googleapis / googleapis/google-cloud-node

version 10.0.1 depends on vulnerable protobufjs

Open
#7,153 10 comments 10 reactions 0 assignees View on GitHub
api: datastore library: datastore
Dominant language
TypeScript
Stars
3.2k
Forks
712
Avg merge
2d 3h
Merged PRs (30d)
99

Description

Version 10.0.1 of @google-cloud/datastore library sets `"protobufjs": "7.0.0"` which has a critical vulnerability.

```
# npm audit report

protobufjs 7.0.0 - 7.2.4
Severity: critical
protobufjs Prototype Pollution vulnerability - https://github.com/advisories/GHSA-h755-8qp9-cq85
fix available via `npm audit fix --force`
Will install @google-cloud/datastore@9.2.1, which is a breaking change
node_modules/@google-cloud/datastore/node_modules/protobufjs
@google-cloud/datastore >=10.0.1
Depends on vulnerable versions of protobufjs
node_modules/@google-cloud/datastore

2 critical severity vulnerabilities
```

Overriding to `"protobufjs": "^7.0.0"` seem to bring in latest of protobufjs that mitigates the vulnerability & seem to work okay in our tests.

Can this dependency be updated and released?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.