chore(deps): update dependency protobufjs to v7.6.5 (main)

[mend-for-github-com]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
protobufjs	7.5.3 → 7.6.5
protobufjs	7.4.0 → 7.5.8
protobufjs	7.5.3 → 7.6.6

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability	Reachability
Critical	9.9	CVE-2026-41242	Unreachable
High	8.8	CVE-2026-44293	Unreachable
High	8.1	CVE-2026-44291	Unreachable
High	7.5	CVE-2026-44289	Unreachable
High	7.5	CVE-2026-44290	Unreachable
Medium	5.3	CVE-2026-44288	Unreachable
Medium	5.3	CVE-2026-44288	Unreachable
Medium	5.3	CVE-2026-44292	Unreachable
Medium	5.3	CVE-2026-44294	Unreachable
Medium	5.3	CVE-2026-45740	Unreachable
Medium	5.3	CVE-2026-59877	Unreachable

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability	Reachability
Critical	9.9	CVE-2026-41242	Unreachable
High	8.8	CVE-2026-44293	Unreachable
High	8.1	CVE-2026-44291	Unreachable
High	7.5	CVE-2026-44289	Unreachable
High	7.5	CVE-2026-44290	Unreachable
Medium	5.3	CVE-2026-44288	Unreachable
Medium	5.3	CVE-2026-44292	Unreachable
Medium	5.3	CVE-2026-44294	Unreachable
Medium	5.3	CVE-2026-45740	Unreachable

---

Release Notes

protobufjs/protobuf.js (protobufjs)

v7.6.5: protobufjs: v7.6.5

Compare Source

Bug Fixes

• handle EOF during options parsing (#​2352) (#​2356) (10fba6d)

v7.6.4: protobufjs: v7.6.4

Compare Source

Bug Fixes

• Reconfigure and speed up CI (#​2329) (574f761)
• Remove inquire submodule (#​2327) (06ddd07)

v7.6.3: protobufjs: v7.6.3

Compare Source

Bug Fixes

• Avoid name collisions in generated code (#​2311) (78a9576)
• Preserve null conversion behavior for fieldless messages (#​2312) (df91652)

v7.6.2: protobufjs: v7.6.2

Compare Source

Bug Fixes

• Backport consistency and correctness fixes (#​2294) (a92f72e)

v7.6.1: protobufjs: v7.6.1

Compare Source

Bug Fixes

• Backport misc utility hardening (#​2280) (8a45c13)
• Treat fixed64 as unsigned in converters (#​2266) (479dfdc)

v7.6.0: protobufjs: v7.6.0

Compare Source

Features

• Support BigInt conversions (7.x) (#​2258) (f769242)

v7.5.9: protobufjs: v7.5.9

Compare Source

Bug Fixes

• Backport bundler-safe optional module lookups (#​2254) (0853a62)

v7.5.8: protobufjs: v7.5.8

Compare Source

Bug Fixes

• Backport parser hardening to 7.x (#​2245) (54b593f)

v7.5.7: protobufjs: v7.5.7

Compare Source

Bug Fixes

• Restore first-match namespace lookup (#​2236) (cc7d595)

v7.5.6: protobufjs: v7.5.6

Compare Source

Bug Fixes

• Backport input hardening and CLI fixes to 7.x (#​2173) (75392ea)

v7.5.5: v7.5.5

Compare Source

v7.5.5

This release backports two reported security issues to 7.x branch.

• fix: do not allow setting __proto__ in Message constructor (#​2126)
• fix: filter invalid characters from the type name (#​2127)

Full Changelog: protobufjs/protobuf.js@protobufjs-v7.5.4...protobufjs-v7.5.5

v7.5.4

Compare Source

Bug Fixes

• invalid syntax in descriptor.proto (#​2092) (5a3769a)

---

• If you want to rebase/retry this PR, check this box