⬆️ Bump protobufjs from 6.8.0 to 6.8.8

[dependabot]

Bumps protobufjs from 6.8.0 to 6.8.8.

Release notes

Sourced from protobufjs's releases.

6.8.6

This is a security patch:

• Fixes typeRefRe used in the parser (1.X-6.8.5) being vulnerable to ReDoS as reported by James Davis. Relevant where a user is allowed to provide .proto sources for parsing. Applications using trusted .proto definitions, JSON descriptors or static code exclusively are not affected.

Changelog

Sourced from protobufjs's changelog.

6.8.8

Fixed

#️⃣ Persist recent index.d.ts changes in JSDoc

6.8.7

Fixed

#️⃣ Fix package browser field descriptor (#1046)

#️⃣ Fix static codegen issues with uglifyjs3

#️⃣ Fix lint issues / pbts on windows

#️⃣ Fix empty 'bytes' field decoding, now using Buffer where applicable (#1020)

#️⃣ Fix circular dependency of Namespace and Enum (#994)

#️⃣ Ignore optional commas in aggregate options (#999)

New

#️⃣ Make Message have a default type param (#1086)

#️⃣ Explicitly define service method names when generating static code, see #857

#️⃣ Also handle services in ext/descriptor (#1001)

CLI

#️⃣ Extend list of ignored ESLint rules for pbjs, fixes #1085

#️⃣ Fix declared return type of pbjs/pbts callback (#1025)

#️⃣ Added an option to pbts to allow custom imports (#1038)

#️⃣ Get node executable path from process.execPath (#1018)

Other

#️⃣ Slim down CI testing and remove some not ultimately necesssary dependencies with audit issues

#️⃣ Move global handling to util, see #995

6.8.6

Fixed

#️⃣ Fix typeRefRe being vulnerable to ReDoS

6.8.5

New

#️⃣ Preserve comments when serializing/deserializing with toJSON and fromJSON. (#983)

#️⃣ Add more details to some frequent error messages (#962)

#️⃣ Add IParseOptions#alternateCommentMode (#968)

#️⃣ Added field_mask to built-in common wrappers (#982)

Other

#️⃣ Remove code climate config in order to use 'in-app' config instead

6.8.4

Other

#️⃣ Update jsdoc dependency (pinned vulnerable marked)

... (truncated)

Commits

• 69623a9 Update changelog for 6.8.8
• 3001425 Fixed: Persist recent index.d.ts changes in JSDoc
• 182bb16 Update dist files and changelog for 6.8.7
• 2c5ef95 CLI: Extend list of ignored ESLint rules for pbjs, fixes #1085
• 36fc964 Make Message<T> have a default type param (#1086)
• e8449c4 Fix package browser field descriptor (#1046)
• 8576b49 CLI: Fix declared return type of pbjs/pbts callback (#1025)
• 9fceaa6 CLI: Added an option to pbts to allow custom imports (#1038)
• 996b3fa Fix static codegen issues with uglifyjs3; New: Explicitly define service meth...
• b611875 Other: Slim down CI testing and remove some not ultimately necesssary depende...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Superseded by #88.