Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Upgrade: , , , , , , , async, google-protobuf, pino #2

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Upgrade: , , , , , , , async, google-protobuf, pino #2

wants to merge 1 commit into from

Conversation

yash509
Copy link
Owner

@yash509 yash509 commented Sep 16, 2024

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

@grpc/proto-loader
from 0.7.10 to 0.7.13 | 3 versions ahead of your current version | 4 months ago
on 2024-05-01
@google-cloud/profiler
from 6.0.0 to 6.0.1 | 1 version ahead of your current version | 7 months ago
on 2024-02-05
@grpc/grpc-js
from 1.9.5 to 1.11.1 | 24 versions ahead of your current version | 2 months ago
on 2024-07-16
@opentelemetry/api
from 1.6.0 to 1.9.0 | 3 versions ahead of your current version | 3 months ago
on 2024-06-05
@opentelemetry/instrumentation-grpc
from 0.44.0 to 0.52.1 | 12 versions ahead of your current version | 3 months ago
on 2024-06-20
@opentelemetry/sdk-trace-base
from 1.17.1 to 1.25.1 | 11 versions ahead of your current version | 3 months ago
on 2024-06-20
@opentelemetry/sdk-node
from 0.44.0 to 0.52.1 | 12 versions ahead of your current version | 3 months ago
on 2024-06-20
async
from 3.2.4 to 3.2.6 | 2 versions ahead of your current version | a month ago
on 2024-08-19
google-protobuf
from 3.21.2 to 3.21.4 | 1 version ahead of your current version | 2 months ago
on 2024-07-15
pino
from 8.16.0 to 8.21.0 | 9 versions ahead of your current version | 5 months ago
on 2024-04-24

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
medium severity Uncontrolled Resource Consumption ('Resource Exhaustion')
SNYK-JS-TAR-6476909		 432 Proof of Concept
Release notes
Package name: @grpc/proto-loader
  • 0.7.13 - 2024-05-01
  • 0.7.12 - 2024-03-28
  • 0.7.11 - 2024-03-26
  • 0.7.10 - 2023-09-18
from @grpc/proto-loader GitHub release notes
Package name: @google-cloud/profiler from @google-cloud/profiler GitHub release notes
Package name: @grpc/grpc-js
  • 1.11.1 - 2024-07-16
    • Fixed an issue where building from source would sometimes fail (#304)
    • Added NodeJS 10 pre-built binaries (#302)
    • Added Electron 2 pre-built binaries (#291)
    • Added TypeScript type definitions for APIs added in v1.11.x (#306)
  • 1.11.0 - 2024-07-15

    @ grpc/proto-loader v0.1.0

    This is a new library for loading .proto files for use with gRPC using the latest version of Protobuf.js. The output of this package is intended to be loaded using the new loadPackageDefinition function in the grpc library.

    @ grpc/grpc-js v0.1.0

    This is the first alpha release of the new pure JavaScript implementation of gRPC. It implements the same API as the existing grpc library. Currently only the client is implemented, with the following functionality:

    • loadPackageDefinition
    • Unary and streaming calls
    • Cancellation
    • Deadlines
    • Metadata
    • Basic automatic reconnection logic
    • Channel and call credentials

    grpc v1.11.0

    Node changes:

    • Add client interceptors API (#59 contributed by @ drobertduke)
    • Add loadPackageDefintion function (#196)
    • Publish ARM64 binaries (#200)
    • Improve function type test in a client method (#204 contributed by @ arcana261)
    • Add details to UNIMPLEMENTED response status (#207 contributed by @ theogravity)
    • Add error handling for missing files when calling grpc.load (#228 contributed by @ cblair)
    • Fix error message in grpc.loadObject when failing to detect Protobuf.js version (#253 contributed by @ kellycampbell)
    • Remove -zdefs flag from binding.gyp to enable building on FreeBSD (#266)
  • 1.10.11 - 2024-07-10
  • 1.10.10 - 2024-06-24
  • 1.10.9 - 2024-06-10
  • 1.10.8 - 2024-05-15
  • 1.10.7 - 2024-05-01
  • 1.10.6 - 2024-04-03
  • 1.10.5 - 2024-04-01
  • 1.10.4 - 2024-03-26
  • 1.10.3 - 2024-03-15
  • 1.10.2 - 2024-03-11
  • 1.10.1 - 2024-02-15

    Node changes:

    • Update dependency on node-pre-gyp to version 0.7.0 (#245)

    C core changes:

  • 1.10.0 - 2024-02-06

    C Core Changes

  • 1.9.15 - 2024-06-10
  • 1.9.14 - 2024-01-16
  • 1.9.13 - 2023-12-12
  • 1.9.12 - 2023-11-27
  • 1.9.11 - 2023-11-16
  • 1.9.10 - 2023-11-14
  • 1.9.9 - 2023-10-30
  • 1.9.8 - 2023-10-27
  • 1.9.7 - 2023-10-19
  • 1.9.6 - 2023-10-17
  • 1.9.5 - 2023-10-02
from @grpc/grpc-js GitHub release notes
Package name: @opentelemetry/api
  • 1.9.0 - 2024-06-05

    1.9.0

    🚀 (Enhancement)

    • feat(metrics): added synchronous gauge #4528 @ clintonb
    • feat(api): allow adding span links after span creation #4536 @ seemk
      • This change is non-breaking for end-users, but breaking for Trace SDK implmentations in accordance with the specification as new features need to be implemented.
    • feat: support node 22 #4666 @ dyladan
  • 1.8.0 - 2024-02-29
  • 1.7.0 - 2023-11-07
  • 1.6.0 - 2023-09-12
from @opentelemetry/api GitHub release notes
Package name: @opentelemetry/instrumentation-grpc
  • 0.52.1 - 2024-06-20

    0.52.1

    🚀 (Enhancement)

    • refactor(instrumentation-fetch): move fetch to use SEMATRR #4632
    • refactor(otlp-transformer): use explicit exports #4785 @ pichlermarc

    🐛 (Bug Fix)

    🏠 (Internal)

    • test: add npm run maint:regenerate-test-certs maintenance script and regenerate recently expired test certs #4777
  • 0.52.0 - 2024-06-05

    0.52.0

    💥 Breaking Change

    • feat(exporter--otlp-)!: move serialization for Node.js exporters to @ opentelemetry/otlp-transformer #4542 @ pichlermarc
      • Breaking changes:
        • (user-facing) convert() now returns an empty object and will be removed in a follow-up
        • (internal) OTLPExporterNodeBase now has additional constructor parameters that are required
        • (internal) OTLPExporterNodeBase now has an additional ResponseType type parameter
    • feat(exporter--otlp-)!: move serialization for Node.js exporters to @ opentelemetry/otlp-transformer #4581 @ pichlermarc
      • Breaking changes:
        • (user-facing) convert() has been removed from all exporters
        • (internal) OTLPExporterBrowserBase: RequestType has been replaced by a ResponseType type-argument
        • (internal) OTLPExporterNodeBase: ServiceRequest has been replaced by a ServiceResponse type-argument
        • (internal) the @ opentelemetry/otlp-exporter-proto-base package has been removed, and will from now on be deprecated in npm
    • feat(instrumentation): remove default value for config in base instrumentation constructor #4695: @ blumamir
    • fix(instrumentation)!: remove unused supportedVersions from Instrumentation interface #4694 @ blumamir
    • feat(instrumentation)!: simplify registerInstrumentations() API
      • Breaking changes:
        • removes InstrumentationOptions type
        • occurrences of InstrumentationOptions are now replaced by (Instrumentation | Instrumentation[])[]
          • migrate usages of registerInstrumentations({instrumentations: fooInstrumentation}) to registerInstrumentations({instrumentations: [fooInstrumentation]})
          • passing Instrumentation classes to registerInstrumentations() is now not possible anymore.
    • feat(sdk-node)!: simplify type of instrumentations option
      • Breaking changes:
        • replaces InstrumentationOptions with (Instrumentation | Instrumentation[])[]

    🚀 (Enhancement)

    • feat(instrumentation): apply unwrap before wrap in base class #4692
    • feat(instrumentation): add util to execute span customization hook in base class #4663 @ blumamir
    • feat(instrumentation): generic config type in instrumentation base #4659 @ blumamir
    • feat: support node 22 #4666 @ dyladan
    • feat(propagator-aws-xray-lambda): add AWS Xray Lambda propagator 4554
    • refactor(instrumentation-xml-http-request): use exported strings for semantic attributes. #4681

    🐛 (Bug Fix)

    📚 (Refine Doc)

    • docs(instrumentation): better docs for supportedVersions option #4693 @ blumamir
    • docs: align all supported versions to a common format #4696 @ blumamir
    • refactor(examples): use new exported string constants for semconv in experimental/examples/opencensus-shim #4763 @ Zen-cronic
  • 0.51.1 - 2024-05-07
  • 0.51.0 - 2024-04-24
  • 0.50.0 - 2024-04-03
  • 0.49.1 - 2024-02-29
  • 0.49.0 - 2024-02-29
  • 0.48.0 - 2024-01-26
  • 0.47.0 - 2024-01-15
  • 0.46.0 - 2023-12-14
  • 0.45.1 - 2023-11-08
  • 0.45.0 - 2023-11-07
  • 0.44.0 - 2023-10-10
from @opentelemetry/instrumentation-grpc GitHub release notes
Package name: @opentelemetry/sdk-trace-base
  • 1.25.1 - 2024-06-20

    1.25.1

    📚 (Refine Doc)

    • refactor(examples): added usage of @ opentelemetry/semantic-conventions and @ opentelemetry/resources to the examples in examples/opentelemetry-web for maintaining consistency across all examples. #4764 @ Zen-cronic

    🏠 (Internal)

  • 1.25.0 - 2024-06-05

    1.25.0

    🚀 (Enhancement)

    📚 (Refine Doc)

    • refactor(examples): use new exported string constants for semconv in examples/esm-http-ts #4758 @ Zen-cronic
    • refactor(examples): use new exported string constants for semconv in examples/basic-tracer-node #4759 @ Zen-cronic
    • refactor(examples): use new exported string constants for semconv in examples/http #4750 @ Zen-cronic
    • refactor(examples): use new exported string constants for semconv in examples/grpc-js #4760 @ Zen-cronic
    • refactor(examples): use new exported string constants for semconv in examples/otlp-exporter-node #4762 @ Zen-cronic
    • refactor(examples): use new exported string constants for semconv in examples/opentracing-shim #4761 @ Zen-cronic
  • 1.24.1 - 2024-05-07

    1.24.1

    🐛 (Bug Fix)

    • fix(core): align inconsistent behavior of getEnv() and getEnvWithoutDefaults() when a process polyfill is used #4648 @ pichlermarc
      • getEnvWithoutDefaults() would use process.env if it was defined when running in a browser, while getEnv() would always use _globalThis. Now both use _globalThis when running in a browser.
    • fix(resources): prevent circular import (resource -> detector -> resource -> ...) #4653 @ pichlermarc
      • fixes a circular import warning which would appear in rollup when bundling @ opentelemetry/resources
    • fix(exporter-metrics-otlp-grpc): add explicit otlp-exporter-base dependency to exporter-metrics-otlp-grpc #4678 @ AkselAllas
  • 1.24.0 - 2024-04-24
  • 1.23.0 - 2024-04-03
  • 1.22.0 - 2024-02-29
  • 1.21.0 - 2024-01-26
  • 1.20.0 - 2024-01-15
  • 1.19.0 - 2023-12-14
  • 1.18.1 - 2023-11-08
  • 1.18.0 - 2023-11-07
  • 1.17.1 - 2023-10-10
from @opentelemetry/sdk-trace-base GitHub release notes
Package name: @opentelemetry/sdk-node
  • 0.52.1 - 2024-06-20

    0.52.1

    🚀 (Enhancement)

    • refactor(instrumentation-fetch): move fetch to use SEMATRR #4632
    • refactor(otlp-transformer): use explicit exports #4785 @ pichlermarc

    🐛 (Bug Fix)

    🏠 (Internal)

    • test: add npm run maint:regenerate-test-certs maintenance script and regenerate recently expired test certs #4777
  • 0.52.0 - 2024-06-05

