mirror of
https://github.com/Kong/insomnia.git
synced 2026-11-05 04:23:55 -05:00
5c14ddfa81
* chore: update google-protobuf to 4.0.3 (INS-3888) google-protobuf <4.0.3 has no depth limit when skipping unknown group fields during binary deserialization, so a crafted payload of nested START_GROUP tags overflows the call stack (AIKIDO-2026-834673). It is only a transitive dependency (grpc-reflection-js at runtime, @ravanallc/grpc-server-reflection in the smoke tests) and both declare a ^3.x range, so force 4.0.3 through root overrides. npm does not apply the global override to the @ravanallc edge, hence the scoped override. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * chore: replace @ravanallc/grpc-server-reflection with @grpc/reflection (INS-3888) @ravanallc/grpc-server-reflection is unmaintained (last release 2022) and depends on google-protobuf ^3, which forced a scoped override to 4.0.3 for the unknown-group recursion DoS fix. The official @grpc/reflection uses protobufjs and does not depend on google-protobuf. The smoke test server already loads the proto through @grpc/proto-loader, so it builds the reflection service from that package definition and the pre-built route_guide.bin fixture is no longer needed. The scoped override is removed. Only the runtime grpc-reflection-js fork still needs the global google-protobuf override. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * chore: update grpc-reflection-js to 0.4.0 and drop google-protobuf override (INS-3888) grpc-reflection-js 0.4.0 depends on google-protobuf ^4.0.3, which contains the fix for the unknown-group recursion DoS. The global google-protobuf override is no longer needed, so remove it and refresh the lockfile to the new fork commit. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> --------- Co-authored-by: yaoweiprc <6896642+yaoweiprc@users.noreply.github.com> Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>