chore(deps): update dependency protobufjs to v7.5.8 (main)

[mend-for-github-com]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
protobufjs	7.4.0 → 7.5.8
protobufjs	7.5.3 → 7.6.5

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability	Reachability
Critical	9.9	CVE-2026-41242	Unreachable
High	8.8	CVE-2026-44293	Unreachable
High	8.1	CVE-2026-44291	Unreachable
High	7.5	CVE-2026-44289	Unreachable
High	7.5	CVE-2026-44290	Unreachable
Medium	5.3	CVE-2026-44288	Unreachable
Medium	5.3	CVE-2026-44292	Unreachable
Medium	5.3	CVE-2026-44294	Unreachable
Medium	5.3	CVE-2026-45740	Unreachable

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability	Reachability
Critical	9.9	CVE-2026-41242	Unreachable
High	8.8	CVE-2026-44293	Unreachable
High	8.1	CVE-2026-44291	Unreachable
High	7.5	CVE-2026-44289	Unreachable
High	7.5	CVE-2026-44290	Unreachable
Medium	5.3	CVE-2026-44288	Unreachable
Medium	5.3	CVE-2026-44292	Unreachable
Medium	5.3	CVE-2026-44294	Unreachable
Medium	5.3	CVE-2026-45740	Unreachable
Medium	5.3	CVE-2026-59877	Unreachable

---

Release Notes

protobufjs/protobuf.js (protobufjs)

v7.5.8: protobufjs: v7.5.8

Compare Source

Bug Fixes

• Backport parser hardening to 7.x (#​2245) (54b593f)

v7.5.7: protobufjs: v7.5.7

Compare Source

Bug Fixes

• Restore first-match namespace lookup (#​2236) (cc7d595)

v7.5.6: protobufjs: v7.5.6

Compare Source

Bug Fixes

• Backport input hardening and CLI fixes to 7.x (#​2173) (75392ea)

v7.5.5: v7.5.5

Compare Source

v7.5.5

This release backports two reported security issues to 7.x branch.

• fix: do not allow setting __proto__ in Message constructor (#​2126)
• fix: filter invalid characters from the type name (#​2127)

Full Changelog: protobufjs/protobuf.js@protobufjs-v7.5.4...protobufjs-v7.5.5

v7.5.4

Compare Source

Bug Fixes

• invalid syntax in descriptor.proto (#​2092) (5a3769a)

v7.5.3

Compare Source

Bug Fixes

• descriptor extensions handling post-editions (#​2075) (6e255d4)

v7.5.2

Compare Source

Bug Fixes

• ensure that types are always resolved (#​2068) (4b51cb2)

v7.5.1

Compare Source

Bug Fixes

• optimize regressions from editions implementations (#​2066) (6406d4c)
• reserved field inside group blocks fail parsing (#​2058) (56782bf)

v7.5.0

Compare Source

Features

• add Edition 2023 Support (f04ded3)
• add Edition 2023 Support (ac9a3b9)
• add Edition 2023 Support (e5ca5c8)
• add Edition 2023 Support (a84409b)
• add Edition 2023 Support (9c5a178)
• add Edition 2023 Support (b2c6867)
• add Edition 2023 Support (60f3e51)
• add Edition 2023 Support (a656361)
• add Edition 2023 Support (869a95b)
• add Edition 2023 Support (b936af4)
• add Edition 2023 Support (a938467)
• add Edition 2023 Support (1af8454)
• add Edition 2023 Support (785416f)
• add feature resolution (a9ffc8a)
• add feature resolution and tests (68b5339)
• add feature resolution for protobuf editions (547afa2)
• add feature resolution for protobuf editions (65d3ed1)
• api_converters_editions tests added and run successfully" (b4b5ca4)
• increase size of file that protobufjs CLI can process (00d5f1a)
• increase size of file that protobufjs CLI can process (d36ef0f)

Bug Fixes

• change tree traversal order and feature resolution algorithm (d2d47d9)
• remove eval usage so that chrome extension MV3 can run properly (#​1941) (f2ccb99)

---

• If you want to rebase/retry this PR, check this box