[Snyk] Upgrade: , , , , , , , , , , , , , , grpc-js-health-check, pino, uuid

[SoniaBoussabeh]

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

@grpc/proto-loader
from 0.7.6 to 0.7.13 | 8 versions ahead of your current version | 4 months ago
on 2024-05-01
@grpc/grpc-js
from 1.8.18 to 1.11.1 | 34 versions ahead of your current version | 2 months ago
on 2024-07-16
@opentelemetry/api
from 1.4.1 to 1.9.0 | 5 versions ahead of your current version | 3 months ago
on 2024-06-05
@opentelemetry/core
from 1.15.0 to 1.25.1 | 16 versions ahead of your current version | 3 months ago
on 2024-06-20
@opentelemetry/resources
from 1.15.0 to 1.25.1 | 16 versions ahead of your current version | 3 months ago
on 2024-06-20
@opentelemetry/sdk-metrics
from 1.15.0 to 1.25.1 | 16 versions ahead of your current version | 3 months ago
on 2024-06-20
@opentelemetry/resource-detector-alibaba-cloud
from 0.28.0 to 0.29.0 | 11 versions ahead of your current version | a month ago
on 2024-08-05
@opentelemetry/resource-detector-aws
from 1.3.0 to 1.5.2 | 12 versions ahead of your current version | 2 months ago
on 2024-07-04
@opentelemetry/resource-detector-container
from 0.3.0 to 0.3.11 | 11 versions ahead of your current version | 3 months ago
on 2024-06-10
@opentelemetry/resource-detector-gcp
from 0.29.0 to 0.29.10 | 10 versions ahead of your current version | 3 months ago
on 2024-06-06
@opentelemetry/exporter-trace-otlp-grpc
from 0.41.0 to 0.52.1 | 17 versions ahead of your current version | 3 months ago
on 2024-06-20
@opentelemetry/sdk-node
from 0.41.0 to 0.52.1 | 17 versions ahead of your current version | 3 months ago
on 2024-06-20
@opentelemetry/auto-instrumentations-node
from 0.38.0 to 0.49.1 | 22 versions ahead of your current version | a month ago
on 2024-08-05
@opentelemetry/exporter-metrics-otlp-grpc
from 0.41.0 to 0.52.1 | 17 versions ahead of your current version | 3 months ago
on 2024-06-20
grpc-js-health-check
from 1.1.0 to 1.2.2 | 3 versions ahead of your current version | 9 months ago
on 2023-12-13
pino
from 8.7.0 to 8.21.0 | 27 versions ahead of your current version | 5 months ago
on 2024-04-24
uuid
from 9.0.0 to 9.0.1 | 1 version ahead of your current version | a year ago
on 2023-09-12

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Arbitrary Code Execution SNYK-JS-IMPORTINTHEMIDDLE-5826054	559	No Known Exploit
	Uncontrolled Resource Consumption SNYK-JS-GRPCGRPCJS-7242922	559	No Known Exploit

Release notes

Package name: @grpc/proto-loader

• 0.7.13 - 2024-05-01
• 0.7.12 - 2024-03-28
• 0.7.11 - 2024-03-26
• 0.7.10 - 2023-09-18
• 0.7.9 - 2023-08-23
• 0.7.9-pre.1 - 2023-07-28
• 0.7.8 - 2023-07-11
• 0.7.7 - 2023-05-03
• 0.7.6 - 2023-03-22

from @grpc/proto-loader GitHub release notes

Package name: @grpc/grpc-js

• 1.11.1 - 2024-07-16
  
  • Fixed an issue where building from source would sometimes fail (#304)
  • Added NodeJS 10 pre-built binaries (#302)
  • Added Electron 2 pre-built binaries (#291)
  • Added TypeScript type definitions for APIs added in v1.11.x (#306)
• 1.11.0 - 2024-07-15
  

  @ grpc/proto-loader v0.1.0

  This is a new library for loading .proto files for use with gRPC using the latest version of Protobuf.js. The output of this package is intended to be loaded using the new loadPackageDefinition function in the grpc library.

  @ grpc/grpc-js v0.1.0

  This is the first alpha release of the new pure JavaScript implementation of gRPC. It implements the same API as the existing grpc library. Currently only the client is implemented, with the following functionality:

  • loadPackageDefinition
  • Unary and streaming calls
  • Cancellation
  • Deadlines
  • Metadata
  • Basic automatic reconnection logic
  • Channel and call credentials

  grpc v1.11.0

  Node changes:

  • Add client interceptors API (#59 contributed by @ drobertduke)
  • Add loadPackageDefintion function (#196)
  • Publish ARM64 binaries (#200)
  • Improve function type test in a client method (#204 contributed by @ arcana261)
  • Add details to UNIMPLEMENTED response status (#207 contributed by @ theogravity)
  • Add error handling for missing files when calling grpc.load (#228 contributed by @ cblair)
  • Fix error message in grpc.loadObject when failing to detect Protobuf.js version (#253 contributed by @ kellycampbell)
  • Remove -zdefs flag from binding.gyp to enable building on FreeBSD (#266)
• 1.10.11 - 2024-07-10
• 1.10.10 - 2024-06-24
• 1.10.9 - 2024-06-10
• 1.10.8 - 2024-05-15
• 1.10.7 - 2024-05-01
• 1.10.6 - 2024-04-03
• 1.10.5 - 2024-04-01
• 1.10.4 - 2024-03-26
• 1.10.3 - 2024-03-15
• 1.10.2 - 2024-03-11
• 1.10.1 - 2024-02-15
  

  Node changes:

  • Update dependency on node-pre-gyp to version 0.7.0 (#245)

  C core changes:

  • Decrease number of pings sent by clients (grpc/grpc#14804)
  • Fix memory leak caused by flow control bug (grpc/grpc#14828)
• 1.10.0 - 2024-02-06
  

  C Core Changes

  • Fix memory leaks in max_age_filter (grpc/grpc#14501) and http_proxy (grpc/grpc#14137)
  • Added re-resolution into grpclb policy (grpc/grpc#14438)
  • Update BoringSSL submodule (grpc/grpc#13948)
  • Make RR re-resolve when any of its subchannels fail (grpc/grpc#14170)
  • DNS resolver caches results, allowing it to be hit arbitrarily often. Resolution frequency is controlled via channel arg "grpc.dns_min_time_between_resolutions_ms". (grpc/grpc#14228)
• 1.9.15 - 2024-06-10
• 1.9.14 - 2024-01-16
• 1.9.13 - 2023-12-12
• 1.9.12 - 2023-11-27
• 1.9.11 - 2023-11-16
• 1.9.10 - 2023-11-14
• 1.9.9 - 2023-10-30
• 1.9.8 - 2023-10-27
• 1.9.7 - 2023-10-19
• 1.9.6 - 2023-10-17
• 1.9.5 - 2023-10-02
• 1.9.4 - 2023-09-26
• 1.9.3 - 2023-09-13
• 1.9.2 - 2023-08-31
• 1.9.1 - 2023-08-22
  
  • Fix usage of Protobuf.js Message type in TypeScript type definitions file (#177)
  • Fix handling of undefined values for optional call arguments (#179)
• 1.9.0 - 2023-08-01
  
  • Further improve the error output when failing to load an installed precompiled binary (#175)
  • Fix type definition documentation for KeyCertPair (#171)
  • Fix server segfault on invalid HTTP/2 (grpc/grpc#14199)
  • LB policies request re-resolution without shutting down (grpc/grpc#12829)
  • On server, include receiving HTTP/2 settings in handshake timeout (grpc/grpc#13336)
  • Fix max connection idleness crash (grpc/grpc#14122)
  • Report metadata plugin auth errors with an UNAVAILABLE status instead of UNAUTHENTICATED (grpc/grpc#13363).
• 1.8.22 - 2024-06-10
• 1.8.21 - 2023-07-28
• 1.8.20 - 2023-07-25
• 1.8.19 - 2023-07-24
• 1.8.18 - 2023-07-13

from @grpc/grpc-js GitHub release notes

Package name: @opentelemetry/api

• 1.9.0 - 2024-06-05
  

  1.9.0

  🚀 (Enhancement)

