[Snyk] Fix for 8 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	539/1000 Why? Has a fix available, CVSS 6.5	Improper Restriction of Security Token Assignment SNYK-JS-JSONWEBTOKEN-3180024	Yes	No Known Exploit
	554/1000 Why? Has a fix available, CVSS 6.8	Use of a Broken or Risky Cryptographic Algorithm SNYK-JS-JSONWEBTOKEN-3180026	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	Yes	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	Yes	No Known Exploit
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-NODEFORGE-598677	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @google-cloud/firestore

The new version differs by 66 commits.

• 7c3bdaa Preparing 0.12.0 release (Removing unused dependency firebase/firebase-admin-node#145)
• ef2730d Allowing empty merge calls (ThenableReference returning PromiseLike - should be Promise? firebase/firebase-admin-node#144)
• f23c167 Adding isEqual to the public API (Adding the RTDB typings back firebase/firebase-admin-node#140)
• 25067bb chore: removing node7 job from CircleCI (Implemented IID Delete API firebase/firebase-admin-node#142)
• 35c1af0 100% Test coverage and misc cleanup (Upgraded Firestore dependency to 0.10.0 firebase/firebase-admin-node#139)
• 463fbfc Rejecting custom types from the API surface (admin.intializeApp returns Raw server response firebase/firebase-admin-node#137)
• 843a5d1 Test refactor (Type names not found firebase/firebase-admin-node#138)
• a620ada Accept strings in where(FieldPath.documentId(), ...) (Wrong "typings" key in package.json after monorepo refactor. firebase/firebase-admin-node#136)
• 59f738a Updating Conformance Tests (Firestore cursor methods not working with document snapshots firebase/firebase-admin-node#135)
• 0d71ae5 chore(package): update @ types/node to version 9.4.5 (Fix Database Statistics Reporting firebase/firebase-admin-node#134)
• c9f4146 Updating variable name for Transactions reads (Bumped version to 5.5.0 firebase/firebase-admin-node#133)
• 8788cb5 Update eslint-plugin-node to the latest version 🚀 (FR: Add util function "encodeAsFirebaseKey" firebase/firebase-admin-node#126)
• b81c45d Update @ google-cloud/common to the latest version 🚀 (missing kid in createCustomToken token header firebase/firebase-admin-node#128)
• d66d66e Adding Transactions.getAll() (Events called synchronously after write operation firebase/firebase-admin-node#125)
• a4c5508 Update google-proto-files to the latest version 🚀 (Removed skrinkwrap File firebase/firebase-admin-node#124)
• 51e076e Exporting all API types (Adding Firestore.setLogFunction() to the typings firebase/firebase-admin-node#123)
• a16c3eb Preparing 0.11.2 release (npm update firebase-admin fails with ENOENT: no such file or directory, rename firebase/firebase-admin-node#121)
• a175370 chore: run circle as non-root user (The email address is already in use by another account firebase/firebase-admin-node#120)
• f8e1d23 Including previous data when we encounter a transform (Firestore Realtime listener drops a connection and does not reconnect firebase/firebase-admin-node#119)
• 0f7a975 Adding Query Conformance Tests (NodeJS crashes while running in cloud due to --> Error: Failed to import the Cloud Storage client library for Node.js. firebase/firebase-admin-node#118)
• f2cccfe Using the GRPC dependency as exposed from google-gax (self signed certificate in certificate chain error firebase/firebase-admin-node#115)
• 19c3a15 Allow newlines in Resource Paths (Upgraded @types/request to latest and removed deprecated typings firebase/firebase-admin-node#114)
• 5be8477 Update dependencies (5.4 regression firebase/firebase-admin-node#113)
• 6ac1947 Updating System Test to use the new error message (Importing RTDB code via @firebase/database firebase/firebase-admin-node#112)

See the full diff

Package name: jsonwebtoken

The new version differs by 154 commits.

• e1fa9dc Merge pull request from GHSA-8cf7-32gw-wr33
• 5eaedbf chore(ci): remove github test actions job ([chore] Release 8.11.0 firebase/firebase-admin-node#861)
• cd4163e chore(ci): configure Github Actions jobs for Tests & Security Scanning (Too much contention on these documents firebase/firebase-admin-node#856)
• ecdf6cc fix!: Prevent accidental use of insecure key sizes & misconfiguration of secrets (fix(auth): Defines missing DecodedIdToken types. firebase/firebase-admin-node#852)
• 8345030 fix(sign&verify)!: Remove default `none` support from `sign` and `verify` methods, and require it to be explicitly configured (Ml merge firebase/firebase-admin-node#851)
• 7e6a86b Upload OpsLevel YAML (cannot deploy to firebase due to sharp.node firebase/firebase-admin-node#849)
• 74d5719 docs: update references vercel/ms references (feat(auth): Add ability to link a federated ID with the updateUser() method. firebase/firebase-admin-node#770)
• d71e383 docs: document "invalid token" error
• 3765003 docs: fix spelling in README.md: Peak -> Peek (Setting up a CI pipeline based on GitHub Actions firebase/firebase-admin-node#754)
• a46097e docs: make decode impossible to discover before verify
• 15a1bc4 refactor: make decode non-enumerable
• 5f10bf9 docs: add jwtid to options of jwt.verify (⚠ Error: Cannot find module 'firebase-admin' firebase/firebase-admin-node#704)
• 88cb9df Replace tilde-indexOf with includes ([FR] add support for reusing firebase-tools credentials firebase/firebase-admin-node#647)
• a6235fa Adds not to README on decoded payload validation (How can I logout a user firebase/firebase-admin-node#646)
• 5ed1f06 docs: fix tiny style change in readme (Implemented the listRulesetMetadata() API firebase/firebase-admin-node#622)
• 9fb90ca style: add missing semicolon (Bumped version to 8.5.0 firebase/firebase-admin-node#641)
• a9e38b8 ci: use circleci (add environment variable to point admin sdk at rtdb emulator firebase/firebase-admin-node#589)
• 7f1f8b4 8.5.1
• e5874ae fix: ensure correct PS signing and verification (onSnapshot exceeds retries? firebase/firebase-admin-node#585)
• 84e03ef README: fix markdown for algorithms table
• 1c0de55 8.5.0
• eefb9d9 feat: add PS JWA support for applicable node versions (Fix type defs for Credential interface firebase/firebase-admin-node#573)
• 8737789 Add complete option in jwt.verify (ServiceAccount interface definition errors firebase/firebase-admin-node#522)
• 7b60c12 Force use_strict during testing (Enforce UserImportOptions when importing users with passwords firebase/firebase-admin-node#577)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note:You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Use of a Broken or Risky Cryptographic Algorithm
🦉 Open Redirect
🦉 Prototype Pollution