fix: bump protobufjs and follow-redirects to resolve dependabot alerts

[jonathannorris]

Summary

• Resolved 4 open Dependabot security alerts by bumping vulnerable transitive dependencies via resolutions in package.json

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#222	protobufjs	critical	Bumped to 7.5.5 via resolution in root package.json
#221	protobufjs	critical	Bumped to 7.5.5 via resolution in proxies/nodejs/package.json
#220	protobufjs	critical	Bumped to 7.5.5 via resolution in proxies/openfeature-nodejs/package.json
#219	follow-redirects	medium	Bumped to 1.16.0 via resolution in root package.json

[Copilot]

Pull request overview

Updates Yarn dependency resolutions/lockfiles to address Dependabot security alerts for vulnerable transitive packages in the root project and NodeJS proxy packages.

Changes:

• Add/adjust resolutions to force protobufjs to 7.5.5 and follow-redirects to 1.16.0.
• Update root and proxy yarn.lock files to reflect the bumped resolved versions.

Reviewed changes

Copilot reviewed 3 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
package.json	Adds root resolutions for protobufjs and follow-redirects.
yarn.lock	Updates resolved versions/checksums for protobufjs and follow-redirects.
proxies/nodejs/package.json	Adds protobufjs resolution for the nodejs proxy workspace.
proxies/nodejs/yarn.lock	Updates resolved protobufjs version/checksum.
proxies/openfeature-nodejs/package.json	Adds protobufjs resolution for the openfeature-nodejs proxy workspace.
proxies/openfeature-nodejs/yarn.lock	Updates resolved protobufjs version/checksum.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

These resolutions selectors are very specific to current transitive ranges (e.g. protobufjs@^7.2.5, protobufjs@^7.3.2). If a dependent updates its semver range (still within major 7), the override may stop applying and the vulnerable version could reappear. Consider broadening the selector (e.g. protobufjs@^7 or just protobufjs) to ensure the security override remains effective across minor/patch range changes.

Suggested change

	"follow-redirects@^1.15.11": "^1.16.0"
	"follow-redirects@^1": "^1.16.0"

[Copilot]

Similar to the root: this override targets only protobufjs@^7.4.0. If upstream dependencies change the protobufjs range (still within major 7), this resolution may stop matching. Consider using a broader selector (e.g. protobufjs@^7 or protobufjs) to keep the vulnerability fix from regressing on future dependency updates.

Suggested change

	"protobufjs@^7.4.0": "^7.5.5"
	"protobufjs@^7": "^7.5.5"

[Copilot]

This resolutions entry targets only protobufjs@^7.4.0. If a transitive dependency later requests a different protobufjs minor/patch range within major 7, the override may no longer apply. Consider broadening the selector (e.g. protobufjs@^7 or protobufjs) to make the security fix more durable.

Suggested change

	"protobufjs@^7.4.0": "^7.5.5"
	"protobufjs@^7": "^7.5.5"