googleapis / googleapis/google-cloud-node
version 10.0.1 depends on vulnerable protobufjs
- Dominant language
- TypeScript
- Stars
- 3.2k
- Forks
- 712
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 99
Description
Version 10.0.1 of @google-cloud/datastore library sets `"protobufjs": "7.0.0"` which has a critical vulnerability.
```
# npm audit report
protobufjs 7.0.0 - 7.2.4
Severity: critical
protobufjs Prototype Pollution vulnerability - https://github.com/advisories/GHSA-h755-8qp9-cq85
fix available via `npm audit fix --force`
Will install @google-cloud/datastore@9.2.1, which is a breaking change
node_modules/@google-cloud/datastore/node_modules/protobufjs
@google-cloud/datastore >=10.0.1
Depends on vulnerable versions of protobufjs
node_modules/@google-cloud/datastore
2 critical severity vulnerabilities
```
Overriding to `"protobufjs": "^7.0.0"` seem to bring in latest of protobufjs that mitigates the vulnerability & seem to work okay in our tests.
Can this dependency be updated and released?
Contributor guide
Assessment
This issue has not been assessed yet.