[jinxiao]

Issue

Closes #259
Refs #255

Summary

Patch the development/reference protobufjs dependency from 7.5.4 to exact 7.6.6, clear the official-registry npm advisories, and retain the Powertools TypeScript 2.35.0 baseline. Add the existing npm audit command to runtime CI so known low-or-higher reference-tool advisories fail the normal gate.

The patched uint32 reader changes one observable boundary diagnostic: prefixes shorter than five bytes now report a one-byte bounds read. Align the Go wrapper with that result, preserve the five-to-nine-byte ten-byte skip diagnostic, and record the patched fixture provenance. No schema, decoded value, callback position, error category or native-message result changes.

Testing

• Official-registry npm audit: 104 packages, zero reported vulnerabilities after the patch. The configured mirror has no audit endpoint; the gate explicitly selects the official registry.

• Regenerated and structurally compared 220 prefix cases plus nine native messages: only protobufVersion and exactly 62 near-end diagnostic messages differ.

• CGO_ENABLED=0 go test ./kafka/protobuf passed, including the full corpus, native descriptors, concurrency/reentrancy/cancellation, and new prefix lengths 0-9 plus a valid near-end value.

• actionlint and all 24 CI routing/gate/evidence regressions passed.

• Separate read-only PyPA pip-audit 2.10.1 audit of the documentation lock export: 11 packages, no known vulnerabilities; no Python dependency change needed.

• Full hosted module/runtime/release checks must pass on the final head before merge.

• Full CI 39882856563 exposed two mixed-event fixtures with the prior diagnostic. Regenerated all 172 events using the fixed dependencies; structural comparison proves only four matching error strings changed. CGO-disabled native SDK mixed-event tests now pass. This corrects fixture provenance; no additional production behavior changed.

Risks and compatibility

protobufjs is a development fixture tool, not a Go Lambda runtime dependency. Schemas in the fixture generator are repository-controlled; npm severity does not establish a first-party runtime exploit. Error text for truncated uint32 prefixes changes as described above. All direct reference versions except protobufjs remain fixed. The closed, unmerged release plan #258 published no tags; regenerate the v1.3.0 plan against the merged source and reuse release issue #257.

Release notes

• kafka/protobuf | fix | Match the patched reference reader's one-byte bounds diagnostic for truncated short prefixes.
• repository | maintenance | Patch protobufjs reference tooling to 7.6.6 and reject known npm advisories during runtime CI.

Integration links

Optional repository integration links may appear below this section.

[jinxiao]

Author/maintainer review of 4f2b60d: direct pins and lock diff are limited to protobufjs 7.6.6 and removal of its unused inquire dependency; the Powertools baseline stays 2.35.0. Reviewed the patched upstream reader source: lengths 0-4 now fail a one-byte near-end read, while lengths 5-9 retain the ten-byte skip diagnostic. The Go change matches both paths and preserves valid decoding. Structural fixture comparison proves only version provenance and 62 such errors changed across 220 cases plus nine native messages. No ignored npm advisories, no fixture-result coercion, and no remaining code blocker identified. Local Go tests, actionlint and 24 routing/evidence tests passed; merge still requires exact-head hosted acceptance. This is not an independent approval.

[jinxiao]

Follow-up fixture review: regenerated the mixed Kafka corpus with protobufjs 7.6.6 after full CI identified two stale empty-message cases. Structural comparison of all 172 events shows only four instances of the same one-byte bounds diagnostic changed; schema, metadata, successful values, callback positions and categories are unchanged. The native Lambda SDK mixed-event suite passes locally with CGO disabled. The production code change remains exactly the previously reviewed prefix diagnostic; final hosted checks are required on the new head.

[jinxiao]

Final maintainer review: no blocking findings on d668b41. The protobufjs 7.6.6 upgrade preserves successful decoding and aligns only truncated-read diagnostics with the patched reference. Reviewed the 220 adapter cases, nine native cases and 172 mixed-mode scenarios; four mixed-mode error strings changed, without changing event payloads or callback ordering. The official npm audit reports zero vulnerabilities across 104 packages. This is author/maintainer review, not an independent approval.

Exact-head CI https://github.com/rambow-cloud/powertools-lambda-go/actions/runs/39884294589 passed Modules and Lambda artifacts, Runtime simulation, DynamoDB Local, documentation, release tooling, CI gate and Full regression. All Go checks used CGO_ENABLED=0. The latest contribution policy passed; an earlier superseded policy run was cancelled. No AWS cloud or race tests were performed. Merge is authorized by the user; #255 remains open through publication and final acceptance.