Skip to content

Commit 5eb1a47

Browse files
Alessandro100Alessandro100
authored
securtiy patch for tar (#1591)
1 parent 96e74d4 commit 5eb1a47

File tree

7 files changed

+94
-61
lines changed

7 files changed

+94
-61
lines changed

‎functions/package.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@
66
"build": "yarn workspaces run build",
77
"lint": "yarn workspaces run lint"
88
},
9+
"resolutions": {
10+
"tar": "^7.5.7"
11+
},
912
"devDependencies": {
1013
"firebase-tools": "^13.6.0"
1114
}

‎functions/packages/feed-form/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"logs": "firebase functions:log"
1414
},
1515
"engines": {
16-
"node": "18"
16+
"node": ">=18 <=24"
1717
},
1818
"main": "lib/index.js",
1919
"dependencies": {

‎functions/packages/firebase-password-policy/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "firebase-password-policy",
33
"version": "1.0.0",
44
"engines": {
5-
"node": "18"
5+
"node": ">=18 <=24"
66
},
77
"scripts": {
88
"lint": "eslint --ext .js,.ts .",

‎functions/packages/user-api/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"logs": "firebase functions:log"
1414
},
1515
"engines": {
16-
"node": "18"
16+
"node": ">=18 <=24"
1717
},
1818
"main": "lib/index.js",
1919
"dependencies": {

‎functions/yarn.lock‎

Lines changed: 45 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -962,6 +962,13 @@
962962
wrap-ansi "^8.1.0"
963963
wrap-ansi-cjs "npm:wrap-ansi@^7.0.0"
964964

965+
"@isaacs/fs-minipass@^4.0.0":
966+
version "4.0.1"
967+
resolved "https://registry.yarnpkg.com/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz#2d59ae3ab4b38fb4270bfa23d30f8e2e86c7fe32"
968+
integrity sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==
969+
dependencies:
970+
minipass "^7.0.4"
971+
965972
"@istanbuljs/load-nyc-config@^1.0.0":
966973
version "1.1.0"
967974
resolved "https://registry.yarnpkg.com/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz#fd3db1d59ecf7cf121e80650bb86712f9b55eced"
@@ -2472,10 +2479,10 @@ chokidar@^3.0.2:
24722479
optionalDependencies:
24732480
fsevents "~2.3.2"
24742481

2475-
chownr@^2.0.0:
2476-
version "2.0.0"
2477-
resolved "https://registry.yarnpkg.com/chownr/-/chownr-2.0.0.tgz#15bfbe53d2eab4cf70f18a8cd68ebe5b3cb1dece"
2478-
integrity sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==
2482+
chownr@^3.0.0:
2483+
version "3.0.0"
2484+
resolved "https://registry.yarnpkg.com/chownr/-/chownr-3.0.0.tgz#9855e64ecd240a9cc4267ce8a4aa5d24a1da15e4"
2485+
integrity sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==
24792486

24802487
ci-info@^2.0.0:
24812488
version "2.0.0"
@@ -2756,6 +2763,11 @@ cors@^2.8.5:
27562763
object-assign "^4"
27572764
vary "^1"
27582765

2766+
countries-list@^3.2.0:
2767+
version "3.2.2"
2768+
resolved "https://registry.yarnpkg.com/countries-list/-/countries-list-3.2.2.tgz#34ded4d3c8ebe715306cb5658c34f73a0c8f01cb"
2769+
integrity sha512-ABJ/RWQBrPWy+hRuZoW+0ooK8p65Eo3WmUZwHm6v4wmfSPznNAKzjy3+UUYrJK2v3182BVsgWxdB6ROidj39kw==
2770+
27592771
crc-32@^1.2.0:
27602772
version "1.2.2"
27612773
resolved "https://registry.yarnpkg.com/crc-32/-/crc-32-1.2.2.tgz#3cad35a934b8bf71f25ca524b6da51fb7eace2ff"
@@ -3845,13 +3857,6 @@ fs-extra@^8.1.0:
38453857
jsonfile "^4.0.0"
38463858
universalify "^0.1.0"
38473859

3848-
fs-minipass@^2.0.0:
3849-
version "2.1.0"
3850-
resolved "https://registry.yarnpkg.com/fs-minipass/-/fs-minipass-2.1.0.tgz#7f5036fdbf12c63c169190cbe4199c852271f9fb"
3851-
integrity sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==
3852-
dependencies:
3853-
minipass "^3.0.0"
3854-
38553860
fs-minipass@^3.0.0:
38563861
version "3.0.3"
38573862
resolved "https://registry.yarnpkg.com/fs-minipass/-/fs-minipass-3.0.3.tgz#79a85981c4dc120065e96f62086bf6f9dc26cc54"
@@ -5903,32 +5908,39 @@ minipass@^3.0.0:
59035908
dependencies:
59045909
yallist "^4.0.0"
59055910

5906-
minipass@^5.0.0:
5907-
version "5.0.0"
5908-
resolved "https://registry.yarnpkg.com/minipass/-/minipass-5.0.0.tgz#3e9788ffb90b694a5d0ec94479a45b5d8738133d"
5909-
integrity sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==
5910-
59115911
"minipass@^5.0.0 || ^6.0.2 || ^7.0.0", minipass@^7.0.2, minipass@^7.0.3:
59125912
version "7.0.4"
59135913
resolved "https://registry.yarnpkg.com/minipass/-/minipass-7.0.4.tgz#dbce03740f50a4786ba994c1fb908844d27b038c"
59145914
integrity sha512-jYofLM5Dam9279rdkWzqHozUo4ybjdZmCsDHePy5V/PbBcVMiSZR97gmAy45aqi8CK1lG2ECd356FU86avfwUQ==
59155915

5916-
minizlib@^2.1.1, minizlib@^2.1.2:
5916+
minipass@^7.0.4, minipass@^7.1.2:
5917+
version "7.1.2"
5918+
resolved "https://registry.yarnpkg.com/minipass/-/minipass-7.1.2.tgz#93a9626ce5e5e66bd4db86849e7515e92340a707"
5919+
integrity sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==
5920+
5921+
minizlib@^2.1.2:
59175922
version "2.1.2"
59185923
resolved "https://registry.yarnpkg.com/minizlib/-/minizlib-2.1.2.tgz#e90d3466ba209b932451508a11ce3d3632145931"
59195924
integrity sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==
59205925
dependencies:
59215926
minipass "^3.0.0"
59225927
yallist "^4.0.0"
59235928

5929+
minizlib@^3.1.0:
5930+
version "3.1.0"
5931+
resolved "https://registry.yarnpkg.com/minizlib/-/minizlib-3.1.0.tgz#6ad76c3a8f10227c9b51d1c9ac8e30b27f5a251c"
5932+
integrity sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==
5933+
dependencies:
5934+
minipass "^7.1.2"
5935+
59245936
mkdirp@^0.5.6:
59255937
version "0.5.6"
59265938
resolved "https://registry.yarnpkg.com/mkdirp/-/mkdirp-0.5.6.tgz#7def03d2432dcae4ba1d611445c48396062255f6"
59275939
integrity sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==
59285940
dependencies:
59295941
minimist "^1.2.6"
59305942

5931-
mkdirp@^1.0.3, mkdirp@^1.0.4:
5943+
mkdirp@^1.0.4:
59325944
version "1.0.4"
59335945
resolved "https://registry.yarnpkg.com/mkdirp/-/mkdirp-1.0.4.tgz#3eb5ed62622756d79a5f0e2a221dfebad75c2f7e"
59345946
integrity sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==
@@ -7313,17 +7325,16 @@ tar-stream@^2.2.0:
73137325
inherits "^2.0.3"
73147326
readable-stream "^3.1.1"
73157327

7316-
tar@^6.1.11, tar@^6.1.2:
7317-
version "6.2.1"
7318-
resolved "https://registry.yarnpkg.com/tar/-/tar-6.2.1.tgz#717549c541bc3c2af15751bea94b1dd068d4b03a"
7319-
integrity sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==
7320-
dependencies:
7321-
chownr "^2.0.0"
7322-
fs-minipass "^2.0.0"
7323-
minipass "^5.0.0"
7324-
minizlib "^2.1.1"
7325-
mkdirp "^1.0.3"
7326-
yallist "^4.0.0"
7328+
tar@^6.1.11, tar@^6.1.2, tar@^7.5.7:
7329+
version "7.5.7"
7330+
resolved "https://registry.yarnpkg.com/tar/-/tar-7.5.7.tgz#adf99774008ba1c89819f15dbd6019c630539405"
7331+
integrity sha512-fov56fJiRuThVFXD6o6/Q354S7pnWMJIVlDBYijsTNx6jKSE4pvrDTs6lUnmGvNyfJwFQQwWy3owKz1ucIhveQ==
7332+
dependencies:
7333+
"@isaacs/fs-minipass" "^4.0.0"
7334+
chownr "^3.0.0"
7335+
minipass "^7.1.2"
7336+
minizlib "^3.1.0"
7337+
yallist "^5.0.0"
73277338

