Skip to content

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Mar 31, 2025

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package From To
zod 3.11.6 3.24.2
@google-cloud/firestore 5.0.2 6.2.0
mongodb 4.3.1 4.17.0
braces 3.0.2 3.0.3
ws 8.4.0 8.18.1

Updates zod from 3.11.6 to 3.24.2

Release notes

Sourced from zod's releases.

v3.24.2

Notes

Support asynchronous checks in z.custom() .

const customSchema = z.custom<number>(async (x) => {
  return typeof x === "number";
});

Commits:

  • cdcf9d4263cc544c7cb49855b31612d4305da72c Bump rollup from 2.79.1 to 2.79.2 (#3895)
  • a2ad37099e8f7117d231cc2c72d0e471893643b2 Bump find-my-way from 8.2.0 to 8.2.2 (#3897)
  • 0e02d66d1bcaad9c0f92609431e1726e088a8112 Bump nanoid from 3.3.7 to 3.3.8 (#3896)
  • 96be65f0d71b0bf8e8f330dc0541cc895edd6459 Bump cross-spawn from 7.0.3 to 7.0.6 (#3882)
  • f7ad26147ba291cb3fb257545972a8e00e767470 Bump micromatch from 4.0.7 to 4.0.8 (#3748)
  • d724620c341e1801db9513f681f731afb3df452a Add zod-struct to utilities for Zod (#3921)
  • 6b96cfd4307649df6a451d74e06c47ac88c01dfe Update README.md (#3949)
  • e376cda8e14d3caa09bc2148ffc668748118db6b Add Courier to README (#3961)
  • 8a099deaef71b3d8bd65986a745b88f08cb28ba5 Add CodeRabbit to sponsors (#3975)
  • 587d160badbe96d1adec1e8ff9d93bbcb3f91c4f WIP (#3976)
  • 9d3af2ee5263971bc0dd7e4927cd07ee854fe4db Add CodeRabbit at Platinum (#3981)
  • eedeb4b69f9f4bb58401d9cb27c8038a042f2c7f docs(X to Zod): Update url for runtyping (#3971)
  • 706f49f9fb852cdde667b65ccb9b765444a86de7 fix: redirect url to correct url (#3939)
  • 7365b7d5564793c42ee02815880463b8bee30028 docs: translate README to Korean (#3934)
  • b7e173de06e223a7a6510903a4110634e2fb5d92 Format
  • 1dd44a0d6f8073f7c417e09ec96580b9ae9bda23 Support async z.custom
  • e30870369d5b8f31ff4d0130d4439fd997deb523 v3.24.2

v3.24.1

Commits:

  • 0c6cbbdd1315683dd3d589fbdc5765c26431dcc9 Undeprecate .nonempty()
  • 4e219d6ad9d5e56e20afd7423092f506400a29e4 Bump min TS version to 5.0
  • 65adeeacef0274abbda5438470a3d2bfd376256d v3.24.1

v3.24.0

Implement @standard-schema/spec

This is the first version of Zod to implement the Standard Schema spec. This is a new community effort among several validation library authors to implement a common interface, with the goal of simplifying the process of integrating schema validators with the rest of the ecosystem. Read more about the project and goals here.

z.string().jwt()

Thanks to @​Mokshit06 and @​Cognition-Labs for this contribution!

To verify that a string is a valid 3-part JWT.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by colinhacks, a new releaser for zod since your current version.


Updates @google-cloud/firestore from 5.0.2 to 6.2.0

Release notes

Sourced from @​google-cloud/firestore's releases.

v6.2.0

6.2.0 (2022-09-13)

Features

Bug Fixes

  • Minify proto JSON files (#1771) (6393fe7)
  • Remove hack in update.sh, and replace with existing pattern for protobuf dependencies. (#1769) (6ba6751)

v6.1.0

6.1.0 (2022-09-07)

Features

  • Accept google-gax instance as a parameter (#1757) (ef59a22)

Bug Fixes

  • Better support for fallback mode (#1756) (a029a6e)
  • Don't allow serialization of firestore settings (#1742) (fa0ad66)
  • Pin Typescript to prevent new type checking. (#1764) (dd01b27)
  • Update GAX (#1758) (1931415)
  • Version 7 of protobufjs broke the update.sh script. Added path to built in protobuf. (#1766) (40f1db3)

v6.0.0

6.0.0 (2022-07-22)

⚠ BREAKING CHANGES

  • update library to use Node 12 (#1725)

Features

Bug Fixes

  • change REST binding for ListDocuments to support root collection (#1695) (6185f13)

... (truncated)

Changelog

Sourced from @​google-cloud/firestore's changelog.

6.2.0 (2022-09-13)

Features

Bug Fixes

  • Minify proto JSON files (#1771) (6393fe7)
  • Remove hack in update.sh, and replace with existing pattern for protobuf dependencies. (#1769) (6ba6751)

6.1.0 (2022-09-07)

Features

  • Accept google-gax instance as a parameter (#1757) (ef59a22)

Bug Fixes

  • Better support for fallback mode (#1756) (a029a6e)
  • Don't allow serialization of firestore settings (#1742) (fa0ad66)
  • Pin Typescript to prevent new type checking. (#1764) (dd01b27)
  • Update GAX (#1758) (1931415)
  • Version 7 of protobufjs broke the update.sh script. Added path to built in protobuf. (#1766) (40f1db3)

6.0.0 (2022-07-22)

⚠ BREAKING CHANGES

  • update library to use Node 12 (#1725)

Features

Bug Fixes

  • change REST binding for ListDocuments to support root collection (#1695) (6185f13)
  • deps: update dependency protobufjs to v7 (#1747) (4e8d33c)
  • split v1 and v1beta1 protos to improve startup time (#1664) (f3729cf)

... (truncated)

Commits

Updates mongodb from 4.3.1 to 4.17.0

Release notes

Sourced from mongodb's releases.

v4.17.0

4.17.0 (2023-08-17)

The MongoDB Node.js team is pleased to announce version 4.17.0 of the mongodb package!

Release Notes

mongodb-js/saslprep is now installed by default

Until v6, the driver included the saslprep package as an optional dependency for SCRAM-SHA-256 authentication. saslprep breaks when bundled with webpack because it attempted to read a file relative to the package location and consequently the driver would throw errors when using SCRAM-SHA-256 if it were bundled.

The driver now depends on mongodb-js/saslprep, a fork of saslprep that can be bundled with webpack because it includes the necessary saslprep data in memory upon loading. This will be installed by default but will only be used if SCRAM-SHA-256 authentication is used.

Remove credential availability on ConnectionPoolCreatedEvent

In order to avoid mistakenly printing credentials the ConnectionPoolCreatedEvent will replace the credentials option with an empty object. The credentials are still accessble via MongoClient options: client.options.credentials.

Features

  • NODE-5272: do not create or drop ecc collections (#3678) (d26ad61)
  • NODE-5398: use mongodb-js/saslprep instead of saslprep (#3820) (5244711)

Bug Fixes

  • NODE-5262: AWS Lambda metadata detection logic is too permissive (#3683) (c0c3d99)
  • NODE-5311: construct error messages for AggregateErrors in Node16+ (#3683) (98b7bdf)
  • NODE-5316: prevent parallel topology creation in MongoClient.connect (#3696) (e13038d)
    • Thank you @​clemclx for contributing this fix! 🎉
  • NODE-5356: prevent scram auth from throwing TypeError if saslprep is not a function (#3732) (2d028af)
  • NODE-5536: remove credentials from ConnectionPoolCreatedEvent options (#3812) (2910dca)

Documentation

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

v4.16.0

The MongoDB Node.js team is pleased to announce version 4.16.0 of the mongodb package!

... (truncated)

Changelog

Sourced from mongodb's changelog.

