-
Notifications
You must be signed in to change notification settings - Fork 28
Labels
api: cloudprofilerIssues related to the googleapis/cloud-profiler-nodejs API.Issues related to the googleapis/cloud-profiler-nodejs API.priority: p2Moderately-important priority. Fix may not be included in next release.Moderately-important priority. Fix may not be included in next release.type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.Error or flaw in code with unintended results or allowing sub-optimal usage patterns.
Description
Link to vulnerability report: GHSA-h755-8qp9-cq85
@google-cloud/profiler uses pprof 3.2.0, which in turn uses protobufjs ~7.0.0
The vulnerability has been patched in protobufjs 7.2.4, but pprof still needs to be patched to use the newer version
There's an issue here to track the protobufjs upgrade within pprof: google/pprof-nodejs#256
The pprof version used by @google-cloud/profiler locked to 3.2.0, so it'll need to be bumped when the protobufjs dependency is upgraded
Environment details
- OS: any
- Node.js version: any
- npm version:
@google-cloud/profilerversion: 5.0.4
Steps to reproduce
- Install
@google-cloud/profiler - Notice the security vulnerability alert
ariel9016
Metadata
Metadata
Assignees
Labels
api: cloudprofilerIssues related to the googleapis/cloud-profiler-nodejs API.Issues related to the googleapis/cloud-profiler-nodejs API.priority: p2Moderately-important priority. Fix may not be included in next release.Moderately-important priority. Fix may not be included in next release.type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.Error or flaw in code with unintended results or allowing sub-optimal usage patterns.