[Snyk] Upgrade: , google-protobuf

[thiswayman]

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

@grpc/grpc-js
from 1.5.4 to 1.11.1 | 76 versions ahead of your current version | 2 months ago
on 2024-07-16
google-protobuf
from 3.19.4 to 3.21.4 | 9 versions ahead of your current version | 2 months ago
on 2024-07-15

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Prototype Pollution SNYK-JS-PROTOBUFJS-5756498	559	Proof of Concept
	Uncontrolled Resource Consumption SNYK-JS-GRPCGRPCJS-7242922	559	No Known Exploit

Release notes

Package name: @grpc/grpc-js

• 1.11.1 - 2024-07-16
  
  • Fixed an issue where building from source would sometimes fail (#304)
  • Added NodeJS 10 pre-built binaries (#302)
  • Added Electron 2 pre-built binaries (#291)
  • Added TypeScript type definitions for APIs added in v1.11.x (#306)
• 1.11.0 - 2024-07-15
  

  @ grpc/proto-loader v0.1.0

  This is a new library for loading .proto files for use with gRPC using the latest version of Protobuf.js. The output of this package is intended to be loaded using the new loadPackageDefinition function in the grpc library.

  @ grpc/grpc-js v0.1.0

  This is the first alpha release of the new pure JavaScript implementation of gRPC. It implements the same API as the existing grpc library. Currently only the client is implemented, with the following functionality:

  • loadPackageDefinition
  • Unary and streaming calls
  • Cancellation
  • Deadlines
  • Metadata
  • Basic automatic reconnection logic
  • Channel and call credentials

  grpc v1.11.0

  Node changes:

  • Add client interceptors API (#59 contributed by @ drobertduke)
  • Add loadPackageDefintion function (#196)
  • Publish ARM64 binaries (#200)
  • Improve function type test in a client method (#204 contributed by @ arcana261)
  • Add details to UNIMPLEMENTED response status (#207 contributed by @ theogravity)
  • Add error handling for missing files when calling grpc.load (#228 contributed by @ cblair)
  • Fix error message in grpc.loadObject when failing to detect Protobuf.js version (#253 contributed by @ kellycampbell)
  • Remove -zdefs flag from binding.gyp to enable building on FreeBSD (#266)
• 1.10.11 - 2024-07-10
• 1.10.10 - 2024-06-24
• 1.10.9 - 2024-06-10
• 1.10.8 - 2024-05-15
• 1.10.7 - 2024-05-01
• 1.10.6 - 2024-04-03
• 1.10.5 - 2024-04-01
• 1.10.4 - 2024-03-26
• 1.10.3 - 2024-03-15
• 1.10.2 - 2024-03-11
• 1.10.1 - 2024-02-15
  

  Node changes:

  • Update dependency on node-pre-gyp to version 0.7.0 (#245)

  C core changes:

  • Decrease number of pings sent by clients (grpc/grpc#14804)
  • Fix memory leak caused by flow control bug (grpc/grpc#14828)
• 1.10.0 - 2024-02-06
  

  C Core Changes

  • Fix memory leaks in max_age_filter (grpc/grpc#14501) and http_proxy (grpc/grpc#14137)
  • Added re-resolution into grpclb policy (grpc/grpc#14438)
  • Update BoringSSL submodule (grpc/grpc#13948)
  • Make RR re-resolve when any of its subchannels fail (grpc/grpc#14170)
  • DNS resolver caches results, allowing it to be hit arbitrarily often. Resolution frequency is controlled via channel arg "grpc.dns_min_time_between_resolutions_ms". (grpc/grpc#14228)
• 1.9.15 - 2024-06-10
• 1.9.14 - 2024-01-16
• 1.9.13 - 2023-12-12
• 1.9.12 - 2023-11-27
• 1.9.11 - 2023-11-16
• 1.9.10 - 2023-11-14
• 1.9.9 - 2023-10-30
• 1.9.8 - 2023-10-27
• 1.9.7 - 2023-10-19
• 1.9.6 - 2023-10-17
• 1.9.5 - 2023-10-02
• 1.9.4 - 2023-09-26
• 1.9.3 - 2023-09-13
• 1.9.2 - 2023-08-31
• 1.9.1 - 2023-08-22
  
  • Fix usage of Protobuf.js Message type in TypeScript type definitions file (#177)
  • Fix handling of undefined values for optional call arguments (#179)
• 1.9.0 - 2023-08-01
  
