[Snyk] Upgrade firebase-admin from 11.3.0 to 13.0.1 #625

aravindvnair99 · 2024-12-16T05:57:57Z

Snyk has created this PR to upgrade firebase-admin from 11.3.0 to 13.0.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

The recommended version is 23 versions ahead of your current version.
The recommended version was released on 25 days ago.

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Infinite loop SNYK-JS-MARKDOWNIT-6483324	506	Proof of Concept
Internal Property Tampering SNYK-JS-TAFFYDB-2992450	506	Proof of Concept
Uncontrolled Resource Consumption SNYK-JS-GRPCGRPCJS-7242922	506	No Known Exploit
Resource Exhaustion SNYK-JS-JOSE-6419224	506	No Known Exploit
Improper Authentication SNYK-JS-JSONWEBTOKEN-3180022	506	No Known Exploit
Improper Restriction of Security Token Assignment SNYK-JS-JSONWEBTOKEN-3180024	506	No Known Exploit
Use of a Broken or Risky Cryptographic Algorithm SNYK-JS-JSONWEBTOKEN-3180026	506	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-WORDWRAP-3149973	506	Proof of Concept

Release notes

Package name: firebase-admin

13.0.1 - 2024-11-20
Bug Fixes
- fix: Fix the property names when initializing the SDK with ServiceAccount type (#2779)
Miscellaneous
- [chore] Release 13.0.1 (#2780)
- build(deps-dev): bump @ firebase/auth-compat from 0.5.15 to 0.5.16 (#2776)
- build(deps): bump google-auth-library from 9.14.2 to 9.15.0 (#2773)
- build(deps): bump @ firebase/database-compat from 2.0.0 to 2.0.1 (#2774)
- build(deps-dev): bump @ firebase/auth-types from 0.12.2 to 0.12.3 (#2775)
13.0.0 - 2024-11-12
Breaking Changes
- change(rc): Update Remote Config condition evaluation hashing (#2760)
- change(fcm): Remove deprecated FCM APIs (#2759)
- change: Update Node support to 18 (#2756)
- change: Migrate credentials to use google-auth-library (#2466)
New Features
- feat(fcm): Add directBootOk field to AndroidConfig (#2745)
Bug Fixes
- fix: Set the Quota Project ID only for ADC human accounts (#2761)
Miscellaneous
- [chore] Release 13.0.0 (#2764)
- build(deps): bump uuid from 11.0.2 to 11.0.3 (#2767)
- build(deps-dev): bump nock from 13.5.5 to 13.5.6 (#2766)
- chore: Add X-Goog-Api-Client metric header to outgoing authorized http requests (#2763)
- chore: Upgrade dependencies (#2757)
- Request timeout const name correction (#2743)
- build(deps-dev): bump @ firebase/app-compat from 0.2.43 to 0.2.45 (#2746)
12.7.0 - 2024-10-24
New Features
- feat(auth): Add recaptcha and sms toll fraud support for phone auth (#2625)
Bug Fixes
- fix: Pin @ firebase/database-compat to v1.0.8 (#2739)
Miscellaneous
- [chore] Release 12.7.0 (#2741)
- build(deps-dev): bump @ microsoft/api-extractor from 7.47.9 to 7.47.11 (#2734)
- build(deps-dev): bump @ types/lodash from 4.17.10 to 4.17.12 (#2735)
- chore: Add X-Goog-Api-Client metric header to Auth and FCM requests (#2738)
- chore: Update auth.spec.ts (#2737)
- chore: fix dataconnect integration tests (#2736)
- build(deps-dev): bump @ firebase/app-compat from 0.2.42 to 0.2.43 (#2729)
- build(deps-dev): bump @ types/lodash from 4.17.9 to 4.17.10 (#2730)
