chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #486

dependabot · 2024-03-25T17:04:58Z

Bumps the npm_and_yarn group with 3 updates in the / directory: protobufjs, follow-redirects and undici.

Updates protobufjs from 7.2.5 to 7.2.6

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.2.6

7.2.6 (2024-01-16)

Bug Fixes

report missing import properly in loadSync (#1960) (af3ff83)

Changelog

Sourced from protobufjs's changelog.

7.2.6 (2024-01-16)

Bug Fixes

report missing import properly in loadSync (#1960) (af3ff83)

Commits

2f846fe chore: release master (#1962)
af3ff83 fix: report missing import properly in loadSync (#1960)
See full diff in compare view

Updates follow-redirects from 1.15.5 to 1.15.6

Commits

35a517c Release version 1.15.6 of the npm package.
c4f847f Drop Proxy-Authorization across hosts.
8526b4a Use GitHub for disclosure.
See full diff in compare view

Updates undici from 5.26.3 to 5.28.3

Release notes

Sourced from undici's releases.

v5.28.3

⚠️ Security Release ⚠️

Fixes:

CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch

Full Changelog: nodejs/undici@v5.28.2...v5.28.3

v5.28.2

What's Changed

fix: remove optional chainning for compatible with Nodejs12 and below by @bugb in nodejs/undici#2470

fix: remove node: prefix by @tsctx in nodejs/undici#2471

perf: avoid Headers initialization by @tsctx in nodejs/undici#2468

fix: handle SharedArrayBuffer correctly by @tsctx in nodejs/undici#2466

fix: Add null type to signal in RequestInit by @gebsh in nodejs/undici#2455

fix: correctly handle data URL with hashes. by @tsctx in nodejs/undici#2475

fix: check response for timinginfo allow flag by @ToshB in nodejs/undici#2477

Make call to onBodySent conditional in RetryHandler by @MzUgM in nodejs/undici#2478

refactor: better integrity check by @tsctx in nodejs/undici#2462

fix: Added support for inline URL username:password proxy auth by @matt-way in nodejs/undici#2473

build(deps-dev): bump jsdom from 22.1.0 to 23.0.0 by @dependabot in nodejs/undici#2472

build(deps-dev): bump sinon from 16.1.3 to 17.0.1 by @dependabot in nodejs/undici#2405

build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 by @dependabot in nodejs/undici#2396

build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 by @dependabot in nodejs/undici#2395

build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 by @dependabot in nodejs/undici#2392

build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 by @dependabot in nodejs/undici#2389

build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 by @dependabot in nodejs/undici#2302

New Contributors

@bugb made their first contribution in nodejs/undici#2470

@gebsh made their first contribution in nodejs/undici#2455

@ToshB made their first contribution in nodejs/undici#2477

@MzUgM made their first contribution in nodejs/undici#2478

@matt-way made their first contribution in nodejs/undici#2473

Full Changelog: nodejs/undici@v5.28.1...v5.28.2

v5.28.1

What's Changed

perf: Improve normalizeMethod by @tsctx in nodejs/undici#2456

fix: dispatch error handling by @ronag in nodejs/undici#2459

perf(request): optimize if headers are given by @tsctx in nodejs/undici#2454

Full Changelog: nodejs/undici@v5.28.0...v5.28.1

v5.28.0

What's Changed

fix(parseHeaders): util.parseHeaders handle correctly array of buffer… by @mdoria12 in nodejs/undici#2398

... (truncated)

Commits

e71cb4c Bumped v5.28.3
20c65b8 Fix tests for Node.js v20.11.0 (#2618)
8ec52cd Fix tests for Node.js v21 (#2609)
d3aa574 Merge pull request from GHSA-3787-6prv-h9w3
9a14e5f Bumped v5.28.2
fcdfe87 build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 (#2302)
169c157 build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 (#2389)
9788177 build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 (#2392)
1f6d159 build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 (#2395)
a393a86 build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 (#2396)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 3 updates in the / directory: [protobufjs](https://github.com/protobufjs/protobuf.js), [follow-redirects](https://github.com/follow-redirects/follow-redirects) and [undici](https://github.com/nodejs/undici). Updates `protobufjs` from 7.2.5 to 7.2.6 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.2.5...protobufjs-v7.2.6) Updates `follow-redirects` from 1.15.5 to 1.15.6 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.5...v1.15.6) Updates `undici` from 5.26.3 to 5.28.3 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.26.3...v5.28.3) --- updated-dependencies: - dependency-name: protobufjs dependency-type: direct:production dependency-group: npm_and_yarn-security-group - dependency-name: follow-redirects dependency-type: indirect dependency-group: npm_and_yarn-security-group - dependency-name: undici dependency-type: indirect dependency-group: npm_and_yarn-security-group ... Signed-off-by: dependabot[bot] <support@github.com>

CLAassistant · 2024-03-25T17:05:05Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ lmangani
❌ dependabot[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

socket-security · 2024-03-25T17:05:47Z

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/protobufjs@7.2.6	filesystem, network	`+11`	4.54 MB	google-wombot

🚮 Removed packages: npm/protobufjs@7.2.5

View full report↗︎

akvlad · 2024-03-25T19:04:55Z

this is a known issue of "protobufjs": "7.2.6" . The update wasn't planned as far as there's no need to.
We can plan it for the next week.