  • Further improve the error output when failing to load an installed precompiled binary (#175)
  • Fix type definition documentation for KeyCertPair (#171)
  • Fix server segfault on invalid HTTP/2 (grpc/grpc#14199)
  • LB policies request re-resolution without shutting down (grpc/grpc#12829)
  • On server, include receiving HTTP/2 settings in handshake timeout (grpc/grpc#13336)
  • Fix max connection idleness crash (grpc/grpc#14122)
  • Report metadata plugin auth errors with an UNAVAILABLE status instead of UNAUTHENTICATED (grpc/grpc#13363).
• 1.8.22 - 2024-06-10
• 1.8.21 - 2023-07-28
• 1.8.20 - 2023-07-25
• 1.8.19 - 2023-07-24
• 1.8.18 - 2023-07-13
• 1.8.17 - 2023-06-27
• 1.8.16 - 2023-06-20
• 1.8.15 - 2023-06-05
• 1.8.14 - 2023-04-12
• 1.8.13 - 2023-03-23
• 1.8.12 - 2023-03-07
• 1.8.11 - 2023-02-24
• 1.8.10 - 2023-02-22
• 1.8.9 - 2023-02-15
• 1.8.8 - 2023-02-08
• 1.8.7 - 2023-01-25
• 1.8.6 - 2023-01-25
• 1.8.5 - 2023-01-23
• 1.8.4 - 2023-01-12
  
  • Add error code name and number to status Error objects for easier debugging. The status details string is now available in the Error object's details field. (#126)
  • Made a build process change that may fix some installation errors
  • Add more informative error for a missing callback to the Server#tryShutdown method (#143)
  • Removed extraneous files from published package
  • Mark some network errors with an UNAVAILABLE status (grpc/grpc#13917)
  • Fix HTTP/2 PING issues (grpc/grpc#13950)
• 1.8.3 - 2023-01-11
• 1.8.2 - 2023-01-09
• 1.8.1 - 2023-01-03
• 1.8.0 - 2022-12-07
  
  • Publish precompiled binaries for Alpine Linux
  • Improve the error output when failing to load an installed precompiled binary (#106).
• 1.7.3 - 2022-10-21
  
  • Pick up a security bug fix from gRPC core (grpc/grpc#13642).
• 1.7.2 - 2022-10-14
  
  • Separate precompiled binaries for glibc and musl libc (#82, courtesy of @ bkw)
    • Precompiled binaries are not yet distributed for musl libc. Installations on Alpine Linux will result in compiling the binary locally.
  • Remove incorrect assertion (#92)
• 1.7.1 - 2022-09-21
• 1.7.0 - 2022-09-08
• 1.6.12 - 2022-08-31
• 1.6.11 - 2022-08-29
• 1.6.10 - 2022-08-15
• 1.6.9 - 2022-08-09
• 1.6.8 - 2022-07-21
• 1.6.7 - 2022-04-20
• 1.6.6 - 2022-04-18
• 1.6.5 - 2022-04-15
• 1.6.4 - 2022-04-14
• 1.6.3 - 2022-04-11
• 1.6.2 - 2022-04-04
• 1.6.1 - 2022-04-01
• 1.6.0 - 2022-03-31
• 1.5.10 - 2022-03-24
• 1.5.9 - 2022-03-16
• 1.5.8 - 2022-03-14
• 1.5.7 - 2022-02-24
• 1.5.6 - 2022-02-23
• 1.5.5 - 2022-02-10
• 1.5.4 - 2022-01-31

from @grpc/grpc-js GitHub release notes

Package name: google-protobuf

• 3.21.4 - 2024-07-15
  

  Release to fix bazel build layering issue in 3.21.3.

• 3.21.2 - 2022-10-10
  

  This is a hotfix release for #141

• 3.21.1 - 2022-10-07
  
  • Enable Closure's advanced optimization mode by default. This should reduce code size (#124).
  • Replace goog.testing.asserts in tests with Jasmine expectations (#136).
  • Bring in the subset of the goog.asserts we use as jspb.asserts. This code retains an Apache 2.0 license.
  • Fix decoding of signed varint32s (#31).
  • Add license files to NPM package.

  This will also be our first release to have cross-compiled protoc-gen-js binaries. Please note that they use dynamic linking (similar to the protobuf protoc releases).

• 3.21.0 - 2022-07-28
  

  First release of protobuf-javascript as a standalone project.

  This release mostly consists of BUILD and documentation fixes to account for new repository.
  Various bug fixes.

• 3.20.1 - 2022-04-21
• 3.20.1-rc.1 - 2022-04-06
• 3.20.0 - 2022-04-01
• 3.20.0-rc.2 - 2022-03-17
• 3.20.0-rc.1 - 2022-03-04
• 3.19.4 - 2022-01-28

from google-protobuf GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs