Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): bump firebase-admin from 11.3.0 to 13.0.0 in /functions #613

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 13, 2024

Bumps firebase-admin from 11.3.0 to 13.0.0.

Release notes

Sourced from firebase-admin's releases.

Firebase Admin Node.js SDK v13.0.0

Breaking Changes

  • change(rc): Update Remote Config condition evaluation hashing (#2760)
  • change(fcm): Remove deprecated FCM APIs (#2759)
  • change: Update Node support to 18 (#2756)
  • change: Migrate credentials to use google-auth-library (#2466)

New Features

  • feat(fcm): Add directBootOk field to AndroidConfig (#2745)

Bug Fixes

  • fix: Set the Quota Project ID only for ADC human accounts (#2761)

Miscellaneous

  • [chore] Release 13.0.0 (#2764)
  • build(deps): bump uuid from 11.0.2 to 11.0.3 (#2767)
  • build(deps-dev): bump nock from 13.5.5 to 13.5.6 (#2766)
  • chore: Add X-Goog-Api-Client metric header to outgoing authorized http requests (#2763)
  • chore: Upgrade dependencies (#2757)
  • Request timeout const name correction (#2743)
  • build(deps-dev): bump @​firebase/app-compat from 0.2.43 to 0.2.45 (#2746)

Firebase Admin Node.js SDK v12.7.0

New Features

  • feat(auth): Add recaptcha and sms toll fraud support for phone auth (#2625)

Bug Fixes

  • fix: Pin @firebase/database-compat to v1.0.8 (#2739)

Miscellaneous

  • [chore] Release 12.7.0 (#2741)
  • build(deps-dev): bump @​microsoft/api-extractor from 7.47.9 to 7.47.11 (#2734)
  • build(deps-dev): bump @​types/lodash from 4.17.10 to 4.17.12 (#2735)
  • chore: Add X-Goog-Api-Client metric header to Auth and FCM requests (#2738)
  • chore: Update auth.spec.ts (#2737)
  • chore: fix dataconnect integration tests (#2736)
  • build(deps-dev): bump @​firebase/app-compat from 0.2.42 to 0.2.43 (#2729)
  • build(deps-dev): bump @​types/lodash from 4.17.9 to 4.17.10 (#2730)
  • fixes function name resolution to cloud tasks emulator queue (#2726)
  • build(deps-dev): bump @​types/mocha from 10.0.8 to 10.0.9 (#2721)
  • build(deps-dev): bump @​firebase/app-compat from 0.2.41 to 0.2.42 (#2722)

... (truncated)

Commits
  • a6a930c [chore] Release 13.0.0 (#2764)
  • 8b978e0 build(deps): bump uuid from 11.0.2 to 11.0.3 (#2767)
  • 49a8e0b build(deps-dev): bump nock from 13.5.5 to 13.5.6 (#2766)
  • 4ee1bb2 fix: Set the Quota Project ID only for ADC human accounts (#2761)
  • 4babb45 change(rc): Update Remote Config condition evaluation hashing (#2760)
  • dcef2ae chore: Add X-Goog-Api-Client metric header to outgoing authorized http requ...
  • 5affb73 change(fcm): Remove deprecated FCM APIs (#2759)
  • ec1dc66 chore: Upgrade dependencies (#2757)
  • 3ae5c63 change: Update Node support to 18 (#2756)
  • 2144b12 change: Migrate credentials to use google-auth-library (#2466)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [firebase-admin](https://github.com/firebase/firebase-admin-node) from 11.3.0 to 13.0.0.
- [Release notes](https://github.com/firebase/firebase-admin-node/releases)
- [Changelog](https://github.com/firebase/firebase-admin-node/blob/master/CHANGELOG.md)
- [Commits](firebase/firebase-admin-node@v11.3.0...v13.0.0)

---
updated-dependencies:
- dependency-name: firebase-admin
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Copy link

guardrails bot commented Nov 13, 2024

⚠️ We detected 8 security issues in this pull request:

Insecure File Management (1)
Severity Details Docs
High Title: Path Traversal from user input
path.join(os.tmpdir(), path.basename(req.files.file[0].fieldname)),
📚

More info on how to fix Insecure File Management in JavaScript.


Insecure Use of Crypto (1)
Severity Details Docs
Medium Title: Insecure use of random generator
result += characters.charAt(Math.floor(Math.random() * charactersLength));
📚

More info on how to fix Insecure Use of Crypto in JavaScript.


Vulnerable Libraries (6)
Severity Details
High pkg:npm/[email protected] upgrade to: > 4.2.1
Informational pkg:npm/[email protected] upgrade to: > 1.4.6
High pkg:npm/[email protected] upgrade to: > 0.3.1
Critical pkg:npm/@tensorflow/[email protected] upgrade to: > 3.14.0
N/A pkg:npm/[email protected] upgrade to: 3.1.10
Medium pkg:npm/[email protected] upgrade to: 1.6.0

More info on how to fix Vulnerable Libraries in JavaScript.


👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

Copy link

sonarcloud bot commented Nov 13, 2024

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file size/XS
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant