ProjectId (chore(deps): bump @google-cloud/local-auth from 2.1.0 to 2.1.1 in /calendar/quickstart googleworkspace/node-samples#216)
c2af227 chore: apply code style rules to javascript (chore(deps): bump @google-cloud/local-auth from 2.1.0 to 2.1.1 in /adminSDK/reseller googleworkspace/node-samples#233)
a2fc08c fix: improve typing around tokens and add sample (chore(deps): bump eslint from 8.14.0 to 8.24.0 googleworkspace/node-samples#219)
c717429 chore: license check as posttest (chore(deps): bump @google-cloud/local-auth from 2.1.0 to 2.1.1 in /people/quickstart googleworkspace/node-samples#232)
d248a00 chore: update deps (chore(deps): bump @google-cloud/local-auth from 2.1.0 to 2.1.1 in /sheets/quickstart googleworkspace/node-samples#229)
83ed61c feat: add support for code_verifier in getToken (chore(deps): bump @google-cloud/local-auth from 2.1.0 to 2.1.1 in /drive/quickstart googleworkspace/node-samples#218)
92d5fc2 chore: docs and samples for refresh token, update uris (chore(deps): bump @google-cloud/local-auth from 2.1.0 to 2.1.1 in /adminSDK/reports googleworkspace/node-samples#215)
bb9a74b feat: allow passing maxExpiry to verifyIdToken (chore(deps): bump googleapis from 105.0.0 to 108.0.0 in /drive/activity-v2 googleworkspace/node-samples#223)
a9ab95e docs: document proxy behavior and verify with a test (chore(deps): bump googleapis from 105.0.0 to 108.0.0 in /adminSDK/reseller googleworkspace/node-samples#221)
26f6161 docs: add example and readme for using fromJSON (chore(deps): bump @google-cloud/local-auth from 2.1.0 to 2.1.1 in /apps-script/quickstart googleworkspace/node-samples#220)
db1a4ab test: add test for verifyIdToken (chore: Synced file(s) with googleworkspace/.github googleworkspace/node-samples#213)
e74d66f docs: add docs and samples (Incorrect scopes url googleworkspace/node-samples#201)
7f0869b chore: update deps to latest versions (chore: Synced file(s) with googleworkspace/.github googleworkspace/node-samples#210)
de318ab fix: Fixes mapping of FederatedSignonCertsResponse in verifyIdTokenAsync ([SyncRepoSettings bot] - Invalid config file googleworkspace/node-samples#211)
b917e5d fix: update code to support [email protected] (Cannot read properties of undefined (reading 'redirect_uris') at authenticate googleworkspace/node-samples#209)
0cd813c fix: retry checking isGCE (chore: Synced file(s) with googleworkspace/.github googleworkspace/node-samples#193)
d6e3585 1.0.0-alpha.1
d5df378 fix: use urlencoded content-type for POST (Documentation update googleworkspace/node-samples#203)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Arbitrary Code Execution
🦉 Prototype Pollution


          fix: slides/snippets/package.json & slides/snippets/package-lock.json…

3cde96e

… to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-BL-608877
- https://snyk.io/vuln/SNYK-JS-HAWK-2808852
- https://snyk.io/vuln/SNYK-JS-ISMYJSONVALID-597165
- https://snyk.io/vuln/SNYK-JS-ISMYJSONVALID-597167
- https://snyk.io/vuln/SNYK-JS-JSONPOINTER-1577288
- https://snyk.io/vuln/SNYK-JS-JSONPOINTER-598804
- https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/npm:extend:20180424
- https://snyk.io/vuln/npm:hoek:20180212
- https://snyk.io/vuln/npm:is-my-json-valid:20180214
- https://snyk.io/vuln/npm:sshpk:20180409
- https://snyk.io/vuln/npm:stringstream:20180511
- https://snyk.io/vuln/npm:tunnel-agent:20170305

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet