Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(deps): Update golang.org/x/net and @google-cloud/spanner to fix v…
…ulnerabilities. (#272) * build(deps): Bump golang.org/x/net (#271) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.17.0 to 0.23.0. - [Commits](golang/net@v0.17.0...v0.23.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(deps): Update spanner to 7.6.0 to fix vulnerability Spanner 6.16.0 depends on vulnerable version of protobufjs protobufjs 7.0.0 - 7.2.4 Severity: critical protobufjs Prototype Pollution vulnerability - GHSA-h755-8qp9-cq85 fix available via `npm audit fix --force` Will install @google-cloud/[email protected], which is a breaking change poller/node_modules/@google-cloud/spanner/node_modules/protobufjs scaler/scaler-core/node_modules/google-gax/node_modules/protobufjs google-gax 2.2.1-pre - 2.2.1-pre.2 || 2.28.2-alpha.1 - 2.28.4-alpha.1 || 3.1.4 - 4.0.3 Depends on vulnerable versions of protobufjs poller/node_modules/@google-cloud/spanner/node_modules/google-gax scaler/scaler-core/node_modules/google-gax @google-cloud/firestore 6.1.0-pre.0 - 6.8.0 Depends on vulnerable versions of google-gax scaler/scaler-core/node_modules/@google-cloud/firestore @google-cloud/spanner 6.3.0 - 6.16.0 Depends on vulnerable versions of google-gax poller/node_modules/@google-cloud/spanner scaler/scaler-core/node_modules/@google-cloud/spanner --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- Loading branch information