4.17.0 (2023-08-17)

Features

  • NODE-5272: do not create or drop ecc collections (#3678) (d26ad61)
  • NODE-5398: use mongodb-js/saslprep instead of saslprep (#3820) (5244711)

Bug Fixes

  • NODE-5262: AWS Lambda metadata detection logic is too permissive (#3683) (c0c3d99)
  • NODE-5311: construct error messages for AggregateErrors in Node16+ (#3683) (98b7bdf)
  • NODE-5316: prevent parallel topology creation in MongoClient.connect (#3696) (e13038d)
  • NODE-5356: prevent scram auth from throwing TypeError if saslprep is not a function (#3732) (2d028af)
  • NODE-5536: remove credentials from ConnectionPoolCreatedEvent options (#3812) (2910dca)

4.16.0 (2023-04-18)

Features

  • NODE-5159: add FaaS env information to client metadata (#3639) (e0b20f1)
  • NODE-5199: add alternative runtime detection to client metadata (#3647) (fba16ad)

Bug Fixes

  • NODE-5161: metadata duplication in handshake (#3628) (b790142)
  • NODE-5200: relax SRV record validation to account for a dot suffix (#3640) (4272c43)

4.15.0 (2023-04-04)

Features

  • NODE-5054: add AssumeRoleWithWebIdentity support to 4x driver (#3566) (8a8c386)

Bug Fixes

  • NODE-5097: set timeout on write and reset on message (#3590) (2d3576b)

4.14.0 (2023-02-07)

Features

  • NODE-4992: Deprecate methods and options that reference legacy logger (#3532) (6c94b4a)

... (truncated)

Commits
  • c83a801 chore(4.x): release 4.17.0 [skip-ci] (#3763)
  • 1b59955 chore: update release automation scripts 4.x (#3824)
  • 5244711 feat(NODE-5398): use mongodb-js/saslprep instead of saslprep (#3820)
  • 2910dca fix(NODE-5536): remove credentials from ConnectionPoolCreatedEvent options (#...
  • 0c1b654 chore(NODE-5400): add @​octokit/core as a devDep (#3750)
  • 4adff37 chore(NODE-5382): backport release automation scripts (#3747)
  • 2d028af fix(NODE-5356): prevent scram auth from throwing TypeError if saslprep is not...
  • 0e1afc0 ci(Node 5335): clean up instance profile from instance after CI runs (#3719)
  • 7f5b334 ci(NODE-5334): install npm to node_artifacts directory in CI (#3709)
  • e13038d fix(NODE-5316): prevent parallel topology creation in MongoClient.connect (#3...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by dbx-node, a new releaser for mongodb since your current version.


Updates @grpc/grpc-js from 1.4.6 to 1.8.22

Release notes

Sourced from @​grpc/grpc-js's releases.

@​grpc/grpc-js 1.8.22

  • Avoid buffering significantly more than grpc.max_receive_message_size per received message.

@​grpc/grpc-js@​1.8.21

  • Fix propagation of UNIMPLEMENTED error messages (#2528)

@​grpc/grpc-js 1.8.20

  • Fix a crash when the channel option grpc.keepalive_permit_without_calls is set (#2519)

@​grpc/grpc-js 1.8.19

  • Update keepalive behavior to more correctly handle short calls and long periods of inactivity (#2513)

@​grpc/grpc-js 1.8.18

  • Fix reporting of call stacks in unary request errors (#2503)
  • Fix reporting of proxy info in channelz socket responses (#2503)

@​grpc/grpc-js 1.8.17

  • Disallow pick_first LB policy as the direct child of an outlier_detection LB policy (#2476)

@​grpc/grpc-js 1.8.16

  • Fix missing transport trace logs (#2470)

@​grpc/grpc-js 1.8.15

  • Fix a memory leak that could result from a specific pattern of recursive function calls (#2456)
  • Ensure status and error events are consistently emitted asynchronously (#2456)

@​grpc/grpc-js 1.8.14

  • Fix sequencing of some events related to connectivity state changes (#2421)

@​grpc/grpc-js 1.8.13

  • Fix memory leak in channelz socket tracking (#2394)

@​grpc/grpc-js@​1.8.12

  • Fix an occasional type error when receiving DNS updates (#2380)
  • Fix ordering of events when handing requests on the server (#2376 contributed by @​phoenix741)

@​grpc/grpc-js 1.8.11

  • Avoid accumulating placeholder objects when sending many messages on a long-running stream (#2372)

@​grpc/grpc-js 1.8.10

  • Fix bugs in "pick first" load balancing policy that caused incorrect reconnection behavior (#2369)

