Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lock protobufjs to 7.2.5, make docker_bun non root, add bunconfig.toml #431

Closed
wants to merge 2 commits into from

Conversation

deathalt
Copy link
Contributor

protobufjs = 7.2.6 have broken backward compatibility

also make bun non root for extra security

avoid GHSA-h755-8qp9-cq85 CVE-2022-35177 for bun as well as for node

@CLAassistant
Copy link

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.


Андрей Лалаев seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

Copy link

Updated and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Packages Version New capabilities Transitives Size Publisher
node-fetch 2.6.9...2.7.0 None +0/-0 162 kB node-fetch-bot
jest 27.4.5...27.5.1 shell +131/-129 19.7 MB simenb
record-cache 1.1.1...1.2.0 None +1/-0 39.4 kB mafintosh
handlebars 4.7.7...4.7.8 None +2/-2 4.12 MB jaylinski
glob 7.2.0...7.2.3 None +0/-0 55.1 kB isaacs
prometheus-remote-write 0.3.0...0.3.1 None +3/-2 4.31 MB huksley
fastify 4.24.3...4.25.2 None +12/-11 4.02 MB matteo.collina
logfmt 1.3.2...1.4.0 None +0/-0 65.4 kB csquared
scramjet 4.36.1...4.37.0 environment +3/-3 837 kB michalcz
protocol-buffers-encodings 1.1.1...1.2.0 None +1/-0 42 kB mafintosh
stream-chain 2.2.4...2.2.5 None +0/-0 39 kB elazutkin
stream-json 1.7.3...1.8.0 None +1/-1 130 kB elazutkin
pino 7.6.5...7.11.0 filesystem +7/-7 872 kB jsumners
eslint-plugin-import 2.25.3...2.29.1 None +74/-43 6.71 MB ljharb
patch-package 6.4.7...6.5.1 None +9/-6 738 kB ds300
@opentelemetry/instrumentation-connect 0.30.0...0.30.1 None +7/-5 4.9 MB dyladan
json-stable-stringify 1.0.1...1.1.1 None +12/-1 247 kB ljharb
ws 8.4.0...8.16.0 None +0/-0 141 kB lpinca
date-fns 2.27.0...2.30.0 None +2/-0 6.96 MB kossnocorp
@fastify/basic-auth 5.1.0...5.1.1 None +0/-0 49.9 kB eomm
pino-pretty 7.5.1...7.6.1 None +6/-6 589 kB matteo.collina
fastify-metrics 10.3.3...10.6.0 None +13/-12 4.08 MB m03geek
@fastify/websocket 8.2.0...8.3.1 None +1/-1 225 kB matteo.collina
@elastic/elasticsearch 8.6.0...8.11.0 None +4/-4 4.1 MB elasticmachine

🚮 Removed packages: @fastify/[email protected], [email protected]

@deathalt deathalt closed this Jan 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants