chore(main): release firestore 8.6.0 - #8203
Closed
codyoss wants to merge 1 commit into
Closed
Conversation
codyoss
force-pushed
the
release-please--branches--main--components--firestore
branch
from
May 6, 2026 18:07
7033d9c to
1b3c8a2
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the handwritten/firestore package from version 8.5.0 to 8.6.0. The update introduces new features including FieldValue.minimum(), FieldValue.maximum(), and enhanced search stage support for languageCode, offset, limit, and retrievalDepth. It also includes bug fixes for limit(0) serialization and the handling of undefined properties in subpipelines. I have no feedback to provide.
release-please
Bot
force-pushed
the
release-please--branches--main--components--firestore
branch
from
May 6, 2026 21:35
1b3c8a2 to
dd8d5f7
Compare
shivanee-p
pushed a commit
that referenced
this pull request
Aug 10, 2026
…8253) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [protobufjs-cli](https://redirect.github.com/protobufjs/protobuf.js) | [`1.2.0` → `1.2.1`](https://renovatebot.com/diffs/npm/protobufjs-cli/1.2.0/1.2.1) |  |  | --- ### protobuf.js is Vulnerable to OS Command Injection in the CLI [CVE-2026-42290](https://nvd.nist.gov/vuln/detail/CVE-2026-42290) / [GHSA-f84p-cvgm-xgjj](https://redirect.github.com/advisories/GHSA-f84p-cvgm-xgjj) <details> <summary>More information</summary> #### Details ##### Summary `pbts` invoked JSDoc by building a shell command string from input file paths and executing it through `child_process.exec`. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. ##### Impact An attacker who can control file names or paths passed to `pbts` may be able to execute arbitrary shell commands with the privileges of the process running `pbts`. This affects the protobufjs CLI tooling path. The protobufjs runtime APIs for encoding, decoding, parsing, and loading protobuf messages are not directly affected by this issue. ##### Preconditions - The application or user must invoke `pbts` on file paths influenced by an attacker. - The attacker must be able to supply or create a path containing shell-significant characters. - The vulnerable `pbts` version must execute the generated JSDoc command through a shell. ##### Workarounds Do not run affected versions of `pbts` on attacker-controlled file names or paths. If this cannot be avoided, sanitize or rename input files before invoking `pbts`, or run the CLI in an isolated environment with minimal privileges. #### Severity - CVSS Score: 7.8 / 10 (High) - Vector String: `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` #### References - [https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f84p-cvgm-xgjj](https://redirect.github.com/protobufjs/protobuf.js/security/advisories/GHSA-f84p-cvgm-xgjj) - [https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v1.2.1](https://redirect.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v1.2.1) - [https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v2.0.2](https://redirect.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v2.0.2) - [https://nvd.nist.gov/vuln/detail/CVE-2026-42290](https://nvd.nist.gov/vuln/detail/CVE-2026-42290) - [https://github.com/advisories/GHSA-f84p-cvgm-xgjj](https://redirect.github.com/advisories/GHSA-f84p-cvgm-xgjj) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-f84p-cvgm-xgjj) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### protobuf.js: Code injection in pbjs static output from crafted schema names [CVE-2026-44295](https://nvd.nist.gov/vuln/detail/CVE-2026-44295) / [GHSA-6r35-46g8-jcw9](https://redirect.github.com/advisories/GHSA-6r35-46g8-jcw9) <details> <summary>More information</summary> #### Details ##### Summary `pbjs` static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum, service, or derived full names could be written into the generated output without sufficient sanitization. ##### Impact An attacker who can provide or influence schemas passed to `pbjs` may be able to cause generated JavaScript output to contain attacker-controlled code. The injected code would run if the generated file is later executed or imported by the application or build process. This affects the protobufjs CLI static code generation path. Applications that only use trusted schemas, or that do not execute generated output from untrusted schemas, are not directly affected. ##### Preconditions - The application or build process must run `pbjs` static code generation on a schema or JSON descriptor influenced by an attacker. - The attacker-controlled input must contain crafted schema names that reach generated JavaScript output. - The generated JavaScript file must subsequently be executed, imported, or otherwise evaluated. ##### Workarounds Do not run affected versions of `pbjs` static code generation on untrusted schemas or descriptors. If untrusted schemas must be accepted, validate schema names before code generation and run generation in an isolated environment. #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N` #### References - [https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-6r35-46g8-jcw9](https://redirect.github.com/protobufjs/protobuf.js/security/advisories/GHSA-6r35-46g8-jcw9) - [https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v1.2.1](https://redirect.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v1.2.1) - [https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v2.0.2](https://redirect.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v2.0.2) - [https://nvd.nist.gov/vuln/detail/CVE-2026-44295](https://nvd.nist.gov/vuln/detail/CVE-2026-44295) - [https://github.com/advisories/GHSA-6r35-46g8-jcw9](https://redirect.github.com/advisories/GHSA-6r35-46g8-jcw9) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-6r35-46g8-jcw9) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>protobufjs/protobuf.js (protobufjs-cli)</summary> ### [`v1.2.1`](https://redirect.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v1.2.1): protobufjs-cli: v1.2.1 [Compare Source](https://redirect.github.com/protobufjs/protobuf.js/compare/protobufjs-cli-v1.2.0...protobufjs-cli-v1.2.1) ##### Bug Fixes - Backport input hardening and CLI fixes to 7.x ([#​2173](https://redirect.github.com/protobufjs/protobuf.js/issues/2173)) ([75392ea](https://redirect.github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/googleapis/google-cloud-node). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzMuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE3OS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 I have created a release beep boop
8.6.0 (2026-05-06)
Features
Bug Fixes
ignoreUndefinedPropertiesin subpipelines (#8089) (a9f6c3f)This PR was generated with Release Please. See documentation.