@​grpc/grpc-js 1.8.9

  • Fix a bug where clients would continue to send pings at the original configured rate after receiving a backoff request from the server (#2363)

@​grpc/grpc-js 1.8.8

  • Remove progress field in returned status object (#2350)
  • Export InterceptingListener and NextCall types (#2351)
  • Fix a bug that could cause a crash when sending messages that exceed the outgoing message buffer size while a retry is in progress (#2349)

... (truncated)

Commits
  • a8a0203 Merge pull request from GHSA-7v5v-9h63-cj86
  • 3b110cd grpc-js: Bump to 1.8.22
  • 8e62222 grpc-js: Avoid buffering significantly more than max_receive_message_size per...
  • 9d83947 Merge pull request #2742 from sergiitk/backport-1.8-psm-interop-common-prod-t...
  • 00f348c Merge pull request #2729 from sergiitk/psm-interop-common-prod-tests
  • 36d105b Merge pull request #2737 from murgatroid99/backport-1.8-grpc-js_linkify-it_fix
  • 969e305 Merge pull request #2735 from murgatroid99/grpc-js_linkify-it_fix
  • d78216f Merge pull request #2715 from sergiitk/backport-1.8-psm-interop-pkg-dev
  • f38966a Merge pull request #2712 from sergiitk/psm-interop-pkg-dev
  • ffefff2 Merge pull request #2640 from XuanWang-Amos/backport-1.8-psm-interop-shared-b...
  • Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

Updates node-fetch from 2.6.6 to 2.7.0

Release notes

Sourced from node-fetch's releases.

v2.7.0

2.7.0 (2023-08-23)

Features

v2.6.13

2.6.13 (2023-08-18)

Bug Fixes

v2.6.12

2.6.12 (2023-06-29)

Bug Fixes

v2.6.11

2.6.11 (2023-05-09)

Reverts

v2.6.10

2.6.10 (2023-05-08)

Bug Fixes

v2.6.9

2.6.9 (2023-01-30)

Bug Fixes

v2.6.8

2.6.8 (2023-01-13)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by node-fetch-bot, a new releaser for node-fetch since your current version.


Updates node-forge from 0.10.0 to 1.3.1

Changelog

Sourced from node-forge's changelog.

1.3.1 - 2022-03-29

Fixes

  • RFC 3447 and RFC 8017 allow for optional DigestAlgorithm NULL parameters for sha* algorithms and require NULL paramters for md2 and md5 algorithms.

1.3.0 - 2022-03-17

Security

  • Three RSA PKCS#1 v1.5 signature verification issues were reported by Moosa Yahyazadeh ([email protected]).
  • HIGH: Leniency in checking digestAlgorithm structure can lead to signature forgery.
  • HIGH: Failing to check tailing garbage bytes can lead to signature forgery.
  • MEDIUM: Leniency in checking type octet.
    • DigestInfo is not properly checked for proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.
    • CVE ID: CVE-2022-24773
    • GHSA ID: GHSA-2r2c-g63r-vccr

Fixed

  • [asn1] Add fallback to pretty print invalid UTF8 data.
  • [asn1] fromDer is now more strict and will default to ensuring all input bytes are parsed or throw an error. A new option parseAllBytes can disable this behavior.
    • NOTE: The previous behavior is being changed since it can lead to security issues with crafted inputs. It is possible that code doing custom DER parsing may need to adapt to this new behavior and optional flag.
  • [rsa] Add and use a validator to check for proper structure of parsed ASN.1

... (truncated)

Commits

Updates protobufjs from 6.11.2 to 7.2.4

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.2.4

7.2.4 (2023-06-23)

Bug Fixes

  • do not let setProperty change the prototype (#1899) (e66379f)

protobufjs: v7.2.3

7.2.3 (2023-03-27)

Bug Fixes

  • type names can be split into multiple tokens (#1877) (8817ee6)

protobufjs: v7.2.2

7.2.2 (2023-02-07)

Bug Fixes

  • do not allow to extend same field twice to prevent the error (#1784) (14f0536)

protobufjs: v7.2.1

7.2.1 (2023-02-02)

Bug Fixes

  • cli: fix relative path to Google pb files (#1859) (e42eea4)
  • Revert "fix: error should be thrown" (4489fa7)
  • use bundled filename to fix common pb includes (#1860) (dce9a2e)
  • use ES5 style function syntax (#1830) (64e8936)

protobufjs: v7.2.0

7.2.0 (2023-01-24)

Features

  • cli: generate static files at the granularity of proto messages (#1840) (32f2d6a)

Bug Fixes

protobufjs: v7.1.2

7.1.2 (2022-09-22)

... (truncated)

Changelog

Sourced from protobufjs's changelog.

