4 Commits (fa2df01d6da4cc6f09b8f76a2503ac9ddb1d8a05)

Author	SHA1	Message	Date
dependabot[bot]	fa2df01d6d	chore(deps): bump jsonwebtoken, firebase-admin and firebase-functions in /functions (#502) ... Bumps [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken) to 9.0.2 and updates ancestor dependencies [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken), [firebase-admin](https://github.com/firebase/firebase-admin-node) and [firebase-functions](https://github.com/firebase/firebase-functions). These dependencies need to be updated together. Updates `jsonwebtoken` from 8.5.1 to 9.0.2 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/auth0/node-jsonwebtoken/blob/master/CHANGELOG.md">jsonwebtoken's changelog</a>.</em></p> <blockquote> <h2>9.0.2 - 2023-08-30</h2> <ul> <li>security: updating semver to 7.5.4 to resolve CVE-2022-25883, closes <a href="https://redirect.github.com/auth0/node-jsonwebtoken/issues/921">#921</a>.</li> <li>refactor: reduce library size by using lodash specific dependencies, closes <a href="https://redirect.github.com/auth0/node-jsonwebtoken/issues/878">#878</a>.</li> </ul> <h2>9.0.1 - 2023-07-05</h2> <ul> <li>fix(stubs): allow decode method to be stubbed</li> </ul> <h2>9.0.0 - 2022-12-21</h2> <p><strong>Breaking changes: See <a href="https://github.com/auth0/node-jsonwebtoken/wiki/Migration-Notes:-v8-to-v9">Migration from v8 to v9</a></strong></p> <h3>Breaking changes</h3> <ul> <li>Removed support for Node versions 11 and below.</li> <li>The verify() function no longer accepts unsigned tokens by default. ([834503079514b72264fd13023a3b8d648afd6a16]<a href="8345030795</a>)</li> <li>RSA key size must be 2048 bits or greater. ([ecdf6cc6073ea13a7e71df5fad043550f08d0fa6]<a href="ecdf6cc607</a>)</li> <li>Key types must be valid for the signing / verification algorithm</li> </ul> <h3>Security fixes</h3> <ul> <li>security: fixes <code>Arbitrary File Write via verify function</code> - CVE-2022-23529</li> <li>security: fixes <code>Insecure default algorithm in jwt.verify() could lead to signature validation bypass</code> - CVE-2022-23540</li> <li>security: fixes <code>Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC</code> - CVE-2022-23541</li> <li>security: fixes <code>Unrestricted key type could lead to legacy keys usage</code> - CVE-2022-23539</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="bc28861f1f"><code>bc28861</code></a> Release 9.0.2 (<a href="https://redirect.github.com/auth0/node-jsonwebtoken/issues/935">#935</a>)</li> <li><a href="96b89060cf"><code>96b8906</code></a> refactor: use specific lodash packages (<a href="https://redirect.github.com/auth0/node-jsonwebtoken/issues/933">#933</a>)</li> <li><a href="ed35062239"><code>ed35062</code></a> security: Updating semver to 7.5.4 to resolve CVE-2022-25883 (<a href="https://redirect.github.com/auth0/node-jsonwebtoken/issues/932">#932</a>)</li> <li><a href="84539b29e1"><code>84539b2</code></a> Updating package version to 9.0.1 (<a href="https://redirect.github.com/auth0/node-jsonwebtoken/issues/920">#920</a>)</li> <li><a href="a99fd4b473"><code>a99fd4b</code></a> fix(stubs): allow decode method to be stubbed (<a href="https://redirect.github.com/auth0/node-jsonwebtoken/issues/876">#876</a>)</li> <li><a href="e1fa9dcc12"><code>e1fa9dc</code></a> Merge pull request from GHSA-8cf7-32gw-wr33</li> <li><a href="5eaedbf2b0"><code>5eaedbf</code></a> chore(ci): remove github test actions job (<a href="https://redirect.github.com/auth0/node-jsonwebtoken/issues/861">#861</a>)</li> <li><a href="cd4163eb14"><code>cd4163e</code></a> chore(ci): configure Github Actions jobs for Tests &amp; Security Scanning (<a href="https://redirect.github.com/auth0/node-jsonwebtoken/issues/856">#856</a>)</li> <li><a href="ecdf6cc607"><code>ecdf6cc</code></a> fix!: Prevent accidental use of insecure key sizes &amp; misconfiguration of secr...</li> <li><a href="8345030795"><code>8345030</code></a> fix(sign&amp;verify)!: Remove default <code>none</code> support from <code>sign</code> and <code>verify</code> met...</li> <li>Additional commits viewable in <a href="https://github.com/auth0/node-jsonwebtoken/compare/v8.5.1...v9.0.2">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~charlesrea">charlesrea</a>, a new releaser for jsonwebtoken since your current version.</p> </details> <br /> Updates `firebase-admin` from 10.2.0 to 12.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/firebase/firebase-admin-node/releases">firebase-admin's releases</a>.</em></p> <blockquote> <h2>Firebase Admin Node.js SDK v12.2.0</h2> <h3>Breaking Changes</h3> <ul> <li>change: Deprecate Node.js 16 support (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2574">#2574</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>fix: Replace <code>farmhash</code> with <code>farmhash-modern</code> (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2603">#2603</a>)</li> <li>fix: Make ADC + human account work with firebase-admin (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2553">#2553</a>)</li> <li>fix: Use optional chaining in FirebaseError (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2581">#2581</a>)</li> </ul> <h3>Miscellaneous</h3> <ul> <li>[chore] Release 12.2.0 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2605">#2605</a>)</li> <li>build(deps): bump uuid from 9.0.1 to 10.0.0 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2599">#2599</a>)</li> <li>build(deps-dev): bump chai-exclude from 2.1.0 to 2.1.1 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2593">#2593</a>)</li> <li>build(deps-dev): bump braces from 3.0.2 to 3.0.3 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2595">#2595</a>)</li> <li>build(deps): bump <code>@​grpc/grpc-js</code> from 1.10.8 to 1.10.9 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2592">#2592</a>)</li> <li>build(deps-dev): bump <code>@​types/lodash</code> from 4.17.4 to 4.17.5 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2594">#2594</a>)</li> <li>build(deps): bump <code>@​google-cloud/firestore</code> from 7.7.0 to 7.8.0 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2583">#2583</a>)</li> <li>build(deps): bump <code>@​types/node</code> from 20.12.12 to 20.14.0 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2585">#2585</a>)</li> <li>build(deps-dev): bump <code>@​firebase/app-compat</code> from 0.2.34 to 0.2.35 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2575">#2575</a>)</li> <li>build(deps-dev): bump chai-as-promised from 7.1.1 to 7.1.2 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2578">#2578</a>)</li> <li>build(deps): bump <code>@​google-cloud/storage</code> from 7.11.0 to 7.11.1 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2579">#2579</a>)</li> </ul> <h2>Firebase Admin Node.js SDK v12.1.1</h2> <h3>Bug Fixes</h3> <ul> <li>fix: Export error classes (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2151">#2151</a>)</li> </ul> <h3>Miscellaneous</h3> <ul> <li>[chore] Release 12.1.1 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2561">#2561</a>)</li> <li>build(deps): updgrade jwks-rsa (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2570">#2570</a>)</li> <li>--- (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2568">#2568</a>)</li> <li>--- (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2566">#2566</a>)</li> <li>--- (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2567">#2567</a>)</li> <li>--- (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2569">#2569</a>)</li> <li>build(deps-dev): bump <code>@​firebase/auth-types</code> from 0.12.1 to 0.12.2 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2556">#2556</a>)</li> <li>build(deps-dev): bump <code>@​microsoft/api-extractor</code> from 7.43.2 to 7.43.7 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2559">#2559</a>)</li> <li>chore: upgrade firestore to 7.7.0 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2560">#2560</a>)</li> <li>build(deps-dev): bump <code>@​firebase/app-compat</code> from 0.2.32 to 0.2.33 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2555">#2555</a>)</li> <li>build(deps): bump <code>@​google-cloud/firestore</code> from 7.6.0 to 7.7.0 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2558">#2558</a>)</li> <li>Fix api extractor issues to expose error types (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2549">#2549</a>)</li> <li>build(deps-dev): bump <code>@​types/lodash</code> from 4.17.0 to 4.17.1 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2546">#2546</a>)</li> <li>build(deps): bump <code>@​google-cloud/storage</code> from 7.10.2 to 7.11.0 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2547">#2547</a>)</li> <li>build(deps-dev): bump <code>@​microsoft/api-extractor</code> from 7.43.1 to 7.43.2 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2545">#2545</a>)</li> <li>build(deps): bump <code>@​types/node</code> from 20.12.7 to 20.12.10 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2544">#2544</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="5620e9c6bd"><code>5620e9c</code></a> [chore] Release 12.2.0 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2605">#2605</a>)</li> <li><a href="f6f7cb9650"><code>f6f7cb9</code></a> build(deps): bump uuid from 9.0.1 to 10.0.0 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2599">#2599</a>)</li> <li><a href="b890182e73"><code>b890182</code></a> fix: Replace <code>farmhash</code> with <code>farmhash-modern</code> (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2603">#2603</a>)</li> <li><a href="5f0f253301"><code>5f0f253</code></a> fix: Make ADC + human account work with firebase-admin (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2553">#2553</a>)</li> <li><a href="fdde8c3a6f"><code>fdde8c3</code></a> build(deps-dev): bump chai-exclude from 2.1.0 to 2.1.1 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2593">#2593</a>)</li> <li><a href="07855bfd77"><code>07855bf</code></a> build(deps-dev): bump braces from 3.0.2 to 3.0.3 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2595">#2595</a>)</li> <li><a href="54405804a8"><code>5440580</code></a> build(deps): bump <code>@​grpc/grpc-js</code> from 1.10.8 to 1.10.9 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2592">#2592</a>)</li> <li><a href="5f01f63da5"><code>5f01f63</code></a> build(deps-dev): bump <code>@​types/lodash</code> from 4.17.4 to 4.17.5 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2594">#2594</a>)</li> <li><a href="4070f5bf41"><code>4070f5b</code></a> build(deps): bump <code>@​google-cloud/firestore</code> from 7.7.0 to 7.8.0 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2583">#2583</a>)</li> <li><a href="07cfca83d8"><code>07cfca8</code></a> build(deps): bump <code>@​types/node</code> from 20.12.12 to 20.14.0 (<a href="https://redirect.github.com/firebase/firebase-admin-node/issues/2585">#2585</a>)</li> <li>Additional commits viewable in <a href="https://github.com/firebase/firebase-admin-node/compare/v10.2.0...v12.2.0">compare view</a></li> </ul> </details> <br /> Updates `firebase-functions` from 3.21.0 to 3.24.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/firebase/firebase-functions/releases">firebase-functions's releases</a>.</em></p> <blockquote> <h2>v3.24.1</h2> <ul> <li>Fix reference docs for performance monitoring.</li> <li>Fix bug where function configuration wil null values couldn't be deployed. (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1246">#1246</a>)</li> </ul> <h2>v3.24.0</h2> <ul> <li>Add performance monitoring triggers to v2 alerts (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1223">#1223</a>).</li> </ul> <h2>v3.23.0</h2> <ul> <li>Fixes a bug that disallowed setting customClaims and/or sessionClaims in blocking functions (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1199">#1199</a>).</li> <li>Add v2 Schedule Triggers (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1177">#1177</a>).</li> </ul> <h2>v3.22.0</h2> <ul> <li>Adds RTDB Triggers for v2 functions (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1127">#1127</a>)</li> <li>Adds support for Firebase Admin SDK v11 (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1151">#1151</a>)</li> <li>Fixes bug where emulated task queue function required auth header (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1154">#1154</a>)</li> </ul> <h2>v3.21.2</h2> <ul> <li>Fixes bug where <code>toJSON</code> was not defined in <code>UserRecord</code> (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1125">#1125</a>).</li> </ul> <h2>v3.21.1</h2> <ul> <li>Add debug feature to enable cors option for v2 onRequest and onCall handlers. (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1099">#1099</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="e4bda7d683"><code>e4bda7d</code></a> 3.24.1</li> <li><a href="3c5392dfee"><code>3c5392d</code></a> Hide documentation for in-app feedback (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1245">#1245</a>)</li> <li><a href="cc6e28e6ed"><code>cc6e28e</code></a> Fix bug where function configuration with null couldn't be deployed. (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1246">#1246</a>)</li> <li><a href="cf27ac6b0b"><code>cf27ac6</code></a> Adding required --project flag to v2 docgen script. (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1239">#1239</a>)</li> <li><a href="1ac04adba9"><code>1ac04ad</code></a> fix tsdoc comments (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1240">#1240</a>)</li> <li><a href="bd0fcbc595"><code>bd0fcbc</code></a> [firebase-release] Removed change log and reset repo after 3.24.0 release</li> <li><a href="e191af7148"><code>e191af7</code></a> 3.24.0</li> <li><a href="b93e397b32"><code>b93e397</code></a> Don't delete fields on a non-breaking change release (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1238">#1238</a>)</li> <li><a href="65e66a2138"><code>65e66a2</code></a> Converting alert type and app id to camel case in the CloudEvent (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1236">#1236</a>)</li> <li><a href="c18e832d92"><code>c18e832</code></a> Adds performance monitoring triggers to v2 alerts (<a href="https://redirect.github.com/firebase/firebase-functions/issues/1223">#1223</a>)</li> <li>Additional commits viewable in <a href="https://github.com/firebase/firebase-functions/compare/v3.21.0...v3.24.1">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/flutter/pinball/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	1 year ago
