fix(deps): bump protobufjs to 7.5.5 for GHSA-xq3m-2v4x-88gg

[malinskibeniamin]

Summary

• GHSA-xq3m-2v4x-88gg: protobufjs ≤7.5.4 / ≤8.0.0 generates JS functions by concatenating schema-derived identifiers and executing them via Function() without validation → RCE when processing untrusted schemas.
• Console has no direct protobufjs dependency, but a transitive 7.5.4 was present in frontend/bun.lock and frontend/yarn.lock.
• Pin protobufjs: ^7.5.5 in both overrides and resolutions of frontend/package.json to kill the finding.

Test plan

• bun i + bun i --yarn produce clean lockfiles; every protobufjs reference resolves to 7.5.5.
• CI green.

🤖 Generated with Claude Code

[malinskibeniamin]

@claude review

[claude]

Claude finished @malinskibeniamin's task in 1m 10s —— View job

---

PR Review

• Read CLAUDE.md for repo guidelines
• Review changed files
• Analyze security fix correctness
• Post review feedback

---

Summary: This PR pins protobufjs to ^7.5.5 to remediate GHSA-xq3m-2v4x-88gg (RCE via unsanitized Function() call in schema processing). Clean, minimal, and correct.

Security Fix Correctness

The approach is right: since protobufjs is a transitive dependency (pulled in by dockerode@4.0.9 via @grpc/proto-loader), pinning via package manager overrides/resolutions is the correct mechanism.

frontend/package.json:

• overrides (used by npm/bun): "protobufjs": "^7.5.5" ✅
• resolutions (used by yarn): "protobufjs": "^7.5.5" ✅
• Follows the exact same pattern as other security overrides already in this file (elliptic, dompurify, ajv, etc.)

frontend/bun.lock:

• Single protobufjs entry resolves to 7.5.5 ✅
• Override field at the top of the lockfile confirms "protobufjs": "^7.5.5" ✅

frontend/yarn.lock:

• All requested ranges (^7.2.5, ^7.3.2, ^7.5.3) collapse to a single 7.5.5 entry with correct integrity hash ✅
• No stale vulnerable versions remain in either lockfile ✅

Minor Notes

1. ^7.5.5 semver range: Using ^7.5.5 (rather than an exact pin or >=7.5.5) is appropriate here — it allows future 7.x.x patch/minor updates but will never downgrade below the fixed version. Good call.

2. overrides vs resolutions parity: There are some pre-existing divergences between these two sections (e.g., elliptic and yaml appear in overrides but not resolutions). This PR correctly adds protobufjs to both, which is the right pattern for dual bun/yarn support.

3. Scope of transitive consumers: dockerode (dev dep, used by testcontainers) requests protobufjs@^7.3.2 and @grpc/proto-loader requests ^7.5.3 — both satisfied by 7.5.5. No compatibility issues.

Verdict

LGTM — correct, minimal fix with no functional changes. CI green would confirm the lockfiles are consistent.