From ec1a87e856502f29a55a5762d129bb845f094bd7 Mon Sep 17 00:00:00 2001 From: Armin Ronacher Date: Thu, 23 Jul 2026 23:16:07 +0200 Subject: [PATCH] fix(coding-agent): require protobufjs 7.6.5, closes #7005 --- package-lock.json | 6 +++--- package.json | 1 + packages/coding-agent/CHANGELOG.md | 1 + packages/coding-agent/install-lock/package-lock.json | 6 +++--- packages/coding-agent/install-lock/package.json | 1 + packages/coding-agent/npm-shrinkwrap.json | 6 +++--- packages/coding-agent/package.json | 1 + scripts/generate-coding-agent-install-lock.mjs | 2 +- scripts/generate-coding-agent-shrinkwrap.mjs | 2 +- 9 files changed, 15 insertions(+), 11 deletions(-) diff --git a/package-lock.json b/package-lock.json index e0a31b458..fa22caf3d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4188,9 +4188,9 @@ } }, "node_modules/protobufjs": { - "version": "7.6.4", - "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.4.tgz", - "integrity": "sha512-RJJPTTpvFfHcWLkIa2JFWK4XvtSzS0yEWDmunqHXli1h3JlkbcQZXDZdcWxv+JK3Xsl5/UFDPZ0iGm7DAengYw==", + "version": "7.6.5", + "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz", + "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==", "hasInstallScript": true, "license": "BSD-3-Clause", "dependencies": { diff --git a/package.json b/package.json index 4f710af98..ae0bb74fa 100644 --- a/package.json +++ b/package.json @@ -63,6 +63,7 @@ }, "version": "0.0.3", "overrides": { + "protobufjs": "7.6.5", "rimraf": "6.1.2", "gaxios": { "rimraf": "6.1.2" diff --git a/packages/coding-agent/CHANGELOG.md b/packages/coding-agent/CHANGELOG.md index 18385c778..37e1fc37e 100644 --- a/packages/coding-agent/CHANGELOG.md +++ b/packages/coding-agent/CHANGELOG.md @@ -10,6 +10,7 @@ - Fixed compaction and branch-summary requests to use fresh routing session IDs with prompt caching disabled where supported. - Fixed explicit self-updates when `PI_SKIP_VERSION_CHECK` is set ([#6977](https://github.com/earendil-works/pi/issues/6977)). +- Updated the packaged `protobufjs` dependency to 7.6.5 to address GHSA-j3f2-48v5-ccww ([#7005](https://github.com/earendil-works/pi/issues/7005)). ## [0.81.1] - 2026-07-21 diff --git a/packages/coding-agent/install-lock/package-lock.json b/packages/coding-agent/install-lock/package-lock.json index e76790ca9..6c510eba6 100644 --- a/packages/coding-agent/install-lock/package-lock.json +++ b/packages/coding-agent/install-lock/package-lock.json @@ -1603,9 +1603,9 @@ } }, "node_modules/protobufjs": { - "version": "7.6.4", - "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.4.tgz", - "integrity": "sha512-RJJPTTpvFfHcWLkIa2JFWK4XvtSzS0yEWDmunqHXli1h3JlkbcQZXDZdcWxv+JK3Xsl5/UFDPZ0iGm7DAengYw==", + "version": "7.6.5", + "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz", + "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==", "license": "BSD-3-Clause", "dependencies": { "@protobufjs/aspromise": "^1.1.2", diff --git a/packages/coding-agent/install-lock/package.json b/packages/coding-agent/install-lock/package.json index d3580806a..f0ae8a062 100644 --- a/packages/coding-agent/install-lock/package.json +++ b/packages/coding-agent/install-lock/package.json @@ -7,6 +7,7 @@ "@earendil-works/pi-coding-agent": "0.81.1" }, "overrides": { + "protobufjs": "7.6.5", "rimraf": "6.1.2", "gaxios": { "rimraf": "6.1.2" diff --git a/packages/coding-agent/npm-shrinkwrap.json b/packages/coding-agent/npm-shrinkwrap.json index ffc4e5fe5..ec763343c 100644 --- a/packages/coding-agent/npm-shrinkwrap.json +++ b/packages/coding-agent/npm-shrinkwrap.json @@ -1593,9 +1593,9 @@ } }, "node_modules/protobufjs": { - "version": "7.6.4", - "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.4.tgz", - "integrity": "sha512-RJJPTTpvFfHcWLkIa2JFWK4XvtSzS0yEWDmunqHXli1h3JlkbcQZXDZdcWxv+JK3Xsl5/UFDPZ0iGm7DAengYw==", + "version": "7.6.5", + "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz", + "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==", "license": "BSD-3-Clause", "dependencies": { "@protobufjs/aspromise": "^1.1.2", diff --git a/packages/coding-agent/package.json b/packages/coding-agent/package.json index e2e5427d3..d770d2e83 100644 --- a/packages/coding-agent/package.json +++ b/packages/coding-agent/package.json @@ -59,6 +59,7 @@ "yaml": "2.9.0" }, "overrides": { + "protobufjs": "7.6.5", "rimraf": "6.1.2", "gaxios": { "rimraf": "6.1.2" diff --git a/scripts/generate-coding-agent-install-lock.mjs b/scripts/generate-coding-agent-install-lock.mjs index 1c634a9fd..881205d2d 100644 --- a/scripts/generate-coding-agent-install-lock.mjs +++ b/scripts/generate-coding-agent-install-lock.mjs @@ -15,7 +15,7 @@ const internalPackagePrefix = "@earendil-works/pi-"; const installPackageName = "@earendil-works/pi-coding-agent-install"; const allowedInstallScriptPackages = new Map([ ["@google/genai@1.52.0", "preinstall is a no-op in the published package"], - ["protobufjs@7.6.4", "postinstall only warns about protobufjs version scheme mismatches"], + ["protobufjs@7.6.5", "postinstall only warns about protobufjs version scheme mismatches"], ]); const args = new Set(process.argv.slice(2)); diff --git a/scripts/generate-coding-agent-shrinkwrap.mjs b/scripts/generate-coding-agent-shrinkwrap.mjs index 1971869ce..06b1a2283 100644 --- a/scripts/generate-coding-agent-shrinkwrap.mjs +++ b/scripts/generate-coding-agent-shrinkwrap.mjs @@ -12,7 +12,7 @@ const shrinkwrapPath = join(codingAgentDir, "npm-shrinkwrap.json"); const internalPackagePrefix = "@earendil-works/pi-"; const allowedInstallScriptPackages = new Map([ ["@google/genai@1.52.0", "preinstall is a no-op in the published package"], - ["protobufjs@7.6.4", "postinstall only warns about protobufjs version scheme mismatches"], + ["protobufjs@7.6.5", "postinstall only warns about protobufjs version scheme mismatches"], ]); const args = new Set(process.argv.slice(2));