Second protobufjs CVE requiring a major version upgrade

[catmeme]

What happened?

When installing this package, you are warned of high severity CVEs.

CVE-2022-25878 was addressed, GHSA-g954-5hwp-pp24

CVE-2023-36665 was not, GHSA-h755-8qp9-cq85

protobufjs/protobuf.js#1741

https://github.com/pulumi/pulumi-policy/blob/master/sdk/nodejs/policy/package.json#L16

Expected Behavior

Witness no CVEs warnings when installing the package.

Steps to reproduce

npm i @pulumi/policy

Output of pulumi about

CLI          
Version      3.75.0
Go Version   go1.20.6
Go Compiler  gc

Additional context

Downgrading to 6.9.0 might also fix it.

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[catmeme]

Personally I went with this as a solution in the short-term, but I would expect Pulumi to address this by sorting through the upgrading of the package.

Add to package.json:

  "overrides": {
    "protobufjs": "~6.9.0"
  }

[justinvp]

Thanks for opening the issue and letting us know, @catmeme! This has been fixed by bumping the major version in #313 and released as @pulumi/policy 1.7.0.