Bump protobufjs from 4.1.3 to 6.8.8

[dependabot]

Bumps protobufjs from 4.1.3 to 6.8.8.

Release notes

Sourced from protobufjs's releases.

6.8.6

This is a security patch:

• Fixes typeRefRe used in the parser (1.X-6.8.5) being vulnerable to ReDoS as reported by James Davis. Relevant where a user is allowed to provide .proto sources for parsing. Applications using trusted .proto definitions, JSON descriptors or static code exclusively are not affected.

protobuf.js 6.8.0

Experimental decorators, a lot of general fixes and an overhaul of typings generated by pbts.

Changelog

protobuf.js 6.7.0

General API cleanup and a lot of fixes, improved spec compliance, static code, typings and documentation.

Changelog

protobuf.js 6.6.0

• Builds are now named full, light (was noparse) and minimal (was runtime), each now with full browserify support
• (Streaming) services work exactly the same with reflection and static code now
• Major reflection performance pass

All details: CHANGELOG

protobuf.js 6.5.0

• Converters are first class codegen citizens now (includes a default toJSON implementation)
• Encodes everything explicitly set on the wire for compatibility with official (c++/java) libraries
• Added protoc-gen-doc-like .proto documentation support that translates to generated static code
• Lots of improvements to generated static code style
• Various fixes and improvements

Breaking:

• asJSON is now toObject
• Removed now unused utility: arrayNe, longNe

All details: CHANGELOG

protobuf.js 6.4.0

• Dropped IE8 support
• Better TypeScript definitions
• Static codegen now has asJSON/from
• pbjs and pbts now support data from stdin
• Micro modules now also have TypeScript definitions

All details: CHANGELOG

protobuf.js 6.0.0

• New API with a flat module structure
• Lightning fast through code generation
• Exhaustive browser support
• No more null values
• Default values on prototypes (i.e. checking if present on the wire through .hasOwnProperty)

... (truncated)

Changelog

Sourced from protobufjs's changelog.

6.8.8

Fixed

#️⃣ Persist recent index.d.ts changes in JSDoc

6.8.7

Fixed

#️⃣ Fix package browser field descriptor (#1046)

#️⃣ Fix static codegen issues with uglifyjs3

#️⃣ Fix lint issues / pbts on windows

#️⃣ Fix empty 'bytes' field decoding, now using Buffer where applicable (#1020)

#️⃣ Fix circular dependency of Namespace and Enum (#994)

#️⃣ Ignore optional commas in aggregate options (#999)

New

#️⃣ Make Message have a default type param (#1086)

#️⃣ Explicitly define service method names when generating static code, see #857

#️⃣ Also handle services in ext/descriptor (#1001)

CLI

#️⃣ Extend list of ignored ESLint rules for pbjs, fixes #1085

#️⃣ Fix declared return type of pbjs/pbts callback (#1025)

#️⃣ Added an option to pbts to allow custom imports (#1038)

#️⃣ Get node executable path from process.execPath (#1018)

Other

#️⃣ Slim down CI testing and remove some not ultimately necesssary dependencies with audit issues

#️⃣ Move global handling to util, see #995

6.8.6

Fixed

#️⃣ Fix typeRefRe being vulnerable to ReDoS

6.8.5

New

#️⃣ Preserve comments when serializing/deserializing with toJSON and fromJSON. (#983)

#️⃣ Add more details to some frequent error messages (#962)

#️⃣ Add IParseOptions#alternateCommentMode (#968)

#️⃣ Added field_mask to built-in common wrappers (#982)

Other

#️⃣ Remove code climate config in order to use 'in-app' config instead

6.8.4

Other

#️⃣ Update jsdoc dependency (pinned vulnerable marked)

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.