chore: bump up protobufjs version to v7.6.5 [SECURITY] (#15296)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [protobufjs](https://redirect.github.com/protobufjs/protobuf.js) |
[`7.6.4` →
`7.6.5`](https://renovatebot.com/diffs/npm/protobufjs/7.6.4/7.6.5) |
![age](https://developer.mend.io/api/mc/badges/age/npm/protobufjs/7.6.5?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/protobufjs/7.6.4/7.6.5?slim=true)
|

---

### protobufjs: Denial of Service via infinite loop in .proto option
parsing
[CVE-2026-59877](https://nvd.nist.gov/vuln/detail/CVE-2026-59877) /
[GHSA-j3f2-48v5-ccww](https://redirect.github.com/advisories/GHSA-j3f2-48v5-ccww)

<details>
<summary>More information</summary>

#### Details
##### Summary

protobufjs parsed option names by advancing through schema tokens until
it reached an `=` token, without checking for end of input. A crafted
`.proto` schema that opens an option declaration but ends prematurely
could cause the option parser to loop without ever terminating.

This affects the reflection parsing path (`parse`, `Root.load`,
`Root.loadSync`).

##### Impact

An attacker who can provide or influence `.proto` schema text parsed by
an application may be able to cause the parsing call to never return.
Because Node.js is single-threaded, the blocked event loop prevents all
other work in the process, resulting in a denial of service that
persists until the process is externally terminated.

Applications that only encode or decode protobuf binary data with
trusted schemas are not directly affected.

##### Preconditions

- The application must parse `.proto` schema text influenced by an
attacker.
- The schema must be parsed through APIs such as `parse`, `Root.load`,
or `Root.loadSync`.
- The crafted input must begin an option declaration that ends before
its `=` assignment.

##### Workarounds

Do not parse `.proto` schemas from untrusted sources with affected
versions. If untrusted schema text must be accepted, isolate parsing in
a process or worker that can be safely terminated and bound it with a
timeout, so a non-returning parse call cannot deny service to the rest
of the application.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww](https://redirect.github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-59877](https://nvd.nist.gov/vuln/detail/CVE-2026-59877)
-
[https://github.com/protobufjs/protobuf.js/pull/2352](https://redirect.github.com/protobufjs/protobuf.js/pull/2352)
-
[https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217](https://redirect.github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217)
-
[https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f](https://redirect.github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f)
-
[https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5](https://redirect.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5)
-
[https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6](https://redirect.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6)
-
[https://github.com/advisories/GHSA-j3f2-48v5-ccww](https://redirect.github.com/advisories/GHSA-j3f2-48v5-ccww)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-j3f2-48v5-ccww)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>protobufjs/protobuf.js (protobufjs)</summary>

###
[`v7.6.5`](https://redirect.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5):
protobufjs: v7.6.5

[Compare
Source](https://redirect.github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.4...protobufjs-v7.6.5)

##### Bug Fixes

- handle EOF during options parsing
([#&#8203;2352](https://redirect.github.com/protobufjs/protobuf.js/issues/2352))
([#&#8203;2356](https://redirect.github.com/protobufjs/protobuf.js/issues/2356))
([10fba6d](https://redirect.github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/toeverything/AFFiNE).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzIuNCIsInVwZGF0ZWRJblZlciI6IjQzLjI3Mi40IiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5IiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

yarn.lock

@@ -31018,8 +31018,8 @@ __metadata:
   linkType: hard
 
 "protobufjs@npm:^7.6.4":
-  version: 7.6.4
-  resolution: "protobufjs@npm:7.6.4"
+  version: 7.6.5
+  resolution: "protobufjs@npm:7.6.5"
   dependencies:
     "@protobufjs/aspromise": "npm:^1.1.2"
     "@protobufjs/base64": "npm:^1.1.2"
@@ -31032,7 +31032,7 @@ __metadata:
     "@protobufjs/utf8": "npm:^1.1.1"
     "@types/node": "npm:>=13.7.0"
     long: "npm:^5.3.2"
-  checksum: 10/eb6898f3a128ba8622509c89b274b9cf899fbe9ecdea4a94e68a608b3c82f45161f78ee32ea650695976a06a7af217e3bffec387ae244b8e8aab23287a971ea9
+  checksum: 10/58a5a635fbe0632a5c48a1ab659fabfc26d5b994915a20ad623a2cfb59a2ca7411d9f4f690ca79074967b632e2db58ecc184ab507927f5b7d0852fc16568d3da
   languageName: node
   linkType: hard