7.2.4 (2023-06-23)

Bug Fixes

  • do not let setProperty change the prototype (#1899) (e66379f)

7.2.3 (2023-03-27)

Bug Fixes

  • type names can be split into multiple tokens (#1877) (8817ee6)

7.2.2 (2023-02-07)

Bug Fixes

  • do not allow to extend same field twice to prevent the error (#1784) (14f0536)

7.2.1 (2023-02-02)

Bug Fixes

  • cli: fix relative path to Google pb files (#1859) (e42eea4)
  • Revert "fix: error should be thrown" (4489fa7)
  • use bundled filename to fix common pb includes (#1860) (dce9a2e)
  • use ES5 style function syntax (#1830) (64e8936)

7.2.0 (2023-01-24)

Features

  • cli: generate static files at the granularity of proto messages (#1840) (32f2d6a)

Bug Fixes

7.1.2 (2022-09-22)

Bug Fixes

... (truncated)

Commits

Updates ws from 8.4.0 to 8.18.1

Release notes

Sourced from ws's releases.

8.18.1

Bug fixes

  • The length of the UNIX domain socket paths in the tests has been shortened to make them work when run via CITGM (021f7b8b).

8.18.0

Features

  • Added support for Blob (#2229).

8.17.1

Bug fixes

  • Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
</tr></table>

... (truncated)

Commits
  • b92745a [dist] 8.18.1
  • b3d9747 [doc] Fix nit
  • 021f7b8 [test] Shorten the path lengths
  • ...

    Description has been truncated

…dates

Bumps the npm_and_yarn group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [zod](https://github.com/colinhacks/zod) | `3.11.6` | `3.24.2` |
| [@google-cloud/firestore](https://github.com/googleapis/nodejs-firestore) | `5.0.2` | `6.2.0` |
| [mongodb](https://github.com/mongodb/node-mongodb-native) | `4.3.1` | `4.17.0` |
| [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` |
| [ws](https://github.com/websockets/ws) | `8.4.0` | `8.18.1` |



Updates `zod` from 3.11.6 to 3.24.2
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Changelog](https://github.com/colinhacks/zod/blob/main/CHANGELOG.md)
- [Commits](colinhacks/zod@v3.11.6...v3.24.2)

Updates `@google-cloud/firestore` from 5.0.2 to 6.2.0
- [Release notes](https://github.com/googleapis/nodejs-firestore/releases)
- [Changelog](https://github.com/googleapis/nodejs-firestore/blob/main/CHANGELOG.md)
- [Commits](googleapis/nodejs-firestore@v5.0.2...v6.2.0)

Updates `mongodb` from 4.3.1 to 4.17.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/v4.17.0/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v4.3.1...v4.17.0)

Updates `@grpc/grpc-js` from 1.4.6 to 1.8.22
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/[email protected]...@grpc/[email protected])

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `node-fetch` from 2.6.6 to 2.7.0
- [Release notes](https://github.com/node-fetch/node-fetch/releases)
- [Commits](node-fetch/node-fetch@v2.6.6...v2.7.0)

Updates `node-forge` from 0.10.0 to 1.3.1
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@0.10.0...v1.3.1)

Updates `protobufjs` from 6.11.2 to 7.2.4
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@v6.11.2...protobufjs-v7.2.4)

Updates `ws` from 8.4.0 to 8.18.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.4.0...8.18.1)

---
updated-dependencies:
- dependency-name: zod
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@google-cloud/firestore"
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: mongodb
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@grpc/grpc-js"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: node-fetch
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: node-forge
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: protobufjs
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 31, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants