chore(deps): update dependency protobufjs to v7.6.5 [security] - #9861
Merged
Conversation
backstage-goalie
Bot
added
dependencies
backstage-goalie
Bot
requested review from
a team,
djzager and
ibolton336
as code owners
July 21, 2026 01:40
backstage-goalie
Bot
added
the
dependencies
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates the workspaces/mta workspace to a newer protobufjs version and refreshes the Yarn lockfile accordingly.
Changes:
- Bump
protobufjsfrom7.6.3to7.6.5inworkspaces/mta/package.json - Update
workspaces/mta/yarn.lockfor the newprotobufjsresolution and dependency set
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| workspaces/mta/package.json | Updates the declared protobufjs dependency version |
| workspaces/mta/yarn.lock | Reflects the protobufjs upgrade and removes @protobufjs/inquire from protobufjs transitive deps |
Comment on lines
58
to
60
| "@asyncapi/protobuf-schema-parser": "3.4.0", | ||
| "protobufjs": "7.6.3", | ||
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" |
Comment on lines
+59
to
60
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" |
backstage-goalie
Bot
force-pushed
the
renovate/npm-protobufjs-vulnerability
branch
from
July 21, 2026 09:01
2ea130b to
60ea976
Compare
Comment on lines
+59
to
60
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" |
backstage-goalie
Bot
force-pushed
the
renovate/npm-protobufjs-vulnerability
branch
from
July 21, 2026 17:00
60ea976 to
ce52744
Compare
backstage-goalie
Bot
changed the title
backstage-goalie
Bot
force-pushed
the
renovate/npm-protobufjs-vulnerability
branch
from
July 21, 2026 17:52
ce52744 to
f03e62e
Compare
backstage-goalie
Bot
changed the title
Comment on lines
+59
to
60
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" |
backstage-goalie
Bot
force-pushed
the
renovate/npm-protobufjs-vulnerability
branch
from
July 21, 2026 18:54
f03e62e to
d540782
Compare
Comment on lines
+59
to
60
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" |
backstage-goalie
Bot
force-pushed
the
renovate/npm-protobufjs-vulnerability
branch
from
July 21, 2026 19:37
d540782 to
88aea57
Compare
Comment on lines
+59
to
60
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" |
backstage-goalie
Bot
force-pushed
the
renovate/npm-protobufjs-vulnerability
branch
from
July 21, 2026 20:35
88aea57 to
7f19805
Compare
Comment on lines
+59
to
60
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" |
backstage-goalie
Bot
force-pushed
the
renovate/npm-protobufjs-vulnerability
branch
from
July 22, 2026 13:41
6402d0d to
b249052
Compare
Comment on lines
+59
to
60
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" |
backstage-goalie
Bot
force-pushed
the
renovate/npm-protobufjs-vulnerability
branch
from
July 22, 2026 14:50
b249052 to
6fdc64f
Compare
Comment on lines
58
to
61
| "@asyncapi/protobuf-schema-parser": "3.4.0", | ||
| "protobufjs": "7.6.3", | ||
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" | ||
| }, |
backstage-goalie
Bot
force-pushed
the
renovate/npm-protobufjs-vulnerability
branch
from
July 22, 2026 16:53
6fdc64f to
7d5f3ed
Compare
Comment on lines
+59
to
60
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" |
backstage-goalie
Bot
force-pushed
the
renovate/npm-protobufjs-vulnerability
branch
from
July 22, 2026 20:32
7d5f3ed to
547c989
Compare
Comment on lines
56
to
61
| "@types/react": "^18", | ||
| "@types/react-dom": "^18", | ||
| "@asyncapi/protobuf-schema-parser": "3.4.0", | ||
| "protobufjs": "7.6.3", | ||
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" | ||
| }, |
backstage-goalie
Bot
force-pushed
the
renovate/npm-protobufjs-vulnerability
branch
from
July 22, 2026 22:29
547c989 to
b5a23f8
Compare
Comment on lines
+59
to
60
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" |
backstage-goalie
Bot
changed the title
backstage-goalie
Bot
changed the title
backstage-goalie
Bot
force-pushed
the
renovate/npm-protobufjs-vulnerability
branch
2 times, most recently
from
July 23, 2026 06:56
b5a23f8 to
0ca6120
Compare
Comment on lines
+59
to
60
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" |
backstage-goalie
Bot
force-pushed
the
renovate/npm-protobufjs-vulnerability
branch
from
July 23, 2026 08:45
0ca6120 to
d8df46c
Compare
Comment on lines
+59
to
60
| "protobufjs": "7.6.5", | ||
| "@protobufjs/inquire": "1.1.0" |
Collaborator
|
👋 Reminder: This Renovate patch/minor PR has been open for 7 days. Please review and merge if the changes look good. If no action is taken, this PR will be labeled |
Signed-off-by: Renovate Bot <bot@renovateapp.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.6.3→7.6.5Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
protobufjs: Denial of Service via infinite loop in .proto option parsing
CVE-2026-59877 / GHSA-j3f2-48v5-ccww
More information
Details
Summary
protobufjs parsed option names by advancing through schema tokens until it reached an
=token, without checking for end of input. A crafted.protoschema that opens an option declaration but ends prematurely could cause the option parser to loop without ever terminating.This affects the reflection parsing path (
parse,Root.load,Root.loadSync).Impact
An attacker who can provide or influence
.protoschema text parsed by an application may be able to cause the parsing call to never return. Because Node.js is single-threaded, the blocked event loop prevents all other work in the process, resulting in a denial of service that persists until the process is externally terminated.Applications that only encode or decode protobuf binary data with trusted schemas are not directly affected.
Preconditions
.protoschema text influenced by an attacker.parse,Root.load, orRoot.loadSync.=assignment.Workarounds
Do not parse
.protoschemas from untrusted sources with affected versions. If untrusted schema text must be accepted, isolate parsing in a process or worker that can be safely terminated and bound it with a timeout, so a non-returning parse call cannot deny service to the rest of the application.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
protobufjs/protobuf.js (protobufjs)
v7.6.5: protobufjs: v7.6.5Compare Source
Bug Fixes
v7.6.4: protobufjs: v7.6.4Compare Source
Bug Fixes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.