Skip to content

Conversation

DellaBitta
Copy link
Contributor

@DellaBitta DellaBitta commented Jan 27, 2025

Discussion

The auto generated PR #8606 attempts to patch the yarn.lock file for a dependency associated with CVE-2024-37168 that was pulled in by the Google Cloud CLI.

Instead of only patching the yarn.lock file to update the transitive culprit @grpc/grpc-js@~1.9.0, let's just update the dependency that we use - the Firebase CLI tools.

Testing

Local build, CI.
This is a dev dependency update.

API Changes

NA

Copy link

changeset-bot bot commented Jan 27, 2025

⚠️ No Changeset found

Latest commit: 76d253b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@google-oss-bot
Copy link
Contributor

@DellaBitta DellaBitta marked this pull request as ready for review January 27, 2025 19:38
@DellaBitta DellaBitta requested a review from a team as a code owner January 27, 2025 19:38
@google-oss-bot
Copy link
Contributor

@DellaBitta DellaBitta merged commit 99766e0 into main Jan 27, 2025
49 checks passed
@DellaBitta DellaBitta deleted the ddb-fbtools-dep-update branch January 27, 2025 20:49
@firebase firebase locked and limited conversation to collaborators Feb 27, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants