protobufjs - npm Package Compare versions

Comparing version 6.11.2 to 6.11.3

package.json

 {
   "name": "protobufjs",
-  "version": "6.11.2",
+  "version": "6.11.3",
   "versionScheme": "~",
@@ -64,5 +64,5 @@ "description": "Protocol Buffers for JavaScript (& TypeScript).",
     "chalk": "^4.0.0",
-    "escodegen": "^2.0.0",
-    "eslint": "^7.0.0",
+    "escodegen": "^1.13.0",
     "espree": "^7.0.0",
+    "eslint": "^8.15.0",
     "estraverse": "^5.1.0",
@@ -69,0 +69,0 @@ "gh-pages": "^3.0.0",

src/util.js

@@ -179,2 +179,5 @@ "use strict";
         var part = path.shift();
+        if (part === "__proto__") {
+          return dst;
+        }
         if (path.length > 0) {
@@ -181,0 +184,0 @@ dst[part] = setProp(dst[part] || {}, path, value);

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Mixed license

License

(Experimental) Package contains multiple licenses.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 2 instances in 1 package

Mixed license

License

(Experimental) Package contains multiple licenses.

Found 1 instance in 1 package

Improved metrics

Number of low supply chain risk alerts

16

decreased by-50%

Worsened metrics

Total package byte prevSize

3250480

decreased by-45.65%

Number of package files

115

decreased by-62.66%

Lines of code

39396

decreased by-43.6%

No dependency changes