    0.52.0

    💥 Breaking Change

    • feat(exporter--otlp-)!: move serialization for Node.js exporters to @ opentelemetry/otlp-transformer #4542 @ pichlermarc
      • Breaking changes:
        • (user-facing) convert() now returns an empty object and will be removed in a follow-up
        • (internal) OTLPExporterNodeBase now has additional constructor parameters that are required
        • (internal) OTLPExporterNodeBase now has an additional ResponseType type parameter
    • feat(exporter--otlp-)!: move serialization for Node.js exporters to @ opentelemetry/otlp-transformer #4581 @ pichlermarc
      • Breaking changes:
        • (user-facing) convert() has been removed from all exporters
        • (internal) OTLPExporterBrowserBase: RequestType has been replaced by a ResponseType type-argument
        • (internal) OTLPExporterNodeBase: ServiceRequest has been replaced by a ServiceResponse type-argument
        • (internal) the @ opentelemetry/otlp-exporter-proto-base package has been removed, and will from now on be deprecated in npm
    • feat(instrumentation): remove default value for config in base instrumentation constructor #4695: @ blumamir
    • fix(instrumentation)!: remove unused supportedVersions from Instrumentation interface #4694 @ blumamir
    • feat(instrumentation)!: simplify registerInstrumentations() API
      • Breaking changes:
        • removes InstrumentationOptions type
        • occurrences of InstrumentationOptions are now replaced by (Instrumentation | Instrumentation[])[]
          • migrate usages of registerInstrumentations({instrumentations: fooInstrumentation}) to registerInstrumentations({instrumentations: [fooInstrumentation]})
          • passing Instrumentation classes to registerInstrumentations() is now not possible anymore.
    • feat(sdk-node)!: simplify type of instrumentations option
      • Breaking changes:
        • replaces InstrumentationOptions with (Instrumentation | Instrumentation[])[]

    🚀 (Enhancement)

    • feat(instrumentation): apply unwrap before wrap in base class #4692
    • feat(instrumentation): add util to execute span customization hook in base class #4663 @ blumamir
    • feat(instrumentation): generic config type in instrumentation base #4659 @ blumamir
    • feat: support node 22 #4666 @ dyladan
    • feat(propagator-aws-xray-lambda): add AWS Xray Lambda propagator 4554
    • refactor(instrumentation-xml-http-request): use exported strings for semantic attributes. #4681

    🐛 (Bug Fix)

    📚 (Refine Doc)

    • docs(instrumentation): better docs for supportedVersions option #4693 @ blumamir
    • docs: align all supported versions to a common format #4696 @ blumamir
    • refactor(examples): use new exported string constants for semconv in experimental/examples/opencensus-shim #4763 @ Zen-cronic
  • 0.51.1 - 2024-05-07
  • 0.51.0 - 2024-04-24
  • 0.50.0 - 2024-04-03
  • 0.49.1 - 2024-02-29
  • 0.49.0 - 2024-02-29
  • 0.48.0 - 2024-01-26
  • 0.47.0 - 2024-01-15
  • 0.46.0 - 2023-12-14
  • 0.45.1 - 2023-11-08
  • 0.45.0 - 2023-11-07
  • 0.44.0 - 2023-10-10
from @opentelemetry/sdk-node GitHub release notes
Package name: async from async GitHub release notes
Package name: google-protobuf
  • 3.21.4 - 2024-07-15

    Release to fix bazel build layering issue in 3.21.3.

  • 3.21.2 - 2022-10-10

    This is a hotfix release for #141

from google-protobuf GitHub release notes
Package name: pino

@snyk-bot
fix: upgrade multiple dependencies with Snyk
17f3836 
Snyk has created this PR to upgrade:
  - @grpc/proto-loader from 0.7.10 to 0.7.13.
    See this package in npm: https://www.npmjs.com/package/@grpc/proto-loader
  - @google-cloud/profiler from 6.0.0 to 6.0.1.
    See this package in npm: https://www.npmjs.com/package/@google-cloud/profiler
  - @grpc/grpc-js from 1.9.5 to 1.11.1.
    See this package in npm: https://www.npmjs.com/package/@grpc/grpc-js
  - @opentelemetry/api from 1.6.0 to 1.9.0.
    See this package in npm: https://www.npmjs.com/package/@opentelemetry/api
  - @opentelemetry/instrumentation-grpc from 0.44.0 to 0.52.1.
    See this package in npm: https://www.npmjs.com/package/@opentelemetry/instrumentation-grpc
  - @opentelemetry/sdk-trace-base from 1.17.1 to 1.25.1.
    See this package in npm: https://www.npmjs.com/package/@opentelemetry/sdk-trace-base
  - @opentelemetry/sdk-node from 0.44.0 to 0.52.1.
    See this package in npm: https://www.npmjs.com/package/@opentelemetry/sdk-node
  - async from 3.2.4 to 3.2.6.
    See this package in npm: https://www.npmjs.com/package/async
  - google-protobuf from 3.21.2 to 3.21.4.
    See this package in npm: https://www.npmjs.com/package/google-protobuf
  - pino from 8.16.0 to 8.21.0.
    See this package in npm: https://www.npmjs.com/package/pino

See this project in Snyk:
https://app.snyk.io/org/yash509-FLozTNRih4edwndPjnPymy/project/451b3f80-1337-42c0-b333-2599cfdc25f4?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@yash509 @snyk-bot