dependabot[bot]	7137067a15	chore(deps): bump express from 4.18.1 to 4.19.2 in /functions (#501) ... Bumps [express](https://github.com/expressjs/express) from 4.18.1 to 4.19.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/expressjs/express/releases">express's releases</a>.</em></p> <blockquote> <h2>4.19.2</h2> <h2>What's Changed</h2> <ul> <li><a href="0b746953c4">Improved fix for open redirect allow list bypass</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/express/compare/4.19.1...4.19.2">https://github.com/expressjs/express/compare/4.19.1...4.19.2</a></p> <h2>4.19.1</h2> <h2>What's Changed</h2> <ul> <li>Fix ci after location patch by <a href="https://github.com/wesleytodd"><code>@​wesleytodd</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5552">expressjs/express#5552</a></li> <li>fixed un-edited version in history.md for 4.19.0 by <a href="https://github.com/wesleytodd"><code>@​wesleytodd</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5556">expressjs/express#5556</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/express/compare/4.19.0...4.19.1">https://github.com/expressjs/express/compare/4.19.0...4.19.1</a></p> <h2>4.19.0</h2> <h2>What's Changed</h2> <ul> <li>fix typo in release date by <a href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5527">expressjs/express#5527</a></li> <li>docs: nominating <a href="https://github.com/wesleytodd"><code>@​wesleytodd</code></a> to be project captian by <a href="https://github.com/wesleytodd"><code>@​wesleytodd</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5511">expressjs/express#5511</a></li> <li>docs: loosen TC activity rules by <a href="https://github.com/wesleytodd"><code>@​wesleytodd</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5510">expressjs/express#5510</a></li> <li>Add note on how to update docs for new release by <a href="https://github.com/crandmck"><code>@​crandmck</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5541">expressjs/express#5541</a></li> <li><a href="660ccf5fa3">Prevent open redirect allow list bypass due to encodeurl</a></li> <li>Release 4.19.0 by <a href="https://github.com/wesleytodd"><code>@​wesleytodd</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5551">expressjs/express#5551</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/crandmck"><code>@​crandmck</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/express/pull/5541">expressjs/express#5541</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/express/compare/4.18.3...4.19.0">https://github.com/expressjs/express/compare/4.18.3...4.19.0</a></p> <h2>4.18.3</h2> <h2>Main Changes</h2> <ul> <li>Fix routing requests without method</li> <li>deps: body-parser@1.20.2 <ul> <li>Fix strict json error message on Node.js 19+</li> <li>deps: content-type@~1.0.5</li> <li>deps: raw-body@2.5.2</li> </ul> </li> </ul> <h2>Other Changes</h2> <ul> <li>Use https: protocol instead of deprecated git: protocol by <a href="https://github.com/vcsjones"><code>@​vcsjones</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5032">expressjs/express#5032</a></li> <li>build: Node.js@16.18 and Node.js@18.12 by <a href="https://github.com/abenhamdine"><code>@​abenhamdine</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5034">expressjs/express#5034</a></li> <li>ci: update actions/checkout to v3 by <a href="https://github.com/armujahid"><code>@​armujahid</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5027">expressjs/express#5027</a></li> <li>test: remove unused function arguments in params by <a href="https://github.com/raksbisht"><code>@​raksbisht</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5124">expressjs/express#5124</a></li> <li>Remove unused originalIndex from acceptParams by <a href="https://github.com/raksbisht"><code>@​raksbisht</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5119">expressjs/express#5119</a></li> <li>Fixed typos by <a href="https://github.com/raksbisht"><code>@​raksbisht</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5117">expressjs/express#5117</a></li> <li>examples: remove unused params by <a href="https://github.com/raksbisht"><code>@​raksbisht</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5113">expressjs/express#5113</a></li> <li>fix: parameter str is not described in JSDoc by <a href="https://github.com/raksbisht"><code>@​raksbisht</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5130">expressjs/express#5130</a></li> <li>fix: typos in History.md by <a href="https://github.com/raksbisht"><code>@​raksbisht</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5131">expressjs/express#5131</a></li> <li>build : add Node.js@19.7 by <a href="https://github.com/abenhamdine"><code>@​abenhamdine</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5028">expressjs/express#5028</a></li> <li>test: remove unused function arguments in params by <a href="https://github.com/raksbisht"><code>@​raksbisht</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5137">expressjs/express#5137</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/expressjs/express/blob/master/History.md">express's changelog</a>.</em></p> <blockquote> <h1>4.19.2 / 2024-03-25</h1> <ul> <li>Improved fix for open redirect allow list bypass</li> </ul> <h1>4.19.1 / 2024-03-20</h1> <ul> <li>Allow passing non-strings to res.location with new encoding handling checks</li> </ul> <h1>4.19.0 / 2024-03-20</h1> <ul> <li>Prevent open redirect allow list bypass due to encodeurl</li> <li>deps: cookie@0.6.0</li> </ul> <h1>4.18.3 / 2024-02-29</h1> <ul> <li>Fix routing requests without method</li> <li>deps: body-parser@1.20.2 <ul> <li>Fix strict json error message on Node.js 19+</li> <li>deps: content-type@~1.0.5</li> <li>deps: raw-body@2.5.2</li> </ul> </li> <li>deps: cookie@0.6.0 <ul> <li>Add <code>partitioned</code> option</li> </ul> </li> </ul> <h1>4.18.2 / 2022-10-08</h1> <ul> <li>Fix regression routing a large stack in a single route</li> <li>deps: body-parser@1.20.1 <ul> <li>deps: qs@6.11.0</li> <li>perf: remove unnecessary object clone</li> </ul> </li> <li>deps: qs@6.11.0</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="04bc62787b"><code>04bc627</code></a> 4.19.2</li> <li><a href="da4d763ff6"><code>da4d763</code></a> Improved fix for open redirect allow list bypass</li> <li><a href="4f0f6cc67d"><code>4f0f6cc</code></a> 4.19.1</li> <li><a href="a003cfab03"><code>a003cfa</code></a> Allow passing non-strings to res.location with new encoding handling checks f...</li> <li><a href="a1fa90fcea"><code>a1fa90f</code></a> fixed un-edited version in history.md for 4.19.0</li> <li><a href="11f2b1db22"><code>11f2b1d</code></a> build: fix build due to inconsistent supertest behavior in older versions</li> <li><a href="084e36506a"><code>084e365</code></a> 4.19.0</li> <li><a href="0867302ddb"><code>0867302</code></a> Prevent open redirect allow list bypass due to encodeurl</li> <li><a href="567c9c665d"><code>567c9c6</code></a> Add note on how to update docs for new release (<a href="https://redirect.github.com/expressjs/express/issues/5541">#5541</a>)</li> <li><a href="69a4cf2819"><code>69a4cf2</code></a> deps: cookie@0.6.0</li> <li>Additional commits viewable in <a href="https://github.com/expressjs/express/compare/4.18.1...4.19.2">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~wesleytodd">wesleytodd</a>, a new releaser for express since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/flutter/pinball/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Álvaro Stivi <astivi@users.noreply.github.com>	1 year ago
dependabot[bot]	ca4a79d462	chore(deps): bump jose from 2.0.5 to 2.0.7 in /functions (#500) ... Bumps [jose](https://github.com/panva/jose) from 2.0.5 to 2.0.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/panva/jose/releases">jose's releases</a>.</em></p> <blockquote> <h2>v2.0.7</h2> <h3>Fixes</h3> <ul> <li>add a maxOutputLength option to zlib inflate (<a href="02a65794f7">02a6579</a>), fixes <a href="https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q">CVE-2024-28176</a></li> </ul> <h2>v2.0.6</h2> <h3>Fixes</h3> <ul> <li>limit default PBES2 alg's computational expense (<a href="c1512be660">c1512be</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/panva/jose/blob/v2.0.7/CHANGELOG.md">jose's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/panva/jose/compare/v2.0.6...v2.0.7">2.0.7</a> (2024-03-07)</h2> <h3>Bug Fixes</h3> <ul> <li>add a maxOutputLength option to zlib inflate (<a href="02a65794f7">02a6579</a>)</li> </ul> <h2><a href="https://github.com/panva/jose/compare/v2.0.5...v2.0.6">2.0.6</a> (2022-09-01)</h2> <h3>Bug Fixes</h3> <ul> <li>limit default PBES2 alg's computational expense (<a href="c1512be660">c1512be</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="0fbe2e68c7"><code>0fbe2e6</code></a> chore(release): 2.0.7</li> <li><a href="02a65794f7"><code>02a6579</code></a> fix: add a maxOutputLength option to zlib inflate</li> <li><a href="d1be83faa6"><code>d1be83f</code></a> chore(release): 2.0.6</li> <li><a href="c1512be660"><code>c1512be</code></a> fix: limit default PBES2 alg's computational expense</li> <li>See full diff in <a href="https://github.com/panva/jose/compare/v2.0.5...v2.0.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/flutter/pinball/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Álvaro Stivi <astivi@users.noreply.github.com>	1 year ago
Felix Angelov	6454d166e9	feat(functions): add leaderboard cleanup function (#376)	4 years ago