From 12feb3476b037b8a959b083046265df96b3be81e Mon Sep 17 00:00:00 2001
From: "linear-code[bot]" <222613912+linear-code[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 13:38:34 +0000
Subject: [PATCH] chore: upgrade protobufjs to ^7.6.5 to address CVE-2026-59877

Refreshes the yarn.lock entry for protobufjs from 7.6.4 to 7.6.5 to
address CVE-2026-59877 (DoS via infinite loop in .proto option parsing).
All existing ^7.x ranges already admit the patched version.

Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1556/sourcebot-devsourcebot-cve-2026-59877-protobufjs-denial-of-service-via#agent-session-2252c8a0)

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 3 +++
 yarn.lock    | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce01f93fa..dbcdbac94 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Upgraded `protobufjs` to `^7.6.5`. [#1467](https://github.com/sourcebot-dev/sourcebot/pull/1467)
+
 ## [5.1.3] - 2026-07-20
 
 ### Added
diff --git a/yarn.lock b/yarn.lock
index 54653dc8d..2e4e63a3b 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -20244,8 +20244,8 @@ __metadata:
   linkType: hard
 
 "protobufjs@npm:^7.3.0, protobufjs@npm:^7.4.0, protobufjs@npm:^7.5.3, protobufjs@npm:^7.5.4":
-  version: 7.6.4
-  resolution: "protobufjs@npm:7.6.4"
+  version: 7.6.5
+  resolution: "protobufjs@npm:7.6.5"
   dependencies:
     "@protobufjs/aspromise": "npm:^1.1.2"
     "@protobufjs/base64": "npm:^1.1.2"
@@ -20258,7 +20258,7 @@ __metadata:
     "@protobufjs/utf8": "npm:^1.1.1"
     "@types/node": "npm:>=13.7.0"
     long: "npm:^5.3.2"
-  checksum: 10c0/6403eaa9c5a72cc6450c11f38fefafdde243fd806e7ac606ac8d591bc3fdaec45ae764febf83181a2d9aac51aca624e0f46dec368ceea191f7e85e2d6ccaaf93
+  checksum: 10c0/863eaca9c6f45bfcfb8787c545f53e9c6696507e328e3981b4643c12d35df7f2826021c10e3fd30bef342c13a8e9d306547bac9c0849ee3bf50f770a12f01dc5
   languageName: node
   linkType: hard