[Snyk] Upgrade: , , jsonwebtoken, lru-cache, gcf-utils, , , , c8, gts, mocha, nock, sinon, typescript #501
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade multiple dependencies.
👯 The following dependencies are linked and will therefore be updated together.ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
@types/node
⚠️ This is a major version upgrade, and may be a breaking change | 21 days ago
⚠️ This is a major version upgrade, and may be a breaking change | 4 months ago
⚠️ This is a major version upgrade, and may be a breaking change | 2 months ago
⚠️ This is a major version upgrade, and may be a breaking change | a year ago
⚠️ This is a major version upgrade, and may be a breaking change | a year ago
⚠️ This is a major version upgrade, and may be a breaking change | 8 months ago
⚠️ This is a major version upgrade, and may be a breaking change | 3 months ago
⚠️ This is a major version upgrade, and may be a breaking change | 3 months ago
⚠️ This is a major version upgrade, and may be a breaking change | 4 months ago
⚠️ This is a major version upgrade, and may be a breaking change | 2 months ago
from 18.15.5 to 22.5.1 | 273 versions ahead of your current version
on 2024-08-28
@google-cloud/secret-manager
from 4.2.2 to 5.6.0 | 8 versions ahead of your current version
on 2024-05-21
jsonwebtoken
from 9.0.0 to 9.0.2 | 2 versions ahead of your current version | a year ago
on 2023-08-30
lru-cache
from 7.18.3 to 11.0.0 | 28 versions ahead of your current version
on 2024-07-08
gcf-utils
from 14.4.6 to 15.0.1 | 2 versions ahead of your current version
on 2023-09-26
@google-automations/bot-config-utils
from 6.1.3 to 7.0.0 | 1 version ahead of your current version
on 2023-09-18
@types/mocha
from 10.0.1 to 10.0.7 | 6 versions ahead of your current version | 3 months ago
on 2024-06-22
@types/sinon
from 10.0.13 to 17.0.3 | 11 versions ahead of your current version
on 2024-01-10
c8
from 7.14.0 to 10.1.2 | 8 versions ahead of your current version
on 2024-06-13
gts
from 4.0.1 to 5.3.1 | 10 versions ahead of your current version
on 2024-06-11
mocha
from 10.2.0 to 10.7.3 | 10 versions ahead of your current version | a month ago
on 2024-08-09
nock
from 13.3.0 to 13.5.5 | 15 versions ahead of your current version | a month ago
on 2024-08-20
sinon
from 15.0.2 to 18.0.0 | 15 versions ahead of your current version
on 2024-05-15
typescript
from 4.9.5 to 5.5.4 | 595 versions ahead of your current version
on 2024-07-22
Issues fixed by the recommended upgrade:
SNYK-JS-OCTOKITWEBHOOKS-6129527
SNYK-JS-BODYPARSER-7926860
SNYK-JS-BODYPARSER-7926860
SNYK-JS-BRACES-6838727
SNYK-JS-PROBOT-6129524
SNYK-JS-MARKDOWNIT-6483324
SNYK-JS-MICROMATCH-6838728
SNYK-JS-PATHTOREGEXP-7925106
SNYK-JS-EXPRESS-6474509
SNYK-JS-PATHTOREGEXP-7925106
SNYK-JS-SERIALIZEJAVASCRIPT-6147607
SNYK-JS-EXPRESS-7926867
SNYK-JS-GRPCGRPCJS-7242922
SNYK-JS-SEND-7926862
SNYK-JS-SERVESTATIC-7926865
Release notes
Package name: @types/node
Package name: @google-cloud/secret-manager
Package name: jsonwebtoken
Release 9.0.2 (#935)
Updating package version to 9.0.1 (#920)
Check if node version supports asymmetricKeyDetails
Validate algorithms for ec key type
Rename variable
Rename function
Add early return for symmetric keys
Validate algorithm for RSA key type
Validate algorithm for RSA-PSS key type
Check key types for EdDSA algorithm
Rename function
Move validateKey function to module
Convert arrow to function notation
Validate key in verify function
Simplify if
Convert if to switch..case
Guard against empty key in validation
Remove empty line
Add lib to check modulus length
Add modulus length checks
Validate mgf1HashAlgorithm and saltLength
Check node version before using key details API
Use built-in modulus length getter
Fix Node version validations
Remove duplicate validateKey
Add periods to error messages
Fix validation in verify function
Make asymmetric key validation the latest validation step
Change key curve validation
Remove support for ES256K
Fix old test that was using wrong key types to sign tokens
Enable RSA-PSS for old Node versions
Add specific RSA-PSS validations on Node 16 LTS+
Improve error message
Simplify key validation code
Fix typo
Improve error message
Change var to const in test
Change const to let to avoid reassigning problem
Improve error message
Test incorrect private key type
Rename invalid to unsupported
Test verifying of jwt token with unsupported key
Test invalid private key type
Change order of object parameters
Move validation test to separate file
Move all validation tests to separate file
Add prime256v1 ec key
Remove modulus length check
WIP: Add EC key validation tests
Fix node version checks
Fix error message check on test
Add successful tests for EC curve check
Remove only from describe
Remove
only
Remove duplicate block of code
Move variable to a different scope and make it const
Convert allowed curves to object for faster lookup
Rename variable
Change variable assignment order
Remove unused object properties
Test RSA-PSS happy path and wrong length
Add missing tests
Pass validation if no algorithm has been provided
Test validation of invalid salt length
Test error when signing token with invalid key
Change var to const/let in verify tests
Test verifying token with invalid key
Improve test error messages
Add parameter to skip private key validation
Replace DSA key with a 4096 bit long key
Test allowInvalidPrivateKeys in key signing
Improve test message
Rename variable
Add key validation flag tests
Fix variable name in Readme
Change private to public dsa key in verify
Rename flag
Run EC validation tests conditionally
Fix tests in old node versions
Ignore block of code from test coverage
Separate EC validations tests into two different ones
Add comment
Wrap switch in if instead of having an early return
Remove unsupported algorithms from asymmetric key validation
Rename option to allowInvalidAsymmetricKeyTypes and improve Readme
9.0.0
adding migration notes to readme
adding changelog for version 9.0.0
Co-authored-by: julienwoll julien.wollscheid@auth0.com
Package name: lru-cache
11.0.0
10.4.1
10.4.0
10.3.1
10.3.0
10.2.2
10.2.1
10.2.0
10.1.0
10.0.3
Package name: gcf-utils
15.0.1 (2023-09-26)
Bug Fixes
Package name: @google-automations/bot-config-utils
Package name: @types/mocha
Package name: @types/sinon
Package name: c8
10.1.2 (2024-06-13)
Bug Fixes
10.1.1 (2024-06-11)
Bug Fixes
10.1.0 (2024-06-11)
Features
10.0.0 (2024-06-10)
⚠ BREAKING CHANGES
Bug Fixes
9.1.0 (2024-01-11)
Features
Bug Fixes
9.0.0 (2024-01-03)
⚠ BREAKING CHANGES
Features
8.0.1 (2023-07-25)
Bug Fixes
8.0.0 (2023-06-05)
⚠ BREAKING CHANGES
Miscellaneous Chores
7.14.0 (2023-05-26)
Features
--merge-async
to asynchronously and incrementally merge process coverage files to avoid OOM due to heap exhaustion (#469) (45f2f84)Package name: gts
5.3.1 (2024-04-10)
Bug Fixes
Performance Improvements
Promise.all
for Resource-Friendly Tasks 🚤 (#838) (7424fe1)5.3.0 (2024-03-21)
Features
Bug Fixes
5.2.0 (2023-10-04)
Features
5.1.1 (2023-10-04)
Bug Fixes
5.1.0 (2023-09-29)
Features
Bug Fixes
5.0.1 (2023-08-21)
Bug Fixes
5.0.0 (2023-07-26)
⚠ BREAKING CHANGES
Bug Fixes
Miscellaneous Chores
4.0.1 (2023-01-09)
Bug Fixes
Package name: mocha
10.7.3 (2024-08-09)
🩹 Fixes
What's Changed
New Contributors
Full Changelog: v10.6.1...v10.7.0
What's Changed
Full Changelog: v10.6.0...v10.6.1
What's Changed
Full Changelog: v10.5.2...v10.6.0
What's Changed
New Contributors
Full Changelog: v10.5.1...v10.5.2
What's Changed
New Contributors
Full Changelog: v10.5.0...v10.5.1
🎉 Enhancements