…ity-group-f03be2d197

lmangani · 2024-04-01T19:05:59Z

@dependabot rebase

dependabot · 2024-04-01T19:06:06Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

github-actions · 2024-04-01T19:09:45Z

Workflow Telemetry - K6 Test qxip/qryn / Run k6 on qryn:latest

Workflow telemetry for commit 1e5b6d1e83282896d949eabd750929faa9154647
You can access workflow job details here

Step Trace

gantt
	title Run k6 on qryn:latest
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1711998351000, 1711998354000
	Initialize containers : 1711998354000, 1711998379000
	Checkout : 1711998379000, 1711998380000
	Run actions/setup-go@v4 : 1711998380000, 1711998380000
	Download k6 for Prometheus : 1711998380000, 1711998382000
	Download k6 for Prometheus : 1711998382000, 1711998383000
	Collect Workflow Telemetry : 1711998383000, 1711998383000
	Wait for Loki API : 1711998383000, 1711998383000
	Run k6 loki test : 1711998383000, 1711998446000
	Run mv summary.txt loki_summary.txt : 1711998446000, 1711998446000
	Wait for Prom API : 1711998446000, 1711998446000
	Run k6 prometheus test : 1711998446000, 1711998509000
	Run mv summary.txt prom_summary.txt : 1711998509000, 1711998509000
	Wait for Tempo API : 1711998509000, 1711998509000
	Run actions/upload-artifact@v3 : 1711998581000, 1711998582000
	Summary Report : 1711998582000, 1711998582000

CPU Metrics

Memory Metrics

IO Metrics

	Read	Write
Network I/O
Disk I/O

Process Trace

Top 100 processes with highest duration

gantt
	title Run k6 on qryn:latest
	dateFormat x
	axisFormat %H:%M:%S

lmangani · 2024-04-09T13:36:30Z

@dependabot rebase please

dependabot · 2024-04-09T13:36:33Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

lmangani · 2024-04-09T13:37:00Z

@dependabot recreate

dependabot · 2024-04-09T13:38:57Z

Superseded by #488.

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 25, 2024

Merge branch 'master' into dependabot/npm_and_yarn/npm_and_yarn-secur…

1e5b6d1

…ity-group-f03be2d197

dependabot bot closed this Apr 9, 2024

dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-security-group-f03be2d197 branch April 9, 2024 13:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #486

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #486

dependabot bot commented on behalf of github Mar 25, 2024 •

edited

Loading

CLAassistant commented Mar 25, 2024 •

edited

Loading

socket-security bot commented Mar 25, 2024 •

edited

Loading

akvlad commented Mar 25, 2024

lmangani commented Apr 1, 2024

dependabot bot commented on behalf of github Apr 1, 2024

github-actions bot commented Apr 1, 2024

lmangani commented Apr 9, 2024

dependabot bot commented on behalf of github Apr 9, 2024

lmangani commented Apr 9, 2024

dependabot bot commented on behalf of github Apr 9, 2024

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #486

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #486

Conversation

dependabot bot commented on behalf of github Mar 25, 2024 • edited Loading

protobufjs: v7.2.6

7.2.6 (2024-01-16)

Bug Fixes

7.2.6 (2024-01-16)

Bug Fixes

v5.28.3

⚠️ Security Release ⚠️

v5.28.2

What's Changed

New Contributors

v5.28.1

What's Changed

v5.28.0

What's Changed

CLAassistant commented Mar 25, 2024 • edited Loading

socket-security bot commented Mar 25, 2024 • edited Loading

akvlad commented Mar 25, 2024

lmangani commented Apr 1, 2024

dependabot bot commented on behalf of github Apr 1, 2024

github-actions bot commented Apr 1, 2024

Workflow Telemetry - K6 Test qxip/qryn / Run k6 on qryn:latest

Step Trace

CPU Metrics

Memory Metrics

IO Metrics

Process Trace

Top 100 processes with highest duration

lmangani commented Apr 9, 2024

dependabot bot commented on behalf of github Apr 9, 2024

lmangani commented Apr 9, 2024

dependabot bot commented on behalf of github Apr 9, 2024

dependabot bot commented on behalf of github Mar 25, 2024 •

edited

Loading

CLAassistant commented Mar 25, 2024 •

edited

Loading

socket-security bot commented Mar 25, 2024 •

edited

Loading