[Security] Bump protobufjs from 6.8.0 to 6.8.8

[dependabot-preview]

Bumps protobufjs from 6.8.0 to 6.8.8. This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects protobufjs
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.

Affected versions: >= 6.0.0 < 6.8.6

Sourced from The Node Security Working Group.

Denial of Service
protobufjs is vulnerable to ReDoS when parsing crafted invalid *.proto files

Affected versions: <=6.8.5

Release notes

Sourced from protobufjs's releases.

6.8.6

This is a security patch:

• Fixes typeRefRe used in the parser (1.X-6.8.5) being vulnerable to ReDoS as reported by James Davis. Relevant where a user is allowed to provide .proto sources for parsing. Applications using trusted .proto definitions, JSON descriptors or static code exclusively are not affected.

Changelog

Sourced from protobufjs's changelog.

6.8.8

Fixed

#️⃣ Persist recent index.d.ts changes in JSDoc

6.8.7

Fixed

#️⃣ Fix package browser field descriptor (#1046)

#️⃣ Fix static codegen issues with uglifyjs3

#️⃣ Fix lint issues / pbts on windows

#️⃣ Fix empty 'bytes' field decoding, now using Buffer where applicable (#1020)

#️⃣ Fix circular dependency of Namespace and Enum (#994)

#️⃣ Ignore optional commas in aggregate options (#999)

New

#️⃣ Make Message have a default type param (#1086)

#️⃣ Explicitly define service method names when generating static code, see #857

#️⃣ Also handle services in ext/descriptor (#1001)

CLI

#️⃣ Extend list of ignored ESLint rules for pbjs, fixes #1085

#️⃣ Fix declared return type of pbjs/pbts callback (#1025)

#️⃣ Added an option to pbts to allow custom imports (#1038)

#️⃣ Get node executable path from process.execPath (#1018)

Other

#️⃣ Slim down CI testing and remove some not ultimately necesssary dependencies with audit issues

#️⃣ Move global handling to util, see #995

6.8.6

Fixed

#️⃣ Fix typeRefRe being vulnerable to ReDoS

6.8.5

New

#️⃣ Preserve comments when serializing/deserializing with toJSON and fromJSON. (#983)

#️⃣ Add more details to some frequent error messages (#962)

#️⃣ Add IParseOptions#alternateCommentMode (#968)

#️⃣ Added field_mask to built-in common wrappers (#982)

Other

#️⃣ Remove code climate config in order to use 'in-app' config instead

6.8.4

Other

#️⃣ Update jsdoc dependency (pinned vulnerable marked)

... (truncated)

Commits

• 69623a9 Update changelog for 6.8.8
• 3001425 Fixed: Persist recent index.d.ts changes in JSDoc
• 182bb16 Update dist files and changelog for 6.8.7
• 2c5ef95 CLI: Extend list of ignored ESLint rules for pbjs, fixes #1085
• 36fc964 Make Message have a default type param (#1086)
• e8449c4 Fix package browser field descriptor (#1046)
• 8576b49 CLI: Fix declared return type of pbjs/pbts callback (#1025)
• 9fceaa6 CLI: Added an option to pbts to allow custom imports (#1038)
• 996b3fa Fix static codegen issues with uglifyjs3; New: Explicitly define service meth...
• b611875 Other: Slim down CI testing and remove some not ultimately necesssary depende...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Note: This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.

You can always request more updates by clicking Bump now in your Dependabot dashboard.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[dependabot-preview]

Superseded by #76.