fix(security/high/): update security protobufjs to v7.6.3 [security] - abandoned

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
protobufjs	7.5.8 → 7.6.3

---

protobufjs: Denial of service through unbounded Any expansion during JSON conversion

CVE-2026-48712 / GHSA-wcpc-wj8m-hjx6

More information

Details

Summary

protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path.

A crafted protobuf binary payload containing deeply nested Any values could cause the JavaScript call stack to be exhausted during conversion to JSON.

Impact

An attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause message conversion to fail with a stack overflow.

This affects applications that decode untrusted protobuf input containing google.protobuf.Any values and then convert decoded messages to JSON or plain objects with JSON conversion enabled, for example through JSON.stringify(message), Message#toJSON(), or Type.toObject(message, { json: true }).

Applications that only decode and re-encode protobuf binary data without converting decoded messages to JSON are not directly affected by this issue.

Preconditions

• The application must decode protobuf binary data influenced by an attacker.
• The application schema must include google.protobuf.Any, and the referenced type_url must resolve to a message type in the loaded protobuf root.
• The application must convert the decoded message to JSON or a plain object through an affected conversion path.
• The crafted input must contain deeply nested Any values that are expanded during conversion.

Workarounds

Avoid converting untrusted protobuf messages containing google.protobuf.Any values to JSON with affected versions. If immediate upgrade is not possible, reject or limit messages with deeply nested Any payloads at an outer protocol boundary where feasible, avoid JSON conversion of untrusted Any values, or isolate message conversion in a process that can be safely restarted.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6
• https://github.com/protobufjs/protobuf.js

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

protobufjs : Schema-derived names can shadow runtime-significant properties

CVE-2026-54269 / GHSA-f38q-mgvj-vph7

More information

Details

Summary

protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall.

When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls in affected decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation.

Impact

An attacker who can provide or influence protobuf schemas or protobufjs JSON descriptors may be able to make affected message or service types unusable, resulting in denial of service for the affected processing path.

Applications using only trusted schemas are affected only if those schemas contain one of the problematic names and the application reaches the affected API path.

The issue is not known to allow code execution by itself.

Preconditions

• The application must use an affected protobufjs version.
• The application must load or use a schema or protobufjs JSON descriptor containing one of the problematic names:
  • a field named hasOwnProperty,
  • a field or oneof named $type through protobufjs JSON/reflection descriptor input,
  • or a service method whose generated helper name is rpcCall.
• The application must reach the affected API path for that name: required-field decode post-checks, verify, or toObject for hasOwnProperty; reflected message JSON serialization for $type; or protobufjs RPC service invocation for rpcCall.

Workarounds

Do not load protobuf schemas or protobufjs JSON descriptors from untrusted sources with affected versions. If untrusted schemas or descriptors must be accepted, validate schema-derived field, oneof, and service method names before loading and reject the problematic names described above.

Applications using trusted schemas can avoid the issue by renaming affected fields or service methods, or by avoiding the affected API path.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f38q-mgvj-vph7
• https://github.com/protobufjs/protobuf.js

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

protobufjs/protobuf.js (protobufjs)

v7.6.3: protobufjs: v7.6.3

Compare Source

Bug Fixes

• Avoid name collisions in generated code (#​2311) (78a9576)
• Preserve null conversion behavior for fieldless messages (#​2312) (df91652)

v7.6.2: protobufjs: v7.6.2

Compare Source

Bug Fixes

• Backport consistency and correctness fixes (#​2294) (a92f72e)

v7.6.1: protobufjs: v7.6.1

Compare Source

Bug Fixes

• Backport misc utility hardening (#​2280) (8a45c13)
• Treat fixed64 as unsigned in converters (#​2266) (479dfdc)

v7.6.0: protobufjs: v7.6.0

Compare Source

Features

• Support BigInt conversions (7.x) (#​2258) (f769242)

v7.5.9: protobufjs: v7.5.9

Compare Source

Bug Fixes

• Backport bundler-safe optional module lookups (#​2254) (0853a62)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[renovate-sh-app]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

? Verifying lockfile against supply-chain policies (1369 entries)...
✓ Lockfile passes supply-chain policies (1369 entries in 17.3s)
[ERR_PNPM_LOCKFILE_CONFIG_MISMATCH] Cannot proceed with the frozen installation. The current "overrides" configuration doesn't match the value found in the lockfile

Update your lockfile using "pnpm install --no-frozen-lockfile"

[github-actions]

⚠️ The workflow jobs listed below don't declare a permissions: block and may break when the organization's default GITHUB_TOKEN permissions are restricted to read-only.

Expand for findings

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/conventional-commits.yml:12:3
   |
12 | /   check-title:
13 | |     runs-on: ubuntu-latest
14 | |     steps:
15 | |       - uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3
...  |
30 | |         env:
31 | |           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   | |                                                    ^
   | |                                                    |
   | |____________________________________________________this job
   |                                                      default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

[renovate-sh-app]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[renovate-sh-app]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.