chore(deps): bump protobufjs to 7.6.1

[mozilla-blender]

Summary

Bumps protobufjs to 7.6.1 to resolve Dependabot alert #236.

This is a transitive dependency update. Only package-lock.json (and possibly package.json) changed.

---

Created by BLEnder investigation via BLEnder

[mozilla-blender]

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

protobufjs is a transitive dependency (installed 7.5.8) pulled in by @google-cloud/pubsub, @grpc/grpc-js, and @opentelemetry/otlp-* exporters. None of these expose schema loading to attacker-controlled input — they use fixed, trusted schemas defined by Google, gRPC, and OpenTelemetry. The application source code does not import protobufjs directly or load any user/untrusted protobuf schemas or JSON descriptors, which is the precondition for this DoS vulnerability (a schema with field names like hasOwnProperty, $type, or rpcCall). A patched version is available, so the dependency should still be bumped via Dependabot to clear the alert.

This PR can be reviewed and merged as a normal dependency update.

[mozilla-blender]

BLEnder could not fix this PR automatically. Workflow run