Skip to content

Bump protobufjs and google-gax in /backend - #524

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/multi-2a30685f11
Open

Bump protobufjs and google-gax in /backend#524
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/multi-2a30685f11

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 17, 2026

Copy link
Copy Markdown
Contributor

Bumps protobufjs and google-gax. These dependencies needed to be updated together.
Updates protobufjs from 7.2.6 to 7.5.5

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.5.4

7.5.4 (2025-08-15)

Bug Fixes

protobufjs: v7.5.3

7.5.3 (2025-05-28)

Bug Fixes

  • descriptor extensions handling post-editions (#2075) (6e255d4)

protobufjs: v7.5.2

7.5.2 (2025-05-14)

Bug Fixes

protobufjs: v7.5.1

7.5.1 (2025-05-08)

Bug Fixes

  • optimize regressions from editions implementations (#2066) (6406d4c)
  • reserved field inside group blocks fail parsing (#2058) (56782bf)

protobufjs: v7.5.0

7.5.0 (2025-04-15)

Features

  • add Edition 2023 Support (f04ded3)
  • add Edition 2023 Support (ac9a3b9)
  • add Edition 2023 Support (e5ca5c8)
  • add Edition 2023 Support (a84409b)
  • add Edition 2023 Support (9c5a178)
  • add Edition 2023 Support (b2c6867)
  • add Edition 2023 Support (60f3e51)
  • add Edition 2023 Support (a656361)
  • add Edition 2023 Support (869a95b)
  • add Edition 2023 Support (b936af4)
  • add Edition 2023 Support (a938467)

... (truncated)

Changelog

Sourced from protobufjs's changelog.

Changelog

8.0.1 (2026-03-11)

Bug Fixes

  • bump protobufjs dependency version for cli package (#2128) (549b05e)
  • correct json syntax in tsconfig.json (#2120) (8065625)
  • descriptor: guard oneof index for non-Type parents (#2122) (1cac5cf)
  • do not allow setting proto in Message constructor (#2126) (f05e3c3)
  • filter invalid characters from the type name (#2127) (535df44)

8.0.0 (2025-12-16)

⚠ BREAKING CHANGES

  • add Edition 2024 Support (#2060)

Features

7.5.4 (2025-08-15)

Bug Fixes

7.5.3 (2025-05-28)

Bug Fixes

  • descriptor extensions handling post-editions (#2075) (6e255d4)

7.5.2 (2025-05-14)

Bug Fixes

7.5.1 (2025-05-08)

Bug Fixes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by fenster, a new releaser for protobufjs since your current version.


Updates google-gax from 4.3.3 to 4.6.1

Changelog

Sourced from google-gax's changelog.

4.6.1 (2025-05-15)

Bug Fixes

4.6.0 (2024-12-19)

Features

4.5.0 (2024-10-25)

Features

  • adds unit tests for sync and async reads of a pipeline transformation (#1663) (c7995c4)

Bug Fixes

4.4.1 (2024-09-04)

Bug Fixes

  • expose underlying error with timeouts or retries (#1650) (f4d037a)

4.4.0 (2024-08-27)

Features

Bug Fixes

  • deps: update dependency protobufjs-cli to v1.1.3 (#1645) (1b2ffdf)

4.3.9 (2024-08-06)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump protobufjs and google-gax in /backend
67436dc 
Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) and [google-gax](https://github.com/googleapis/google-cloud-node-core/tree/HEAD/packages/gax). These dependencies needed to be updated together.

Updates `protobufjs` from 7.2.6 to 7.5.5
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-v7.2.6...protobufjs-v7.5.5)

Updates `google-gax` from 4.3.3 to 4.6.1
- [Release notes](https://github.com/googleapis/google-cloud-node-core/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node-core/blob/main/packages/gax/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node-core/commits/HEAD/packages/gax)

---
updated-dependencies:
- dependency-name: protobufjs
  dependency-version: 7.5.5
  dependency-type: indirect
- dependency-name: google-gax
  dependency-version: 4.6.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 17, 2026
@socket-security

socket-security Bot commented Apr 17, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednpm/​@​types/​smoothscroll-polyfill@​0.3.41001004880100
Addednpm/​@​typescript-eslint/​parser@​5.62.01001007098100
Addednpm/​@​types/​react-router-dom@​5.3.31001007080100
Addednpm/​@​types/​ua-parser-js@​0.7.391001007180100
Addednpm/​@​types/​react-router@​5.1.201001007380100
Addednpm/​@​types/​react-transition-group@​4.4.121001007480100
Addednpm/​@​types/​react-dom@​16.9.251001007586100
Addednpm/​@​types/​jest@​26.0.241001007781100
Addednpm/​@​types/​luxon@​2.4.01001007781100
Addednpm/​@​types/​react@​16.14.661001007892100
Addednpm/​@​typescript-eslint/​eslint-plugin@​5.62.0951007998100
Addednpm/​@​types/​node@​12.20.551001008096100
Updatednpm/​@​types/​lodash@​4.14.189 ⏵ 4.17.2010010080 -186100
Addednpm/​@​types/​toastify-js@​1.12.49910010080100
Addednpm/​@​testing-library/​user-event@​12.8.310010010086100
Addednpm/​@​ionic/​react@​7.8.6981008697100
Addednpm/​@​testing-library/​react@​11.2.710010010087100
Addednpm/​@​testing-library/​jest-dom@​5.17.010010010089100
Addednpm/​@​sentry/​react@​7.120.4991009896100
Addednpm/​@​ionic/​core@​7.8.69910010098100
Addednpm/​@​nkalupahana/​react-circular-slider@​2.3.5100100100100100

View full report

@socket-security

socket-security Bot commented Apr 17, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @stencil/core is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: package-lock.json → npm/@ionic/core@7.8.6 → npm/@ionic/react@7.8.6 → npm/@stencil/core@4.36.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@stencil/core@4.36.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants