OCPBUGS-99418: Bump protobufjs to 7.6.5 to fix CVE-2026-59877, CVE-2026-48712, CVE-2026-41242

[shahsahil264]

Analysis / Root cause:
The protobufjs package pinned in yarn resolutions at version 7.5.8 is affected by three CVEs:

• CVE-2026-59877 (OCPBUGS-99418): DoS via crafted .proto schema (fixed in 7.6.5)
• CVE-2026-48712 (OCPBUGS-99529): DoS via uncontrolled recursion (fixed in 7.6.1)
• CVE-2026-41242 (OCPBUGS-96734): Arbitrary code execution via injected type fields (fixed in 7.5.5)

Solution description:
Bumps the protobufjs yarn resolution from 7.5.8 to 7.6.5, which includes fixes for all three CVEs. No API changes are expected as this is a patch-level update within the 7.x line.

Screenshots / screen recording:
N/A - dependency version bump only, no visual changes.

Test setup:
No special setup required.

Test cases:

• yarn install succeeds
• lint-staged pre-commit hook passes
• yarn build succeeds (CI)
• CI passes

Browser conformance:

• Chrome
• Firefox
• Safari (or Epiphany on Linux)

N/A - no runtime behavior change expected.

Additional info:
This PR fixes three Jira bugs:

• https://issues.redhat.com/browse/OCPBUGS-99418
• https://issues.redhat.com/browse/OCPBUGS-99529
• https://issues.redhat.com/browse/OCPBUGS-96734

Summary by CodeRabbit

• Chores
  • Updated the bundled Protocol Buffers library to version 7.6.5 to align with the latest available release.
  • Maintenance update only; existing end-user workflows should remain unchanged.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@shahsahil264: This pull request references Jira Issue OCPBUGS-99418, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Analysis / Root cause:
The protobufjs package pinned in yarn resolutions at version 7.5.8 is affected by three CVEs:

• CVE-2026-59877 (OCPBUGS-99418): DoS via crafted .proto schema (fixed in 7.6.5)
• CVE-2026-48712 (OCPBUGS-99529): DoS via uncontrolled recursion (fixed in 7.6.1)
• CVE-2026-41242 (OCPBUGS-96734): Arbitrary code execution via injected type fields (fixed in 7.5.5)

Solution description:
Bumps the protobufjs yarn resolution from 7.5.8 to 7.6.5, which includes fixes for all three CVEs. No API changes are expected as this is a patch-level update within the 7.x line.

Screenshots / screen recording:
N/A - dependency version bump only, no visual changes.

Test setup:
No special setup required.

Test cases:

• yarn install succeeds
• lint-staged pre-commit hook passes
• yarn build succeeds (CI)
• CI passes

Browser conformance:

• Chrome
• Firefox
• Safari (or Epiphany on Linux)

N/A - no runtime behavior change expected.

Additional info:
This PR fixes three Jira bugs:

• https://issues.redhat.com/browse/OCPBUGS-99418
• https://issues.redhat.com/browse/OCPBUGS-99529
• https://issues.redhat.com/browse/OCPBUGS-96734

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 57075599-4488-4a1c-ada5-6e3cadb0e58b

📥 Commits

Reviewing files that changed from the base of the PR and between 1be40f5 and 753be8d.

⛔ Files ignored due to path filters (1)

• frontend/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• frontend/package.json

🚧 Files skipped from review as they are similar to previous changes (1)

• frontend/package.json

---

Walkthrough

The frontend package resolution for protobufjs changes from version 7.5.8 to 7.6.5.

Changes

Dependency resolution

Layer / File(s)	Summary
Update protobufjs resolution frontend/package.json	Updates the protobufjs resolution from 7.5.8 to 7.6.5.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• openshift/console#16812: Also modifies the protobufjs Yarn resolution in frontend/package.json.

