From 4313bd2dc5322b22ed222372bb0aa3e2a246d7a4 Mon Sep 17 00:00:00 2001
From: Sahitya Chandra <sahityajb@gmail.com>
Date: Mon, 20 Apr 2026 21:52:52 +0530
Subject: [PATCH] fix(security): upgrade protobufjs to 7.5.5 to fix critical
 CVE (#28941)

Pins protobufjs to 7.5.5 via resolutions to patch GHSA-xq3m-2v4x-88gg
(arbitrary code execution, <7.5.5). The vulnerable 7.4.0 was pulled in
transitively through @opentelemetry/otlp-transformer, causing the
Security Audit CI job to fail on all PRs.
---
 package.json | 1 +
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 5d4f98066e..746985df39 100644
--- a/package.json
+++ b/package.json
@@ -145,6 +145,7 @@
     "form-data": "4.0.4",
     "axios": "1.15.0",
     "follow-redirects": "1.16.0",
+    "protobufjs": "7.5.5",
     "jws": "4.0.1",
     "jsonwebtoken": "9.0.0",
     "sha.js": "2.4.12",
diff --git a/yarn.lock b/yarn.lock
index 9d74108805..9e32fd238b 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -34681,9 +34681,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"protobufjs@npm:^7.2.5, protobufjs@npm:^7.3.0":
-  version: 7.4.0
-  resolution: "protobufjs@npm:7.4.0"
+"protobufjs@npm:7.5.5":
+  version: 7.5.5
+  resolution: "protobufjs@npm:7.5.5"
   dependencies:
     "@protobufjs/aspromise": "npm:^1.1.2"
     "@protobufjs/base64": "npm:^1.1.2"
@@ -34697,7 +34697,7 @@ __metadata:
     "@protobufjs/utf8": "npm:^1.1.0"
     "@types/node": "npm:>=13.7.0"
     long: "npm:^5.0.0"
-  checksum: 10/408423506610f70858d7593632f4a6aa4f05796c90fd632be9b9252457c795acc71aa6d3b54bb7f48a890141728fee4ca3906723ccea6c202ad71f21b3879b8b
+  checksum: 10/048898023a38d22f5fc9a1bcf0dcce5cfbcd37fb00753bd72283720eee7e2cb6055b23957542e5bcdc136379af66203a2ddb8d8c39d11f73169bacf07885fedd
   languageName: node
   linkType: hard