fix(deps): remediate security vulnerabilities

[phillipleblanc]

Security: dependency vulnerability remediation

Automated dependency remediation for spicehq/spice-cloud-deploy-action, addressing open Dependabot security alerts.

Fixes pin each affected package via overrides/resolutions (forces direct + transitive resolution) and bump declared ranges for direct deps. Lockfiles refreshed; CI validates.

(repo root) (npm)

Package	Fixed version	Severity	CVSS	SLA deadline	Advisories	Alerts
protobufjs	7.5.8	MEDIUM	5.3	2026-07-28	CVE-2026-45740	#1

---

Automated mechanical dependency-security update.

[Copilot]

Pull request overview

Remediates a Vanta-tracked security vulnerability by forcing a safe protobufjs version across the dependency graph for the spice-cloud-deploy-action npm package, with lockfile updates to reflect the resolved version.

Changes:

• Adds an npm overrides pin for protobufjs to 7.5.8.
• Refreshes package-lock.json to resolve protobufjs to 7.5.8 (and updates the package version metadata in the lockfile accordingly).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adds an overrides entry to pin protobufjs to the remediated version.
package-lock.json	Updates the resolved protobufjs package to 7.5.8 and refreshes lock metadata.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.