Any plans on fixing protobufjs Prototype Pollution vulnerability (GHSA-h755-8qp9-cq85) please?

[huxingyi]

Hi, looks like this hasn't been raised as an issue, and not sure if this has been brought to maintainers' attention.

There is a new vulnerability published 5 days ago, please check the details here:
GHSA-h755-8qp9-cq85

I have seen multiple pull requests created by Dependabot, but not found the one containing the recent vulnerability fixing. Maybe there is a limit on how many pull requests created by bots?

I forked this repo just for the purpose to verify the Dependabot, and it's able to raise a fixing pull request for this vulnerability (Enabled it in the Security tab of the forked repo): huxingyi#1

If you could have a look on this vulnerability issue, that would be much appreciated, thanks!

[jrm86]

This looks like a pretty cut and dry fix (or, should have already been fixed by dependabot). It would be wonderful to see this resolved ASAP if someone is still maintaining this repo