chore(deps): override protobufjs to 7.5.6+ (GHSA-q6x5-8v7m-xcrf et al)

[jrphilo]

Summary

• Adds pnpm.overrides.protobufjs set to ^7.5.6 to clear seven Dependabot alerts on the transitive protobufjs (and a related alert on @protobufjs/utf8). Each is patched at protobufjs@7.5.6 (@protobufjs/utf8@1.1.1 ships with that bump).
• Alerts cleared:
  • hotfix: apple-icon.png with transparent bg #14 GHSA-685m-2w69-288q — DoS via unbounded protobuf recursion (CVE-2026-44289)
  • hotfix: serve icon.svg + apple-icon.png as static assets #13 GHSA-66ff-xgx4-vchm — Code injection via bytes-field defaults in generated toObject code (CVE-2026-44293)
  • hotfix: center mid-dot in changelog OG eyebrow #12 GHSA-2pr8-phx7-x9h3 — DoS from crafted field names in generated code (CVE-2026-44294)
  • hotfix: avoid OG root file/dir name collision on CF #11 GHSA-fx83-v9x8-x52w — Prototype injection in generated message constructors (CVE-2026-44292)
  • hotfix: match OG card bg to welcome's og-default (#EDE9E3) #10 GHSA-75px-5xx7-5xc7 — Code-generation gadget after prototype pollution (CVE-2026-44291)
  • hotfix: prepend build:pre to local deploy scripts #9 GHSA-jvwf-75h9-cwgg — Process-wide DoS through unsafe option paths (CVE-2026-44290)
  • Generate docs OG PNGs at build time (fixes 500s on preview) #8 / Drop CLA section from CONTRIBUTING #7 GHSA-q6x5-8v7m-xcrf — Overlong UTF-8 decoding (CVE-2026-44288)
• Path into the tree:

docs@0.1.0
└─┬ posthog-js 1.369.3
  └─┬ @opentelemetry/exporter-logs-otlp-http 0.208.0
    └─┬ @opentelemetry/otlp-transformer 0.208.0
      └── protobufjs 7.5.5 → 7.5.8 (post-override)

• Exposure: protobufjs is reached only through posthog-js's OpenTelemetry logs exporter; our app never imports protobufjs directly (no source-tree references in src/ or scripts/). We don't author .proto files, don't decode attacker-controlled protobuf payloads, and don't expose generated toObject codepaths. The advisories all describe attacker-supplied protobuf data reaching generated decode/encode code, which isn't reachable through our usage. Bumping is still the right move — it's a deterministic transitive fix with no behavior change for our integration.

Test plan

• pnpm install succeeds; lockfile updated
• pnpm why protobufjs reports 7.5.8 (>= 7.5.6 patched floor)
• CI green (lint + build + check:links)

---

AI-assistance disclosure: this PR was drafted by an AI agent (Claude / Ralphie) as part of the docs repo dependency-triage loop. The change is mechanical (a pnpm.overrides entry) and the exposure assessment is grounded in a repo grep and the advisory text. A maintainer should still skim the diff and the advisories before merging.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	docs-preview	63c1ad8	Commit Preview URL Branch Preview URL	May 13 2026, 01:37 PM

[jrphilo]

Ralphie verified this — ready to merge.

Verification

• lint: ✓
• build: ✓ (Next.js type-check + bundle, 11/11 static pages generated)
• check:links: ✓ (39 files, 3 internal links, 0 broken)

Changelog highlights

• This is an alert-sweep override PR, not a version bump — the "changelog" is the seven advisories listed in the PR body (GHSA-q6x5-8v7m-xcrf and friends, all patched in protobufjs@7.5.6).
• Post-override pnpm why protobufjs reports 7.5.8, well above the patched floor.

Investigation

• Ownership: no ownership change — this is a transitive-dep version floor, no publisher swap.
• Auth/secrets: none — pnpm.overrides edit only; no auth/secret-handling code touched.
• Security advisory: GHSA-q6x5-8v7m-xcrf et al. (seven advisories) — investigated → all describe attacker-controlled protobuf payloads reaching generated encode/decode code (toObject, bytes-field defaults, option paths, UTF-8 decoding). We reach protobufjs only via posthog-js@1.369.3 → @opentelemetry/exporter-logs-otlp-http → @opentelemetry/otlp-transformer. Confirmed by pnpm why protobufjs and grep -r protobuf src/ (no hits). We don't author .proto files, don't decode attacker-controlled protobuf payloads, don't expose generated codepaths. Override is deterministic and the right floor.
• Deprecations: none we'd hit.
• Breaking API: none — protobufjs@7.5.5 → 7.5.8 is a patch-level move within the 7.5.x range; no API surface change for the OpenTelemetry transformer.

Recommendation

Safe to merge. The override is mechanical, the resolved version (7.5.8) clears all seven advisories' patched floors (7.5.6), and our exposure to the vulnerable surfaces is zero — protobufjs is reached only through posthog-js's OTLP logs exporter and we don't process attacker-controlled protobuf input.

[jrphilo]

Closing — superseded by #57, which batches this override with the fast-xml-builder override (#53) onto current main to avoid a rebase cascade after the recent merge wave.