security vulnerability in @google-cloud/[email protected]

[hernancondoriipsy]

Bug description

Currently [email protected] is a dependency of @google-cloud/[email protected]

https://security.snyk.io/vuln/SNYK-JS-PROTOBUFJS-5756498

Is there any plan to update to @google-cloud/logging@11?

Describe what you expected

No response

Steps to reproduce the issue

No response

Additional context

No response

Command

None

[Drarig29]

Released in v2.24.1

[Drarig29]

@hernancondoriipsy FYI, the [email protected] is not affected by this vulnerability: >=6.10.0 <6.11.4 >=7.2.0 <7.2.4

So @google-cloud/[email protected] was actually not vulnerable.

[hernancondoriipsy]

@hernancondoriipsy FYI, the [email protected] is not affected by this vulnerability: >=6.10.0 <6.11.4 >=7.2.0 <7.2.4

So @google-cloud/[email protected] was actually not vulnerable.

Is weird, because in the link to CVE we see this "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution