Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Denial of service advisory #327

Closed
sidhuko opened this issue May 9, 2018 · 2 comments
Closed

Denial of service advisory #327

sidhuko opened this issue May 9, 2018 · 2 comments

Comments

@sidhuko
Copy link

sidhuko commented May 9, 2018

We're currently having issues with our security checks using the gprc-node packages. The package grpc-native-core contains an old version of protobufjs which should be updated to 6.8.4.

https://nodesecurity.io/advisories/605

I've started a patch but its a major version increment so a few breaks in tests.
@murgatroid99
Copy link
Member

We are not going to upgrade that package's dependency to Protobuf.js 6 because it would be a breaking change. As an alternative solution, I have submitted a patch to Protobuf.js 5 here to fix this problem within the same major version. When that gets published, we will upgrade our dependency to it.

@nicolasnoble
Copy link
Member

Duplicate of #277, waiting for a protobufjs release.

@lock lock bot locked as resolved and limited conversation to collaborators Sep 29, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@murgatroid99 @sidhuko @nicolasnoble