chore(deps): update dependency protobufjs to ^7.6.5 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
protobufjs	^7.6.2 → ^7.6.5

---

protobufjs : Schema-derived names can shadow runtime-significant properties

CVE-2026-54269 / GHSA-f38q-mgvj-vph7

More information

Details

Summary

protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall.

When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls in affected decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation.

Impact

An attacker who can provide or influence protobuf schemas or protobufjs JSON descriptors may be able to make affected message or service types unusable, resulting in denial of service for the affected processing path.

Applications using only trusted schemas are affected only if those schemas contain one of the problematic names and the application reaches the affected API path.

The issue is not known to allow code execution by itself.

Preconditions

• The application must use an affected protobufjs version.
• The application must load or use a schema or protobufjs JSON descriptor containing one of the problematic names:
  • a field named hasOwnProperty,
  • a field or oneof named $type through protobufjs JSON/reflection descriptor input,
  • or a service method whose generated helper name is rpcCall.
• The application must reach the affected API path for that name: required-field decode post-checks, verify, or toObject for hasOwnProperty; reflected message JSON serialization for $type; or protobufjs RPC service invocation for rpcCall.

Workarounds

Do not load protobuf schemas or protobufjs JSON descriptors from untrusted sources with affected versions. If untrusted schemas or descriptors must be accepted, validate schema-derived field, oneof, and service method names before loading and reject the problematic names described above.

Applications using trusted schemas can avoid the issue by renaming affected fields or service methods, or by avoiding the affected API path.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f38q-mgvj-vph7
• https://nvd.nist.gov/vuln/detail/CVE-2026-54269
• https://github.com/advisories/GHSA-f38q-mgvj-vph7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

protobufjs/protobuf.js (protobufjs)

v7.6.5: protobufjs: v7.6.5

Compare Source

Bug Fixes

• handle EOF during options parsing (#​2352) (#​2356) (10fba6d)

v7.6.4: protobufjs: v7.6.4

Compare Source

Bug Fixes

• Reconfigure and speed up CI (#​2329) (574f761)
• Remove inquire submodule (#​2327) (06ddd07)

v7.6.3: protobufjs: v7.6.3

Compare Source

Bug Fixes

• Avoid name collisions in generated code (#​2311) (78a9576)
• Preserve null conversion behavior for fieldless messages (#​2312) (df91652)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for brilliant-pasca-3e80ec canceled.

Name	Link
🔨 Latest commit	1fbffa5
🔍 Latest deploy log	https://app.netlify.com/projects/brilliant-pasca-3e80ec/deploys/6a5c07bd2fa3f00008dc52dd

[github-actions]

🚀 Performance Test Results

Test Configuration:

• VUs: 4
• Duration: 1m0s

Test Metrics:

• Requests/s: 43.88
• Iterations/s: 14.62
• Failed Requests: 0.00% (0 of 2641)

📜 Logs

> performance@1.0.0 run-tests:testenv /home/runner/work/rafiki/rafiki/test/performance
> ./scripts/run-tests.sh -e test -k -q --vus 4 --duration 1m

Cloud Nine GraphQL API is up: http://localhost:3101/graphql
Cloud Nine Wallet Address is up: http://localhost:3100/
Happy Life Bank Address is up: http://localhost:4100/
cloud-nine-wallet-test-backend already set
cloud-nine-wallet-test-auth already set
happy-life-bank-test-backend already set
happy-life-bank-test-auth already set
     data_received..................: 953 kB 16 kB/s
     data_sent......................: 2.0 MB 34 kB/s
     http_req_blocked...............: avg=7.85µs  min=2.02µs   med=5.35µs   max=889.28µs p(90)=6.57µs   p(95)=7.43µs  
     http_req_connecting............: avg=319ns   min=0s       med=0s       max=267.69µs p(90)=0s       p(95)=0s      
     http_req_duration..............: avg=90.53ms min=7.51ms   med=72.92ms  max=460.18ms p(90)=154.05ms p(95)=177.16ms
       { expected_response:true }...: avg=90.53ms min=7.51ms   med=72.92ms  max=460.18ms p(90)=154.05ms p(95)=177.16ms
     http_req_failed................: 0.00%  ✓ 0         ✗ 2641
     http_req_receiving.............: avg=88.76µs min=25.78µs  med=77.76µs  max=1.46ms   p(90)=118.18µs p(95)=148.28µs
     http_req_sending...............: avg=38.44µs min=9.47µs   med=24.09µs  max=2.72ms   p(90)=43.51µs  p(95)=63.7µs  
     http_req_tls_handshaking.......: avg=0s      min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=90.4ms  min=7.34ms   med=72.83ms  max=460.1ms  p(90)=153.97ms p(95)=177.05ms
     http_reqs......................: 2641   43.879219/s
     iteration_duration.............: avg=273.4ms min=188.32ms med=259.17ms max=962.75ms p(90)=338.44ms p(95)=370.68ms
     iterations.....................: 880    14.620868/s
     vus............................: 4      min=4       max=4 
     vus_max........................: 4      min=4       max=4