Fix protobufjs security vulnerability CVE-2023-36665

[ljht]

Upgrade protobufjs to latest version in order to address vulnerability Add new package protobufjs-cli, since it was a breaking change from moving from v6 to v7 in protobufjs

[ljht]

This is a duplicate of #98 , just added the new package dependency protobufjs-cli and commit the output of
npm run genprotobuf

[seemk]

Thanks! But I think the updated package-lock.json contains private artifactory URLs, can you double check this?

[ljht]

Sorry for that, package-lock.json updated to remove reference to private artifactory

[seemk]

Just noticed the commits need to be signed, I can't merge otherwise :(

[ljht]

learn something new today, I force push a single commit that is signed

[seemk]

The email in this signature doesn’t match the committer email.

At the moment it's showing me The email in this signature doesn’t match the committer email. and merge button is greyed out :D

[ljht]

Finally go it right

[seemk]

Thanks!

[rushabh-wadkar]

@seemk Any deadline when this will release ?
We use signalfx version ^7.4.0, will this version upgrade for protobufjs apply to those versions too ?

[kumarrishav]

yeah. good to backport this fix in v7 as well

[rushabh-wadkar]

@seemk Any update please ?