Fix multiple CVEs by updating protobufjs to patched versions

[sbouchet]

What does this PR do?

This PR fixes CVE-2026-41242 and CVE-2026-59877
protobuf.js versions are updated to 7.6.5 and 8.7.1

What issues does this PR fix?

https://redhat.atlassian.net/browse/CRW-11976
https://redhat.atlassian.net/browse/CRW-11936

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

• the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
• the corresponding items were added to the CHANGELOG.md file
• rules for automatic git rebase were added to the .rebase folder

Summary by CodeRabbit

• Bug Fixes

  • Improved dependency resolution for Copilot-related functionality.
  • Addressed potential compatibility issues involving protocol buffer packages.

• Chores

  • Updated release tracking information for the dependency-related changes.

[github-actions]

Click here to review and test in web IDE:

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-773-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-773-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-773-dev-amd64

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8f321edc-39ee-426f-b02b-bd84c95dbab7

📥 Commits

Reviewing files that changed from the base of the PR and between d2d7be6 and 6644af4.

⛔ Files ignored due to path filters (1)

• code/extensions/copilot/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

• .rebase/CHANGELOG.md
• .rebase/add/code/extensions/copilot/package.json
• code/extensions/copilot/package.json

---

📝 Walkthrough

Walkthrough

The Copilot package configuration now constrains protobufjs versions for @grpc/proto-loader and @opentelemetry/otlp-transformer through targeted overrides. The same override entries are added to the rebase package configuration, and the change is recorded in .rebase/CHANGELOG.md.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: romannikitenko, azatsarynnyy, rgrunber

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise, imperative, and accurately summarizes the protobufjs security update.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Rebase Rules For Upstream Changes	✅ Passed	The PR changes code/extensions/copilot/package.json, adds the matching .rebase/add rule and CHANGELOG entry, and rebase.sh already routes that file.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}