[Snyk] Upgrade firebase-admin from 11.3.0 to 11.6.0

[snyk-bot]

Snyk has created this PR to upgrade firebase-admin from 11.3.0 to 11.6.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 4 versions ahead of your current version.
• The recommended version was released 21 days ago, on 2023-04-06.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Improper Authentication SNYK-JS-JSONWEBTOKEN-3180022	534/1000 Why? Has a fix available, CVSS 6.4	No Known Exploit
	Improper Restriction of Security Token Assignment SNYK-JS-JSONWEBTOKEN-3180024	534/1000 Why? Has a fix available, CVSS 6.4	No Known Exploit
	Use of a Broken or Risky Cryptographic Algorithm SNYK-JS-JSONWEBTOKEN-3180026	534/1000 Why? Has a fix available, CVSS 6.4	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: firebase-admin

• 11.6.0 - 2023-04-06
  

  New Features

  • feat(auth): Add TOTP support in Project and Tenant config (#1989)

  Changed

  • Deprecate sendToDevice and sendToDeviceGroup and their response classes (#2090)

  Miscellaneous

  • [chore] Release 11.6.0 (#2139)
  • chore: update app check integration tests (#2140)
  • build(deps-dev): bump @ typescript-eslint/eslint-plugin (#2134)
  • build(deps-dev): bump @ firebase/auth-compat from 0.3.5 to 0.3.7 (#2133)
  • build(deps-dev): bump @ typescript-eslint/parser from 5.56.0 to 5.57.1 (#2135)
  • build(deps): bump @ google-cloud/storage from 6.9.4 to 6.9.5 (#2136)
  • build(deps-dev): bump sinon from 15.0.2 to 15.0.3 (#2126)
  • build(deps): bump @ firebase/database-compat from 0.3.1 to 0.3.4 (#2125)
  • build(deps): bump @ types/node from 18.15.5 to 18.15.10 (#2123)
  • build(deps-dev): bump eslint from 8.35.0 to 8.36.0 (#2124)
  • build(deps-dev): bump @ firebase/auth-compat from 0.3.1 to 0.3.5 (#2127)
  • build(deps-dev): bump sinon from 15.0.1 to 15.0.2 (#2120)
  • build(deps): bump @ google-cloud/storage from 6.9.3 to 6.9.4 (#2119)
  • build(deps-dev): bump @ firebase/app-compat from 0.2.3 to 0.2.5 (#2118)
  • build(deps-dev): bump @ typescript-eslint/eslint-plugin (#2121)
  • build(deps): bump @ types/node from 18.15.3 to 18.15.5 (#2117)
  • build(deps): bump @ firebase/database-types from 0.10.3 to 0.10.4 (#2101)
  • build(deps-dev): bump yargs from 17.6.0 to 17.7.1 (#2099)
  • build(deps-dev): bump @ typescript-eslint/parser from 5.48.2 to 5.56.0 (#2115)
  • build(deps): bump @ types/node from 18.14.2 to 18.15.3 (#2114)
  • build(deps): bump @ google-cloud/firestore from 6.4.3 to 6.5.0 (#2102)
  • build(deps): bump @ types/node from 18.13.0 to 18.14.2 (#2088)
  • build(deps-dev): bump @ types/uuid from 8.3.4 to 9.0.1 (#2086)
  • build(deps-dev): bump minimist from 1.2.7 to 1.2.8 (#2081)
  • build(deps-dev): bump @ typescript-eslint/eslint-plugin (#2087)
  • build(deps-dev): bump eslint from 8.33.0 to 8.35.0 (#2089)
  • Fixing links to externally defined RTDB APIs. (#2085)
  • build(deps): bump @ google-cloud/storage from 6.8.0 to 6.9.3 (#2082)
  • build(deps): bump @ google-cloud/firestore from 6.4.2 to 6.4.3 (#2079)
  • build(deps): bump @ google-cloud/firestore from 6.4.0 to 6.4.2 (#2074)
  • build(deps-dev): bump @ firebase/auth-types from 0.11.1 to 0.12.0 (#2072)
  • build(deps-dev): bump @ firebase/app-compat from 0.2.1 to 0.2.3 (#2071)
  • build(deps): bump @ firebase/database-types from 0.10.0 to 0.10.3 (#2073)
  • build(deps-dev): bump @ microsoft/api-extractor from 7.34.3 to 7.34.4 (#2070)
  • build(deps): bump @ types/node from 18.11.14 to 18.13.0 (#2067)
  • build(deps-dev): bump @ microsoft/api-extractor from 7.33.5 to 7.34.3 (#2064)
  • build(deps): bump @ fastify/busboy from 1.1.0 to 1.2.1 (#2066)
  • build(deps-dev): bump eslint from 8.31.0 to 8.33.0 (#2060)
  • build(deps): bump @ firebase/database-compat from 0.3.0 to 0.3.1 (#2059)
  • build(deps-dev): bump nock from 13.2.9 to 13.3.0 (#2058)
  • build(deps-dev): bump @ firebase/auth-compat from 0.2.24 to 0.3.1 (#2053)
  • build(deps-dev): bump @ firebase/app-compat from 0.1.37 to 0.2.1 (#2052)
• 11.5.0 - 2023-01-19
  Read more
• 11.4.1 - 2022-12-22
  

  Bug Fixes

  • fix: Update jsonwebtoken to v9.0.0 (#2025)

  Miscellaneous

  • [chore] Release 11.4.1 (#2026)
  • build(deps-dev): bump mocha from 10.1.0 to 10.2.0 (#2019)
  • build(deps-dev): bump @ typescript-eslint/parser from 5.42.1 to 5.47.0 (#2020)
  • build(deps-dev): bump @ typescript-eslint/eslint-plugin (#2018)
• 11.4.0 - 2022-12-15
  Read more
• 11.3.0 - 2022-11-17
  Read more

from firebase-admin GitHub release notes

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

[guardrails]

⚠️ We detected 12 security issues in this pull request:

Insecure File Management (1)

Severity	Details	Docs
High	Title: Path Traversal from user input Spot-the-Hole/functions/index.js Line 562 in 697b415 path.join(os.tmpdir(), path.basename(req.files.file[0].fieldname)),	📚

More info on how to fix Insecure File Management in JavaScript.

---

Vulnerable Libraries (10)

Severity	Details
High	[email protected] upgrade to: >=1.6.0
High	[email protected] (t) upgrade to: >2.28.4-alpha.1 || >3.5.2
High	[email protected] (t) upgrade to: >2.2.1
Critical	[email protected] (t) upgrade to: >1.2.5
Critical	pkg:npm/[email protected]@1.0.3 (t) - no patch available
Medium	pkg:npm/@tensorflow/[email protected]@2.6.7 (t) - no patch available
High	pkg:npm/[email protected]@0.3.1 (t) - no patch available
Medium	pkg:npm/[email protected]@1.2.3 (t) - no patch available
Medium	pkg:npm/@tensorflow/[email protected]@2.6.7 (t) - no patch available
High	pkg:npm/[email protected]@4.18.2 (t) - no patch available

More info on how to fix Vulnerable Libraries in JavaScript.

---

Insecure Use of Crypto (1)

Severity	Details	Docs
Medium	Title: Insecure use of random generator Spot-the-Hole/functions/index.js Line 204 in 697b415 result += characters.charAt(Math.floor(Math.random() * charactersLength));	📚

More info on how to fix Insecure Use of Crypto in JavaScript.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

[stale]

Automatically marked as stale due to lack of recent activity. Will be closed if no further activity occurs. Thank you for your contributions.

[stale]

Automatically closed due to lack of recent activity. Tag @aravindvnair99 to reopen. Thank you for your contributions.