Bump protobufjs from 7.2.4 to 7.2.5 in /web

[dependabot]

Bumps protobufjs from 7.2.4 to 7.2.5.

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.2.5

7.2.5 (2023-08-21)

Bug Fixes

• crash in comment parsing (#1890) (eaf9f0a)
• deprecation warning for new Buffer (#1905) (e93286e)
• possible infinite loop when parsing option (#1923) (f2a8620)

Changelog

Sourced from protobufjs's changelog.

7.2.5 (2023-08-21)

Bug Fixes

• crash in comment parsing (#1890) (eaf9f0a)
• deprecation warning for new Buffer (#1905) (e93286e)
• possible infinite loop when parsing option (#1923) (f2a8620)

Commits

• 4436cc7 chore: release master (#1925)
• e93286e fix: deprecation warning for new Buffer (#1905)
• eaf9f0a fix: crash in comment parsing (#1890)
• f2a8620 fix: possible infinite loop when parsing option (#1923)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Configured Codepaths Analyzer	✅	0 findings
Sensitive Files Analyzer	❕	2 findings
Authn/Authz Analyzer	✅	0 findings
AppSec Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖.
Note that this summary is auto-generated and not meant to be a definitive list of security issues
but rather a helpful summary from a security perspective.

Summary:

The code change in this pull request updates the version of the protobufjs dependency from 7.2.4 to 7.2.5 in the web/package.json file. While updating dependencies to their latest versions is generally considered a good practice, as it can address known security vulnerabilities and bugs, the specific security implications of this change are not immediately clear without more context about how the protobufjs library is used within the application.

Protobuf (Protocol Buffers) is a language-neutral, platform-neutral, extensible mechanism for serializing structured data, and it is often used for efficient data transmission in distributed applications. While protobuf itself is not inherently a security risk, the way it is implemented and used within an application can have security implications. Some potential security considerations around the use of protobuf in an application include input validation, deserialization security, versioning and compatibility, and secure transport of the protobuf data.

Without more information about the specific application and how the protobufjs library is utilized, it's difficult to provide a more detailed security analysis. However, the general principles of secure coding, input validation, and secure data handling should be applied when working with protobuf in any application.

Files Changed:

• web/package.json: The code change in this file updates the version of the protobufjs dependency from 7.2.4 to 7.2.5.

Powered by DryRun Security