  • feat(metrics): added synchronous gauge #4528 @ clintonb
  • feat(api): allow adding span links after span creation #4536 @ seemk
    • This change is non-breaking for end-users, but breaking for Trace SDK implmentations in accordance with the specification as new features need to be implemented.
  • feat: support node 22 #4666 @ dyladan
• 1.8.0 - 2024-02-29
• 1.7.0 - 2023-11-07
• 1.6.0 - 2023-09-12
• 1.5.0 - 2023-09-11
• 1.4.1 - 2023-03-13

from @opentelemetry/api GitHub release notes

Package name: @opentelemetry/core

• 1.25.1 - 2024-06-20
  

  1.25.1

  📚 (Refine Doc)

  • refactor(examples): added usage of @ opentelemetry/semantic-conventions and @ opentelemetry/resources to the examples in examples/opentelemetry-web for maintaining consistency across all examples. #4764 @ Zen-cronic

  🏠 (Internal)

  • refactor(context-zone-peer-dep): use explicit exports #4785 @ pichlermarc
  • refactor(context-async-hooks): use explicit exports #4785 @ pichlermarc
• 1.25.0 - 2024-06-05
  

  1.25.0

  🚀 (Enhancement)

  • feat: support node 22 #4666 @ dyladan
  • feat(context-zone*): support zone.js 0.12.x #4376 @ maldago
  • refactor(core): Use tree-shakeable string constants for semconv #4739 @ JohannesHuster
  • refactor(shim-opentracing): Use tree-shakeable string constants for semconv #4746 @ JohannesHuster
  • refactor(sdk-trace-web): Use tree-shakeable string constants for semconv #4747 @ JohannesHuster
  • refactor(sdk-trace-node): Use tree-shakeable string constants for semconv #4748 @ JohannesHuster
  • refactor(sdk-trace-base): Use tree-shakeable string constants for semconv #4749 @ JohannesHuster
  • refactor(resources): update deprecated semconv to use exported strings #4755 @ JamieDanielson
  • refactor(exporters): update deprecated semconv to use exported strings #4756 @ JamieDanielson

  📚 (Refine Doc)

  • refactor(examples): use new exported string constants for semconv in examples/esm-http-ts #4758 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/basic-tracer-node #4759 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/http #4750 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/grpc-js #4760 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/otlp-exporter-node #4762 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/opentracing-shim #4761 @ Zen-cronic
• 1.24.1 - 2024-05-07
  

  1.24.1

  🐛 (Bug Fix)

  • fix(core): align inconsistent behavior of getEnv() and getEnvWithoutDefaults() when a process polyfill is used #4648 @ pichlermarc
    • getEnvWithoutDefaults() would use process.env if it was defined when running in a browser, while getEnv() would always use _globalThis. Now both use _globalThis when running in a browser.
  • fix(resources): prevent circular import (resource -> detector -> resource -> ...) #4653 @ pichlermarc
    • fixes a circular import warning which would appear in rollup when bundling @ opentelemetry/resources
  • fix(exporter-metrics-otlp-grpc): add explicit otlp-exporter-base dependency to exporter-metrics-otlp-grpc #4678 @ AkselAllas
• 1.24.0 - 2024-04-24
• 1.23.0 - 2024-04-03
• 1.22.0 - 2024-02-29
• 1.21.0 - 2024-01-26
• 1.20.0 - 2024-01-15
• 1.19.0 - 2023-12-14
• 1.18.1 - 2023-11-08
• 1.18.0 - 2023-11-07
• 1.17.1 - 2023-10-10
• 1.17.0 - 2023-09-12
• 1.16.0 - 2023-09-11
• 1.15.2 - 2023-08-08
• 1.15.1 - 2023-07-24
• 1.15.0 - 2023-07-06

from @opentelemetry/core GitHub release notes

Package name: @opentelemetry/resources

• 1.25.1 - 2024-06-20
  

  1.25.1

  📚 (Refine Doc)

  • refactor(examples): added usage of @ opentelemetry/semantic-conventions and @ opentelemetry/resources to the examples in examples/opentelemetry-web for maintaining consistency across all examples. #4764 @ Zen-cronic

  🏠 (Internal)

  • refactor(context-zone-peer-dep): use explicit exports #4785 @ pichlermarc
  • refactor(context-async-hooks): use explicit exports #4785 @ pichlermarc
• 1.25.0 - 2024-06-05
  

  1.25.0

  🚀 (Enhancement)

  • feat: support node 22 #4666 @ dyladan
  • feat(context-zone*): support zone.js 0.12.x #4376 @ maldago
  • refactor(core): Use tree-shakeable string constants for semconv #4739 @ JohannesHuster
  • refactor(shim-opentracing): Use tree-shakeable string constants for semconv #4746 @ JohannesHuster
  • refactor(sdk-trace-web): Use tree-shakeable string constants for semconv #4747 @ JohannesHuster
  • refactor(sdk-trace-node): Use tree-shakeable string constants for semconv #4748 @ JohannesHuster
  • refactor(sdk-trace-base): Use tree-shakeable string constants for semconv #4749 @ JohannesHuster
  • refactor(resources): update deprecated semconv to use exported strings #4755 @ JamieDanielson
  • refactor(exporters): update deprecated semconv to use exported strings #4756 @ JamieDanielson

  📚 (Refine Doc)

  • refactor(examples): use new exported string constants for semconv in examples/esm-http-ts #4758 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/basic-tracer-node #4759 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/http #4750 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/grpc-js #4760 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/otlp-exporter-node #4762 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/opentracing-shim #4761 @ Zen-cronic
• 1.24.1 - 2024-05-07
  

  1.24.1

  🐛 (Bug Fix)

  • fix(core): align inconsistent behavior of getEnv() and getEnvWithoutDefaults() when a process polyfill is used #4648 @ pichlermarc
    • getEnvWithoutDefaults() would use process.env if it was defined when running in a browser, while getEnv() would always use _globalThis. Now both use _globalThis when running in a browser.
  • fix(resources): prevent circular import (resource -> detector -> resource -> ...) #4653 @ pichlermarc
    • fixes a circular import warning which would appear in rollup when bundling @ opentelemetry/resources
  • fix(exporter-metrics-otlp-grpc): add explicit otlp-exporter-base dependency to exporter-metrics-otlp-grpc #4678 @ AkselAllas
• 1.24.0 - 2024-04-24
• 1.23.0 - 2024-04-03
• 1.22.0 - 2024-02-29
• 1.21.0 - 2024-01-26
• 1.20.0 - 2024-01-15
• 1.19.0 - 2023-12-14
• 1.18.1 - 2023-11-08
• 1.18.0 - 2023-11-07
• 1.17.1 - 2023-10-10
• 1.17.0 - 2023-09-12
• 1.16.0 - 2023-09-11
• 1.15.2 - 2023-08-08
• 1.15.1 - 2023-07-24
• 1.15.0 - 2023-07-06

from @opentelemetry/resources GitHub release notes

Package name: @opentelemetry/sdk-metrics

• 1.25.1 - 2024-06-20
  

  1.25.1

  📚 (Refine Doc)

  • refactor(examples): added usage of @ opentelemetry/semantic-conventions and @ opentelemetry/resources to the examples in examples/opentelemetry-web for maintaining consistency across all examples. #4764 @ Zen-cronic

  🏠 (Internal)

  • refactor(context-zone-peer-dep): use explicit exports #4785 @ pichlermarc
  • refactor(context-async-hooks): use explicit exports #4785 @ pichlermarc
• 1.25.0 - 2024-06-05
  

  1.25.0

  🚀 (Enhancement)

  • feat: support node 22 #4666 @ dyladan
  • feat(context-zone*): support zone.js 0.12.x #4376 @ maldago
  • refactor(core): Use tree-shakeable string constants for semconv #4739 @ JohannesHuster
  • refactor(shim-opentracing): Use tree-shakeable string constants for semconv #4746 @ JohannesHuster
  • refactor(sdk-trace-web): Use tree-shakeable string constants for semconv #4747 @ JohannesHuster
  • refactor(sdk-trace-node): Use tree-shakeable string constants for semconv #4748 @ JohannesHuster
  • refactor(sdk-trace-base): Use tree-shakeable string constants for semconv #4749 @ JohannesHuster
  • refactor(resources): update deprecated semconv to use exported strings #4755 @ JamieDanielson
  • refactor(exporters): update deprecated semconv to use exported strings #4756 @ JamieDanielson

  📚 (Refine Doc)

  • refactor(examples): use new exported string constants for semconv in examples/esm-http-ts #4758 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/basic-tracer-node #4759 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/http #4750 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/grpc-js #4760 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/otlp-exporter-node #4762 @ Zen-cronic
  • refactor(examples): use new exported string constants for semconv in examples/opentracing-shim #4761 @ Zen-cronic
• 1.24.1 - 2024-05-07
  

  1.24.1

  🐛 (Bug Fix)

  • fix(core): align inconsistent behavior of getEnv() and getEnvWithoutDefaults() when a process polyfill is used #4648 @ pichlermarc
    • getEnvWithoutDefaults() would use process.env if it was defined when running in a browser, while getEnv() would always use _globalThis. Now both use _globalThis when running in a browser.
  • fix(resources): prevent circular import (resource -> detector -> resource -> ...) #4653 @ pichlermarc
    • fixes a circular import warning which would appear in rollup when bundling @ opentelemetry/resources
  • fix(exporter-metrics-otlp-grpc): add explicit otlp-exporter-base dependency to exporter-metrics-otlp-grpc #4678 @ AkselAllas
• 1.24.0 - 2024-04-24
• 1.23.0 - 2024-04-03
• 1.22.0 - 2024-02-29
• 1.21.0 - 2024-01-26
• 1.20.0 - 2024-01-15
• 1.19.0 - 2023-12-14
• 1.18.1 - 2023-11-08
• 1.18.0 - 2023-11-07
• 1.17.1 - 2023-10-10
• 1.17.0 - 2023-09-12
• 1.16.0 - 2023-09-11
• 1.15.2 - 2023-08-08
• 1.15.1 - 2023-07-24
• 1.15.0 - 2023-07-06

from @opentelemetry/sdk-metrics GitHub release notes

Package name: @opentelemetry/resource-detector-alibaba-cloud

• 0.29.0 - 2024-08-05
• 0.28.10 - 2024-06-06
• 0.28.9 - 2024-04-25
• 0.28.8 - 2024-04-03
• 0.28.7 - 2024-03-06
• 0.28.6 - 2024-01-29
• 0.28.5 - 2024-01-04
• 0.28.4 - 2023-11-22
• 0.28.3 - 2023-11-13
• 0.28.2 - 2023-10-11
• 0.28.1 - 2023-08-14
• 0.28.0 - 2023-07-12

from @opentelemetry/resource-detector-alibaba-cloud GitHub release notes

Package name: @opentelemetry/resource-detector-aws

• 1.5.2 - 2024-07-04
• 1.5.1 - 2024-06-06
• 1.5.0 - 2024-05-15
• 1.4.2 - 2024-04-25
• 1.4.1 - 2024-04-03
• 1.4.0 - 2024-03-06
• 1.3.6 - 2024-01-29
• 1.3.5 - 2024-01-04
• 1.3.4 - 2023-11-22
• 1.3.3 - 2023-11-13
• 1.3.2 - 2023-10-11
• 1.3.1 - 2023-08-14
• 1.3.0 - 2023-07-12

from