Suggested labels: lgtm, verified

Suggested reviewers: fsgreco, leo6leo

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the protobufjs version bump and its CVE-fix purpose.
Description check	✅ Passed	The description includes the required sections and is mostly complete, with only reviewers/assignees missing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR changes only frontend/package.json and frontend/yarn.lock; no Ginkgo tests or titles were added or edited.
Test Structure And Quality	✅ Passed	No Ginkgo test code changed; PR only updates protobufjs resolution and yarn.lock, so the test-structure criteria are not applicable.
Microshift Test Compatibility	✅ Passed	Only frontend/package.json and yarn.lock changed; no Ginkgo tests were added or modified, so MicroShift compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only updates frontend/package.json and yarn.lock; no new/changed Ginkgo e2e tests or SNO assumptions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only frontend/package.json and frontend/yarn.lock changed; no deployment manifests, operator code, or controllers were modified.
Ote Binary Stdout Contract	✅ Passed	PR only bumps protobufjs in package.json/yarn.lock; no process-level stdout code or suite setup changed.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only bumps protobufjs in frontend/package.json and yarn.lock; no new Ginkgo/e2e tests or networking code were added.
No-Weak-Crypto	✅ Passed	PR only bumps protobufjs resolution and lockfile entries; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom crypto code added.
Container-Privileges	✅ Passed	The PR only updates frontend/package.json and frontend/yarn.lock; no K8s/container manifest files or privilege settings were changed.
No-Sensitive-Data-In-Logs	✅ Passed	Diff only updates protobufjs in package.json and yarn.lock; no logging or sensitive-data patterns appear.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@shahsahil264: This pull request references Jira Issue OCPBUGS-99418, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Analysis / Root cause:
The protobufjs package pinned in yarn resolutions at version 7.5.8 is affected by three CVEs:

• CVE-2026-59877 (OCPBUGS-99418): DoS via crafted .proto schema (fixed in 7.6.5)
• CVE-2026-48712 (OCPBUGS-99529): DoS via uncontrolled recursion (fixed in 7.6.1)
• CVE-2026-41242 (OCPBUGS-96734): Arbitrary code execution via injected type fields (fixed in 7.5.5)

Solution description:
Bumps the protobufjs yarn resolution from 7.5.8 to 7.6.5, which includes fixes for all three CVEs. No API changes are expected as this is a patch-level update within the 7.x line.

Screenshots / screen recording:
N/A - dependency version bump only, no visual changes.

Test setup:
No special setup required.

Test cases:

• yarn install succeeds
• lint-staged pre-commit hook passes
• yarn build succeeds (CI)
• CI passes

Browser conformance:

• Chrome
• Firefox
• Safari (or Epiphany on Linux)

N/A - no runtime behavior change expected.

Additional info:
This PR fixes three Jira bugs:

• https://issues.redhat.com/browse/OCPBUGS-99418
• https://issues.redhat.com/browse/OCPBUGS-99529
• https://issues.redhat.com/browse/OCPBUGS-96734

Summary by CodeRabbit

• Chores
• Updated the bundled Protocol Buffers library to version 7.6.5.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[rhamilto]

/approve
/lgtm
/verified by CI

[openshift-ci-robot]

@rhamilto: This PR has been marked as verified by CI.

Details

In response to this:

/approve
/lgtm
/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console
/test e2e-playwright

[openshift-ci-robot]

@shahsahil264: This pull request references Jira Issue OCPBUGS-99418, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Analysis / Root cause:
The protobufjs package pinned in yarn resolutions at version 7.5.8 is affected by three CVEs:

• CVE-2026-59877 (OCPBUGS-99418): DoS via crafted .proto schema (fixed in 7.6.5)
• CVE-2026-48712 (OCPBUGS-99529): DoS via uncontrolled recursion (fixed in 7.6.1)
• CVE-2026-41242 (OCPBUGS-96734): Arbitrary code execution via injected type fields (fixed in 7.5.5)

Solution description:
Bumps the protobufjs yarn resolution from 7.5.8 to 7.6.5, which includes fixes for all three CVEs. No API changes are expected as this is a patch-level update within the 7.x line.

Screenshots / screen recording:
N/A - dependency version bump only, no visual changes.

Test setup:
No special setup required.

Test cases:

• yarn install succeeds
• lint-staged pre-commit hook passes
• yarn build succeeds (CI)
• CI passes

Browser conformance:

• Chrome
• Firefox
• Safari (or Epiphany on Linux)

N/A - no runtime behavior change expected.

Additional info:
This PR fixes three Jira bugs:

• https://issues.redhat.com/browse/OCPBUGS-99418
• https://issues.redhat.com/browse/OCPBUGS-99529
• https://issues.redhat.com/browse/OCPBUGS-96734

Summary by CodeRabbit

• Chores
• Updated the bundled Protocol Buffers library to version 7.6.5 to align with the latest available release.
• This maintenance update is not expected to change existing end-user workflows.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[shahsahil264]

/retest

[rhamilto]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console
/test e2e-playwright

[rhamilto]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console
/test e2e-playwright

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rhamilto, shahsahil264

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• frontend/OWNERS [rhamilto]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment