security(deps): resolve 4 Dependabot alerts (2 critical, 2 high)

.changeset/security-protobufjs-basic-ftp-fixes.md

@@ -0,0 +1,20 @@
+---
+"@connectum/otel": patch
+---
+
+security(deps): force patched versions of protobufjs and basic-ftp via pnpm overrides
+
+Resolves Dependabot alerts on main branch:
+
+- **GHSA-xq3m-2v4x-88gg** (Critical) — Arbitrary code execution in protobufjs < 7.5.5
+  (transitive via `@grpc/proto-loader` under OTel gRPC exporters).
+- **GHSA-xq3m-2v4x-88gg** (Critical) — Arbitrary code execution in protobufjs 8.0.0
+  (transitive via `@opentelemetry/otlp-transformer`).
+- **GHSA-chqc-8p9q-pq6q** (High) — basic-ftp 5.2.0 FTP Command Injection via CRLF
+  (dev-only transitive via `@exodus/test` → puppeteer-core).
+- **GHSA-6v7q-wjvx-w8wg** (High) — basic-ftp ≤ 5.2.1 incomplete CRLF protection
+  (dev-only transitive via `@exodus/test` → puppeteer-core).
+
+No runtime API changes. Only `pnpm.overrides` in the monorepo root were adjusted
+to force patched transitive versions: `protobufjs@<7.5.5 → 7.5.5`,
+`protobufjs@>=8.0.0 <8.0.1 → 8.0.1`, `basic-ftp@<5.2.2 → 5.2.2`.

package.json

@@ -56,11 +56,13 @@
     "overrides": {
       "ajv@<8.18.0": "8.18.0",
       "minimatch@<10.2.3": "10.2.3",
-      "basic-ftp@<5.2.0": "5.2.0",
+      "basic-ftp@<5.2.2": "5.2.2",
       "rollup@>=4.0.0 <4.59.0": "4.59.0",
       "picomatch@<2.3.2": "2.3.2",
       "picomatch@>=4.0.0 <4.0.4": "4.0.4",
-      "brace-expansion@>=4.0.0 <5.0.5": "5.0.5"
+      "brace-expansion@>=4.0.0 <5.0.5": "5.0.5",
+      "protobufjs@<7.5.5": "7.5.5",
+      "protobufjs@>=8.0.0 <8.0.1": "8.0.1"
     }
   },
   "devDependencies": {