chore(deps): update dependency protobufjs-cli to v1.3.2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
protobufjs-cli	1.2.1 → 1.3.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

CVE-2026-54271 / GHSA-pr59-h9ph-3fr8

More information

Details

Summary

A previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas from .proto files is not affected.

This is a bypass of GHSA-6r35-46g8-jcw9 / CVE-2026-44295.

Impact

An attacker who can provide or influence pre-parsed JSON descriptors passed to pbjs static code generation may be able to cause generated JavaScript output to contain attacker-controlled code.

The injected code may execute if the generated file is later executed or imported and an affected generated API path is invoked.

Preconditions

• The application or build process must run pbjs static code generation on a pre-parsed JSON descriptor influenced by an attacker.
• The generated JavaScript file must subsequently be executed or imported.
• An affected generated API path must be invoked.

Workarounds

Do not run affected versions of pbjs static or static-module generation on untrusted JSON descriptors. If untrusted JSON descriptors must be accepted, validate descriptor-derived names before code generation and reject names that could not have been produced by parsing a valid .proto file. Running code generation in an isolated environment can reduce impact.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L

References

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-pr59-h9ph-3fr8
• https://nvd.nist.gov/vuln/detail/CVE-2026-54271
• https://github.com/advisories/GHSA-pr59-h9ph-3fr8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

protobufjs/protobuf.js (protobufjs-cli)

v1.3.2: protobufjs-cli: v1.3.2

Compare Source

Bug Fixes

• Backport consistency and correctness fixes (#​2294) (a92f72e)

v1.3.1: protobufjs-cli: v1.3.1

Compare Source

Bug Fixes

• Treat fixed64 as unsigned in converters (#​2266) (479dfdc)

v1.3.0: protobufjs-cli: v1.3.0

Compare Source

Features

• Support BigInt conversions (7.x) (#​2258) (f769242)

v1.2.2: protobufjs-cli: v1.2.2

Compare Source

Bug Fixes

• Update CLI peer dependency (7.x) (#​2189) (a0bf2df)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d7fe815

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wiz-9635d3485b]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	5
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	5

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.