73287339
tcp-port-used@^1.0.2:
73297340
version "1.0.2"
@@ -7981,6 +7992,11 @@ yallist@^4.0.0:
79817992
resolved "https://registry.yarnpkg.com/yallist/-/yallist-4.0.0.tgz#9bb92790d9c0effec63be73519e11a35019a3a72"
79827993
integrity sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==
79837994

7995+
yallist@^5.0.0:
7996+
version "5.0.0"
7997+
resolved "https://registry.yarnpkg.com/yallist/-/yallist-5.0.0.tgz#00e2de443639ed0d78fd87de0d27469fbcffb533"
7998+
integrity sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==
7999+
79848000
yaml@^2.2.1:
79858001
version "2.3.4"
79868002
resolved "https://registry.yarnpkg.com/yaml/-/yaml-2.3.4.tgz#53fc1d514be80aabf386dc6001eb29bf3b7523b2"

‎web-app/package.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,9 @@
7878
"generate:gbfs-validator-types:output": "npx openapi-typescript ../docs/GbfsValidator.yaml -o $OUTPUT_PATH_TYPES && eslint $OUTPUT_PATH_TYPES --fix",
7979
"generate:gbfs-validator-types": "OUTPUT_PATH_TYPES=src/app/services/feeds/gbfs-validator-types.ts npm run generate:gbfs-validator-types:output"
8080
},
81+
"resolutions": {
82+
"tar": "^7.5.7"
83+
},
8184
"eslintConfig": {
8285
"extends": [
8386
"react-app",

‎web-app/yarn.lock‎

Lines changed: 40 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -2094,6 +2094,13 @@
20942094
wrap-ansi "^8.1.0"
20952095
wrap-ansi-cjs "npm:wrap-ansi@^7.0.0"
20962096

2097+
"@isaacs/fs-minipass@^4.0.0":
2098+
version "4.0.1"
2099+
resolved "https://registry.yarnpkg.com/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz#2d59ae3ab4b38fb4270bfa23d30f8e2e86c7fe32"
2100+
integrity sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==
2101+
dependencies:
2102+
minipass "^7.0.4"
2103+
20972104
"@istanbuljs/load-nyc-config@^1.0.0":
20982105
version "1.1.0"
20992106
resolved "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz"
@@ -5428,10 +5435,10 @@ chokidar@^3.0.2, chokidar@^3.4.2, chokidar@^3.5.3:
54285435
optionalDependencies:
54295436
fsevents "~2.3.2"
54305437

5431-
chownr@^2.0.0:
5432-
version "2.0.0"
5433-
resolved "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz"
5434-
integrity sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==
5438+
chownr@^3.0.0:
5439+
version "3.0.0"
5440+
resolved "https://registry.yarnpkg.com/chownr/-/chownr-3.0.0.tgz#9855e64ecd240a9cc4267ce8a4aa5d24a1da15e4"
5441+
integrity sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==
54355442

54365443
chrome-trace-event@^1.0.2:
54375444
version "1.0.3"
@@ -8008,13 +8015,6 @@ fs-extra@^9.0.0, fs-extra@^9.0.1, fs-extra@^9.1.0:
80088015
jsonfile "^6.0.1"
80098016
universalify "^2.0.0"
80108017

8011-
fs-minipass@^2.0.0:
8012-
version "2.1.0"
8013-
resolved "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz"
8014-
integrity sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==
8015-
dependencies:
8016-
minipass "^3.0.0"
8017-
80188018
fs-minipass@^3.0.0:
80198019
version "3.0.3"
80208020
resolved "https://registry.npmjs.org/fs-minipass/-/fs-minipass-3.0.3.tgz"
@@ -11003,32 +11003,39 @@ minipass@^3.0.0:
1100311003
dependencies:
1100411004
yallist "^4.0.0"
1100511005

11006-
minipass@^5.0.0:
11007-
version "5.0.0"
11008-
resolved "https://registry.npmjs.org/minipass/-/minipass-5.0.0.tgz"
11009-
integrity sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==
11010-
1101111006
"minipass@^5.0.0 || ^6.0.2 || ^7.0.0", minipass@^7.0.2, minipass@^7.0.3:
1101211007
version "7.0.4"
1101311008
resolved "https://registry.npmjs.org/minipass/-/minipass-7.0.4.tgz"
1101411009
integrity sha512-jYofLM5Dam9279rdkWzqHozUo4ybjdZmCsDHePy5V/PbBcVMiSZR97gmAy45aqi8CK1lG2ECd356FU86avfwUQ==
1101511010

11016-
minizlib@^2.1.1, minizlib@^2.1.2:
11011+
minipass@^7.0.4, minipass@^7.1.2:
11012+
version "7.1.2"
11013+
resolved "https://registry.yarnpkg.com/minipass/-/minipass-7.1.2.tgz#93a9626ce5e5e66bd4db86849e7515e92340a707"
11014+
integrity sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==
11015+
11016+
minizlib@^2.1.2:
1101711017
version "2.1.2"
1101811018
resolved "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz"
1101911019
integrity sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==
1102011020
dependencies:
1102111021
minipass "^3.0.0"
1102211022
yallist "^4.0.0"
1102311023

11024+
minizlib@^3.1.0:
11025+
version "3.1.0"
11026+
resolved "https://registry.yarnpkg.com/minizlib/-/minizlib-3.1.0.tgz#6ad76c3a8f10227c9b51d1c9ac8e30b27f5a251c"
11027+
integrity sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==
11028+
dependencies:
11029+
minipass "^7.1.2"
11030+
1102411031
mkdirp@^0.5.6, mkdirp@~0.5.1:
1102511032
version "0.5.6"
1102611033
resolved "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz"
1102711034
integrity sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==
1102811035
dependencies:
1102911036
minimist "^1.2.6"
1103011037

11031-
mkdirp@^1.0.3, mkdirp@^1.0.4:
11038+
mkdirp@^1.0.4:
1103211039
version "1.0.4"
1103311040
resolved "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz"
1103411041
integrity sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==
@@ -14418,17 +14425,16 @@ tar-stream@^2.2.0:
1441814425
inherits "^2.0.3"
1441914426
readable-stream "^3.1.1"
1442014427

14421-
tar@^6.1.11, tar@^6.1.2:
14422-
version "6.2.1"
14423-
resolved "https://registry.yarnpkg.com/tar/-/tar-6.2.1.tgz#717549c541bc3c2af15751bea94b1dd068d4b03a"
14424-
integrity sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==
14425-
dependencies:
14426-
chownr "^2.0.0"
14427-
fs-minipass "^2.0.0"
14428-
minipass "^5.0.0"
14429-
minizlib "^2.1.1"
14430-
mkdirp "^1.0.3"
14431-
yallist "^4.0.0"
14428+
tar@^6.1.11, tar@^6.1.2, tar@^7.5.7:
14429+
version "7.5.7"
14430+
resolved "https://registry.yarnpkg.com/tar/-/tar-7.5.7.tgz#adf99774008ba1c89819f15dbd6019c630539405"
14431+
integrity sha512-fov56fJiRuThVFXD6o6/Q354S7pnWMJIVlDBYijsTNx6jKSE4pvrDTs6lUnmGvNyfJwFQQwWy3owKz1ucIhveQ==
14432+
dependencies:
14433+
"@isaacs/fs-minipass" "^4.0.0"
14434+
chownr "^3.0.0"
14435+
minipass "^7.1.2"
14436+
minizlib "^3.1.0"
14437+
yallist "^5.0.0"
1443214438

1443314439
tcp-port-used@^1.0.2:
1443414440
version "1.0.2"
@@ -15744,6 +15750,11 @@ yallist@^4.0.0:
1574415750
resolved "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz"
1574515751
integrity sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==
1574615752

15753+
yallist@^5.0.0:
15754+
version "5.0.0"
15755+
resolved "https://registry.yarnpkg.com/yallist/-/yallist-5.0.0.tgz#00e2de443639ed0d78fd87de0d27469fbcffb533"
15756+
integrity sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==
15757+
1574715758
yaml@^1.10.0, yaml@^1.10.2, yaml@^1.7.2:
1574815759
version "1.10.2"
1574915760
resolved "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz"

0 commit comments

Comments
 (0)