Skip to content

Commit 4313bd2

Browse files
fix(security): upgrade protobufjs to 7.5.5 to fix critical CVE (calcom#28941)
Pins protobufjs to 7.5.5 via resolutions to patch GHSA-xq3m-2v4x-88gg (arbitrary code execution, <7.5.5). The vulnerable 7.4.0 was pulled in transitively through @opentelemetry/otlp-transformer, causing the Security Audit CI job to fail on all PRs.
1 parent 9efd0e6 commit 4313bd2

2 files changed

Lines changed: 5 additions & 4 deletions

File tree

package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,7 @@
145145
"form-data": "4.0.4",
146146
"axios": "1.15.0",
147147
"follow-redirects": "1.16.0",
148+
"protobufjs": "7.5.5",
148149
"jws": "4.0.1",
149150
"jsonwebtoken": "9.0.0",
150151
"sha.js": "2.4.12",

yarn.lock

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34681,9 +34681,9 @@ __metadata:
3468134681
languageName: node
3468234682
linkType: hard
3468334683

34684-
"protobufjs@npm:^7.2.5, protobufjs@npm:^7.3.0":
34685-
version: 7.4.0
34686-
resolution: "protobufjs@npm:7.4.0"
34684+
"protobufjs@npm:7.5.5":
34685+
version: 7.5.5
34686+
resolution: "protobufjs@npm:7.5.5"
3468734687
dependencies:
3468834688
"@protobufjs/aspromise": "npm:^1.1.2"
3468934689
"@protobufjs/base64": "npm:^1.1.2"
@@ -34697,7 +34697,7 @@ __metadata:
3469734697
"@protobufjs/utf8": "npm:^1.1.0"
3469834698
"@types/node": "npm:>=13.7.0"
3469934699
long: "npm:^5.0.0"
34700-
checksum: 10/408423506610f70858d7593632f4a6aa4f05796c90fd632be9b9252457c795acc71aa6d3b54bb7f48a890141728fee4ca3906723ccea6c202ad71f21b3879b8b
34700+
checksum: 10/048898023a38d22f5fc9a1bcf0dcce5cfbcd37fb00753bd72283720eee7e2cb6055b23957542e5bcdc136379af66203a2ddb8d8c39d11f73169bacf07885fedd
3470134701
languageName: node
3470234702
linkType: hard
3470334703

0 commit comments

Comments
 (0)