- fixes function name resolution to cloud tasks emulator queue (#2726)
- build(deps-dev): bump @ types/mocha from 10.0.8 to 10.0.9 (#2721)
- build(deps-dev): bump @ firebase/app-compat from 0.2.41 to 0.2.42 (#2722)
- build(deps-dev): bump nyc from 17.0.0 to 17.1.0 (#2718)
- build(deps): bump @ google-cloud/storage from 7.12.1 to 7.13.0 (#2717)
- build(deps-dev): bump @ types/mocha from 10.0.7 to 10.0.8 (#2719)
12.6.0 - 2024-09-30
New Features
- feat: Add Data Connect API (#2701)
Bug Fixes
- fix(auth): Add missing Math.floor() when setting validDuration in createSessionCookie() (#2712)
Miscellaneous
- [chore] Release 12.6.0 (#2715)
- build(deps-dev): bump @ types/lodash from 4.17.7 to 4.17.9 (#2710)
- build(deps-dev): bump @ firebase/app-compat from 0.2.39 to 0.2.41 (#2711)
- build(deps-dev): bump eslint from 8.57.0 to 8.57.1 (#2707)
- build(deps-dev): bump @ microsoft/api-extractor from 7.47.6 to 7.47.9 (#2706)
- build(deps): bump @ google-cloud/firestore from 7.9.0 to 7.10.0 (#2705)
12.5.0 - 2024-09-12
New Features
- feat(rc): SSRC targeting (#2665)
Bug Fixes
- fix: updating comments with VibrateTimingsMillis and defaultVibrateTimings instead of vibrate_timings and default_vibrate_timings (#2598)
- fix: support httpAgent in JwksFetcher (#2689)
Miscellaneous
- [chore] Release 12.5.0 Take 2 (#2703)
- [chore] Release 12.5.0 (#2702)
- chore: Upgrade actions/upload-artifact@v4 (#2700)
- build(deps): bump actions/download-artifact in /.github/workflows (#2694)
- Create CHANGELOG.md (#2626)
12.4.0 - 2024-08-22
Miscellaneous
- [chore] Release 12.4.0 (#2674)
- build(deps-dev): bump @ firebase/app-compat from 0.2.38 to 0.2.39 (#2677)
- chore: Deprecate sendToTopic and Condition (#2683)
- build(deps): bump @ types/node from 22.1.0 to 22.3.0 (#2675)
- build(deps-dev): bump mocha from 10.7.0 to 10.7.3 (#2670)
- build(deps): bump @ google-cloud/storage from 7.12.0 to 7.12.1 (#2669)
- build(deps): bump axios in /.github/actions/send-email (#2673)
- build(deps-dev): bump @ microsoft/api-extractor from 7.47.5 to 7.47.6 (#2671)
- Reroute Cloud Tasks to emulator when it is running (#2649)
12.3.1 - 2024-08-08
Bug Fixes
- fix: getToken() returns existing promise to a token if one exists instead of a new token. (#2648)
Miscellaneous
- [chore] Release 12.3.1 (#2667)
- chore: Skip sendToDeviceGroup integration test (#2666)
- build(deps-dev): bump @ microsoft/api-extractor from 7.47.2 to 7.47.5 (#2661)
- build(deps): bump @ types/node from 22.0.1 to 22.1.0 (#2663)
- build(deps-dev): bump @ firebase/app-compat from 0.2.37 to 0.2.38 (#2664)
- build(deps): bump @ types/node from 20.14.11 to 22.0.1 (#2657)
- build(deps-dev): bump chai from 4.4.1 to 4.5.0 (#2650)
- build(deps-dev): bump @ firebase/app-compat from 0.2.35 to 0.2.37 (#2653)
- build(deps): bump fast-xml-parser from 4.4.0 to 4.4.1 (#2654)
12.3.0 - 2024-07-25
New Features
- feat(fcm): Add HTTP2 support for sendEach() and sendEachForMulticast() (#2550)
Miscellaneous
- [chore] Release 12.3.0 (#2644)
- build(deps): bump @ types/node from 20.14.8 to 20.14.11 (#2641)
- build(deps-dev): bump @ microsoft/api-extractor from 7.47.0 to 7.47.2 (#2642)
- build(deps): bump @ google-cloud/storage from 7.11.2 to 7.12.0 (#2643)
- build(deps-dev): bump mocha and @ types/mocha (#2640)
- build(deps): bump @ fastify/busboy from 2.1.1 to 3.0.0 (#2632)
- build(deps-dev): bump @ types/lodash from 4.17.5 to 4.17.7 (#2636)
- Remove Remote Config dependency on Long JS (#2614)
- build(deps): bump @ google-cloud/firestore from 7.8.0 to 7.9.0 (#2618)
- build(deps-dev): bump nyc from 15.1.0 to 17.0.0 (#2616)
- chore: update integration test resources (#2615)
- build(deps-dev): bump @ types/uuid from 9.0.8 to 10.0.0 (#2612)
- build(deps): bump @ types/node from 20.14.2 to 20.14.8 (#2613)
12.2.0 - 2024-06-20
Breaking Changes
- change: Deprecate Node.js 16 support (#2574)
Bug Fixes
- fix: Replace farmhash with farmhash-modern (#2603)
- fix: Make ADC + human account work with firebase-admin (#2553)
- fix: Use optional chaining in FirebaseError (#2581)
Miscellaneous
- [chore] Release 12.2.0 (#2605)
- build(deps): bump uuid from 9.0.1 to 10.0.0 (#2599)
- build(deps-dev): bump chai-exclude from 2.1.0 to 2.1.1 (#2593)
- build(deps-dev): bump braces from 3.0.2 to 3.0.3 (#2595)
- build(deps): bump @ grpc/grpc-js from 1.10.8 to 1.10.9 (#2592)
- build(deps-dev): bump @ types/lodash from 4.17.4 to 4.17.5 (#2594)
- build(deps): bump @ google-cloud/firestore from 7.7.0 to 7.8.0 (#2583)
- build(deps): bump @ types/node from 20.12.12 to 20.14.0 (#2585)
- build(deps-dev): bump @ firebase/app-compat from 0.2.34 to 0.2.35 (#2575)
- build(deps-dev): bump chai-as-promised from 7.1.1 to 7.1.2 (#2578)
- build(deps): bump @ google-cloud/storage from 7.11.0 to 7.11.1 (#2579)
12.1.1 - 2024-05-21
Bug Fixes
- fix: Export error classes (#2151)
Miscellaneous
- [chore] Release 12.1.1 (#2561)
- build(deps): updgrade jwks-rsa (#2570)
- --- (#2568)
- --- (#2566)
- --- (#2567)
- --- (#2569)
- build(deps-dev): bump @ firebase/auth-types from 0.12.1 to 0.12.2 (#2556)
- build(deps-dev): bump @ microsoft/api-extractor from 7.43.2 to 7.43.7 (#2559)
- chore: upgrade firestore to 7.7.0 (#2560)
- build(deps-dev): bump @ firebase/app-compat from 0.2.32 to 0.2.33 (#2555)
- build(deps): bump @ google-cloud/firestore from 7.6.0 to 7.7.0 (#2558)
- Fix api extractor issues to expose error types (#2549)
- build(deps-dev): bump @ types/lodash from 4.17.0 to 4.17.1 (#2546)
- build(deps): bump @ google-cloud/storage from 7.10.2 to 7.11.0 (#2547)
- build(deps-dev): bump @ microsoft/api-extractor from 7.43.1 to 7.43.2 (#2545)
- build(deps): bump @ types/node from 20.12.7 to 20.12.10 (#2544)
- build(deps-dev): bump @ firebase/app-compat from 0.2.31 to 0.2.32 (#2540)
- build(deps): bump @ google-cloud/storage from 7.10.1 to 7.10.2 (#2541)
- build(deps): bump @ google-cloud/storage from 7.10.0 to 7.10.1 (#2536)
- Update package.json to use farmhash 3.3.1 (#2534)
12.1.0 - 2024-04-16
12.0.0 - 2023-12-07
11.11.1 - 2023-11-23
11.11.0 - 2023-09-28
11.10.1 - 2023-07-13
11.10.0 - 2023-07-12
11.9.0 - 2023-05-30
11.8.0 - 2023-05-04
11.7.0 - 2023-04-18
11.6.0 - 2023-04-06
11.5.0 - 2023-01-19
11.4.1 - 2022-12-22
11.4.0 - 2022-12-15
11.3.0 - 2022-11-17

from firebase-admin GitHub release notes

Important

Warning: This PR contains a major version upgrade, and may be a breaking change.
Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade firebase-admin from 11.3.0 to 13.0.1. See this package in npm: firebase-admin See this project in Snyk: https://app.snyk.io/org/aravindvnair99-github-marketplace/project/3e229b24-b2de-4c21-9d58-eebf425f44fc?utm_source=github&utm_medium=referral&page=upgrade-pr

guardrails · 2024-12-16T05:58:25Z

⚠️ We detected 9 security issues in this pull request:

Insecure File Management (1)

Severity

Details

Docs

High

Title: Path Traversal from user input

Spot-the-Hole/functions/index.js

Line 562 in a2f6ee8

path.join(os.tmpdir(), path.basename(req.files.file[0].fieldname)),

📚

More info on how to fix Insecure File Management in JavaScript.

Insecure Use of Crypto (1)

Severity

Details

Docs

Medium

Title: Insecure use of random generator

Spot-the-Hole/functions/index.js

Line 204 in a2f6ee8

result += characters.charAt(Math.floor(Math.random() * charactersLength));

📚

More info on how to fix Insecure Use of Crypto in JavaScript.

Vulnerable Libraries (7)

Severity	Details
Critical	pkg:npm/@tensorflow/tfjs-node@3.14.0 upgrade to: > 3.14.0
N/A	pkg:npm/ejs@3.1.7 upgrade to: 3.1.10
High	pkg:npm/eslint@8.54.0 upgrade to: > 8.54.0
High	pkg:npm/firebase-functions@4.2.1 upgrade to: > 4.2.1
High	pkg:npm/busboy@0.3.1 upgrade to: > 0.3.1
Informational	pkg:npm/cookie-parser@1.4.6 upgrade to: > 1.4.6
Medium	pkg:npm/axios@0.25.0 upgrade to: 1.6.0

More info on how to fix Vulnerable Libraries in JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

sonarqubecloud · 2024-12-16T05:58:28Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

pull-request-size bot added the size/XS label Dec 16, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade firebase-admin from 11.3.0 to 13.0.1 #625

[Snyk] Upgrade firebase-admin from 11.3.0 to 13.0.1 #625

aravindvnair99 commented Dec 16, 2024

Bug Fixes

Miscellaneous

Breaking Changes

New Features

Bug Fixes

Miscellaneous

New Features

Bug Fixes

Miscellaneous

New Features

Bug Fixes

Miscellaneous

New Features

Bug Fixes

Miscellaneous

Miscellaneous

Bug Fixes

Miscellaneous

New Features

Miscellaneous

Breaking Changes

Bug Fixes

Miscellaneous

Bug Fixes

Miscellaneous

guardrails bot commented Dec 16, 2024

sonarqubecloud bot commented Dec 16, 2024

[Snyk] Upgrade firebase-admin from 11.3.0 to 13.0.1 #625

Are you sure you want to change the base?

[Snyk] Upgrade firebase-admin from 11.3.0 to 13.0.1 #625

Conversation

aravindvnair99 commented Dec 16, 2024

Snyk has created this PR to upgrade firebase-admin from 11.3.0 to 13.0.1.

Issues fixed by the recommended upgrade:

Bug Fixes

Miscellaneous

Breaking Changes

New Features

Bug Fixes

Miscellaneous

New Features

Bug Fixes

Miscellaneous

New Features

Bug Fixes

Miscellaneous

New Features

Bug Fixes

Miscellaneous

Miscellaneous

Bug Fixes

Miscellaneous

New Features

Miscellaneous

Breaking Changes

Bug Fixes

Miscellaneous

Bug Fixes

Miscellaneous

guardrails bot commented Dec 16, 2024

sonarqubecloud bot commented Dec 16, 2024

Quality Gate passed