[Snyk] Fix for 1 vulnerabilities

[baby636]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/ipfs-grpc-client/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	823/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-PROTOBUFJS-5756498	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: ipfs-core-utils

The new version differs by 250 commits.

• 89aeaf8 chore: release master (chore: release master ipfs/js-ipfs#4189)
• 051da16 deps: update libp2p to 0.39.0 (deps: update libp2p to 0.39.0 ipfs/js-ipfs#4203)
• bb78ebf deps: upgrade @ multiformats/multiaddr to 10.4.0 (deps: upgrade @multiformats/multiaddr to 10.4.0 ipfs/js-ipfs#4178)
• 83f9882 fix: query input types (fix: query input types ipfs/js-ipfs#4201)
• c6d03ec docs: clarify state of DHT in js-ipfs (docs: clarify state of DHT in js-ipfs ipfs/js-ipfs#4181)
• cb3533a docs: Update README.md (docs: Update README.md ipfs/js-ipfs#4192)
• 8f351a8 chore: linting
• 39dbf70 deps!: update to libp2p@0.38.x (deps!: update to libp2p@0.38.x ipfs/js-ipfs#4151)
• 7a7e091 chore: update docs/core-api/README (chore: update docs/core-api/README ipfs/js-ipfs#4159)
• 3b25957 chore: houseclean README (chore: houseclean README ipfs/js-ipfs#4157)
• e14dab8 chore: Update .github/workflows/stale.yml [skip ci]
• 3e7353f chore: houseclean ipfs/README (chore: houseclean ipfs/README ipfs/js-ipfs#4156)
• 89db371 chore: houseclean interface-ipfs-core/README (chore: houseclean interface-ipfs-core/README ipfs/js-ipfs#4158)
• a05695f chore: houseclean ipfs-core/README (chore: houseclean ipfs-core/README.md ipfs/js-ipfs#4160)
• d5c1a54 Update .github/workflows/stale.yml
• 965f5a4 chore: release master (chore: release master ipfs/js-ipfs#4146)
• 00bd3dd fix: make pubsub message types consistent (fix: make pubsub message types consistent ipfs/js-ipfs#4145)
• c1cbc81 chore: update changelogs (chore: update changelogs ipfs/js-ipfs#4144)
• 5a9039a chore: release master (chore: release master ipfs/js-ipfs#4143)
• 7be50bd fix: use default ws filters instead of connecting to everything (fix: use default ws filters instead of connecting to everything ipfs/js-ipfs#4142)
• 0078aad chore: release master (chore: release master ipfs/js-ipfs#4132)
• 70e142a chore: cleanup changelog (chore: cleanup changelog ipfs/js-ipfs#4129)
• 129ac77 fix: onMessage assignment should be undefined not null (fix: onMessage assignment should be undefined not null ipfs/js-ipfs#4131)
• 92155bc Add .github/workflows/stale.yml

See the full diff

Package name: ipfs-unixfs

The new version differs by 65 commits.

• 0316760 chore(release): 7.0.0 [skip ci]
• 50a7607 deps: update hamt-sharding to 3.0.0 ([Snyk] Security upgrade aegir from 33.2.4 to 36.2.3 #244)
• 9fccb7c deps!: update aegir to 37.x.x ([Snyk] Security upgrade aegir from 33.2.4 to 36.2.3 #243)
• fd05d61 chore: Update .github/workflows/stale.yml [skip ci]
• de1a7f0 Update .github/workflows/stale.yml
• a700c38 update .github/workflows/js-test-and-release.yml ([Snyk] Security upgrade ipfs from 0.55.4 to 0.62.0 #227)
• a33a0f2 Add .github/workflows/stale.yml
• 38e94da update .github/workflows/js-test-and-release.yml ([Snyk] Fix for 1 vulnerabilities #223)
• dd6253f chore(release): 7.0.11 [skip ci]
• 97bdb9c chore(release): 9.0.10 [skip ci]
• b280c1d chore(release): 6.0.9 [skip ci]
• 465670e fix: remove typesVersions from package.json ([Snyk] Security upgrade aegir from 33.2.4 to 36.2.3 #219)
• 5802bd3 chore: update dep-check command ([Snyk] Fix for 1 vulnerabilities #221)
• 83e289e chore(release): 7.0.10 [skip ci]
• df1ab2f chore(release): 9.0.9 [skip ci]
• a8f5ca3 chore(release): 6.0.8 [skip ci]
• 08e851e fix: update deps ([Snyk] Security upgrade aegir from 33.2.4 to 36.2.3 #220)
• f119eb4 chore(release): 7.0.9 [skip ci]
• daeb686 chore: bump @ ipld/dag-cbor from 6.0.15 to 7.0.2 ([Snyk] Security upgrade aegir from 33.2.4 to 36.2.3 #216)
• 8ed6e40 chore: bump lerna from 4.0.0 to 5.0.0 ([Snyk] Security upgrade aegir from 33.2.4 to 36.2.3 #217)
• 5ab15c1 chore: bump sinon from 11.1.2 to 14.0.0 ([Snyk] Fix for 1 vulnerabilities #213)
• 0cb6aff sync: update CI config files ([Snyk] Security upgrade aegir from 33.2.4 to 36.2.3 #215)
• bb3a353 chore(release): 7.0.8 [skip ci]
• 6e7cf63 chore(release): 9.0.8 [skip ci]

See the full diff

Package name: protobufjs

The new version differs by 72 commits.

• 42e5a9c chore: release master (UnhandledPromiseRejectionWarning: #<Object> at jsipfs init ipfs/js-ipfs#1900)
• e66379f fix: do not let setProperty change the prototype ([WIP] chore: update to Web UI v2.4.0 ipfs/js-ipfs#1899)
• 56b1e64 chore: release master (fix: dht browser disabled ipfs/js-ipfs#1879)
• 8817ee6 fix: type names can be split into multiple tokens (Act as HTTP PROXY for http://<cidv1b32>.ipfs.localhost ipfs/js-ipfs#1877)
• e721d04 chore: release master (Implement --pin option for block.put and dag.put ipfs/js-ipfs#1867)
• 14f0536 fix: do not allow to extend same field twice to prevent the error (npm install fail ipfs/js-ipfs#1784)
• 644d588 chore: release master (Running js-ipfs behind a proxy ipfs/js-ipfs#1865)
• e42eea4 fix(cli): fix relative path to Google pb files (How to use dist/index.min.js in node-cli ipfs/js-ipfs#1859)
• dce9a2e fix: use bundled filename to fix common pb includes (fix: swallowed errors ipfs/js-ipfs#1860)
• 64e8936 fix: use ES5 style function syntax ([WIP] feat: load IPLD formats lazily from IPFS ipfs/js-ipfs#1830)
• 4489fa7 Revert "fix: error should be thrown (Merge bundling Browser examples ipfs/js-ipfs#1817)" (docs: create maintainer.json ipfs/js-ipfs#1864)
• 0099ddc chore: release master (Support exposing API/Gateway on multiple multiaddrs ipfs/js-ipfs#1852)
• 32f2d6a feat(cli): generate static files at the granularity of proto messages (feat: exit command line tool on unhandled Promise rejections ipfs/js-ipfs#1840)
• ea7b9a6 build(deps): bump decode-uri-component from 0.2.0 to 0.2.2 (offline boot: does not (re)bind ipfs/js-ipfs#1837)
• e7a3489 fix: error should be thrown (Merge bundling Browser examples ipfs/js-ipfs#1817)
• 82f55e6 build(deps): bump json5 from 2.2.1 to 2.2.3 ([WIP] feat: use new IPLD API ipfs/js-ipfs#1848)
• 57fe6f5 chore(deps): update dependency jsdoc to v4 (feat: pipe to add ipfs/js-ipfs#1833)
• d026849 chore: release master (Different CLI output for jsipfs add ipfs/js-ipfs#1813)
• 119d90a fix(types): nested object can be a oneof ([WIP] feat: add stardust behind flag "EXPERIMENTAL.stardust" ipfs/js-ipfs#1812)
• 67fe592 Update CDN (RawGit EOL) (ipfs.stop(cb) not calling cb, looks like in libp2p.stop in [discovery].map.stop ipfs/js-ipfs#1806)
• 6254efb chore: release master (Can I update a img or txt to ipfs and make it private? ipfs/js-ipfs#1804)
• 7c27b5a fix: add import long to the generated .d.ts (chore: update webui to v2.3.1 ipfs/js-ipfs#1802)
• 7120e93 fix: generate valid js code for aliased enum values (Fix the 101 example ipfs/js-ipfs#1801)
• 48457c4 chore: release master (refactor: modularise files ipfs/js-ipfs#1772)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution