From fcd75d12b3dcaf373b07765815a13c3bbf323eb5 Mon Sep 17 00:00:00 2001 From: Erik Schultink Date: Wed, 23 Sep 2026 11:09:22 -0700 Subject: [PATCH] Bump protobufjs from 7.6.4 to 7.6.6 (CVE-2026-59877) Raise the override floor so a truncated .proto option cannot hang the parser. Co-authored-by: Cursor --- package-lock.json | 6 +++--- package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 562aa41..ab8c573 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1857,9 +1857,9 @@ } }, "node_modules/protobufjs": { - "version": "7.6.4", - "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.4.tgz", - "integrity": "sha512-RJJPTTpvFfHcWLkIa2JFWK4XvtSzS0yEWDmunqHXli1h3JlkbcQZXDZdcWxv+JK3Xsl5/UFDPZ0iGm7DAengYw==", + "version": "7.6.6", + "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.6.tgz", + "integrity": "sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg==", "hasInstallScript": true, "license": "BSD-3-Clause", "dependencies": { diff --git a/package.json b/package.json index ac0bf82..2d4dd56 100644 --- a/package.json +++ b/package.json @@ -28,6 +28,6 @@ "vitest": "^4.1.11" }, "overrides": { - "protobufjs": "^7.6.2" + "protobufjs": "^7.6.6" } }