From c8a6feae38f32ff79921d7989b07f2e698e443d6 Mon Sep 17 00:00:00 2001
From: "ugo.bechameil" <ugo.bechameil@hackolade.com>
Date: Tue, 28 Jul 2026 15:09:13 +0200
Subject: [PATCH] chore: address Trivy production dependency vulnerabilities

Bump vulnerable production dependencies/overrides and refresh package-lock.json to clear Plugins develop Trivy findings.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 package-lock.json | 20 ++++++++++----------
 package.json      |  7 ++++---
 2 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 74ff59a..0ddff8e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,17 +1,17 @@
 {
     "name": "Protobuf",
-    "version": "0.2.7",
+    "version": "0.2.8",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "Protobuf",
-            "version": "0.2.7",
+            "version": "0.2.8",
             "hasInstallScript": true,
             "dependencies": {
                 "antlr4": "4.8.0",
                 "lodash": "4.18.1",
-                "protobufjs": "7.6.4"
+                "protobufjs": "7.6.5"
             },
             "devDependencies": {
                 "@hackolade/hck-esbuild-plugins-pack": "0.0.1",
@@ -1310,16 +1310,16 @@
             }
         },
         "node_modules/brace-expansion": {
-            "version": "5.0.6",
-            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-            "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+            "version": "5.0.8",
+            "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+            "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
                 "balanced-match": "^4.0.2"
             },
             "engines": {
-                "node": "18 || 20 || >=22"
+                "node": "20 || >=22"
             }
         },
         "node_modules/braces": {
@@ -2340,9 +2340,9 @@
             }
         },
         "node_modules/protobufjs": {
-            "version": "7.6.4",
-            "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.4.tgz",
-            "integrity": "sha512-RJJPTTpvFfHcWLkIa2JFWK4XvtSzS0yEWDmunqHXli1h3JlkbcQZXDZdcWxv+JK3Xsl5/UFDPZ0iGm7DAengYw==",
+            "version": "7.6.5",
+            "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz",
+            "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==",
             "hasInstallScript": true,
             "license": "BSD-3-Clause",
             "dependencies": {
diff --git a/package.json b/package.json
index 1ae501d..fe0c412 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,7 @@
     "dependencies": {
         "antlr4": "4.8.0",
         "lodash": "4.18.1",
-        "protobufjs": "7.6.4"
+        "protobufjs": "7.6.5"
     },
     "simple-git-hooks": {
         "pre-commit": "npm run package && npx lint-staged --config lint-staged.config.js",
@@ -63,6 +63,7 @@
         "simple-git-hooks": "2.13.1"
     },
     "overrides": {
-        "minimatch": "10.2.4"
+        "minimatch": "10.2.4",
+        "brace-expansion": "5.0.8"
     }
-}
\ No newline at end of file
+}