Repository navigation
fix(reference): patch protobufjs code generation and parser advisories #259
Description
Affected page, module, or tool
tools/reference/package.json and package-lock.json; the pinned TypeScript reference-fixture runner.
Affected modules
kafka/protobuf, integration
Request or question
The October 23, 2026 read-only npm audit of the current lockfile identifies protobufjs 7.5.4 as affected by published advisories, including Critical GHSA-xq3m-2v4x-88gg (code execution) and additional code-generation/parser issues. The official registry reports 7.6.6 as a non-major remediation covering the selected advisory range through 7.6.4. This dependency is a development/reference tool, not the Go Lambda Protobuf adapter or a Lambda runtime dependency. This follow-up blocks the unified security release tracked in #255 and #257; the old unmerged plan PR #258 was closed without publishing tags.
Completion criteria
- Pin protobufjs 7.6.6 and update only its necessary lockfile entries.
- Keep the Powertools TypeScript 2.35.0 reference baseline and all other direct tool versions fixed.
- Update the direct-dependency provenance inventory.
- Re-run the official-registry npm audit and require zero reported vulnerabilities.
- Generate the Protobuf fixtures, retain schema, successful values, callback positions and error categories, and precisely align the short-prefix bounds diagnostic with the patched reader.
- Verify relevant CI/runtime checks, review, merge, and regenerate the v1.3.0 plan against the new main source before publication.
Before submitting
- I searched existing issues and documentation.
- I removed credentials and private data from this request.
Activity
jinxiao commentedon Oct 23, 2026
Scope accepted: update only protobufjs within major version 7 and its required lock metadata, keep the Powertools 2.35.0 reference baseline fixed, compare generated Protobuf fixtures, require a clean official-registry npm audit, and review before merging. The fixture schemas are repository-controlled; npm severity is not proof that the published Go Lambda code is exploitable. Python documentation audit separately found no known vulnerabilities in its 11 locked dependencies.
jinxiao commentedon Oct 23, 2026
Fixture review found one observable patch-level difference: protobufjs 7.6.6 reports a one-byte bounds read for truncated uint32 prefixes shorter than five bytes, rather than the former ten-byte read. Scope refinement accepted: preserve decoded values, schema, native-message results, callback positions and error categories; record the new tool provenance and align only this Go prefix diagnostic with the patched reader. Keep five-to-nine-byte ten-byte-skip failures unchanged and verify both boundary classes explicitly. No Go runtime code-execution vulnerability is implied by the development-tool advisory.