Possible fix(deps): 13 vulnerable dependencies in package-lock.json

[begininvoke]

This might be a false positive, but packages/kafka/load-tests/package-lock.json around line 1388 looked worth a second pair of eyes.

This CRITICAL vulnerability allows attackers to inject arbitrary JavaScript code via the 'type' field in protobuf definitions. When malicious data is decoded using protobufjs v8.0.0, the crafted type payload executes, enabling Remote Code Execution (RCE) and potential full environment compromise. Immediate upgrade to v8.0.1+ is required to sanitize type fields and prevent code execution during decoding.

Something like this might fix it:

Update the `protobufjs` dependency version in your project's `package.json` to `8.0.1` (or `^8.0.1`) and regenerate the lockfile. Apply the following diff:

```diff
--- a/packages/kafka/load-tests/package.json
+++ b/packages/kafka/load-tests/package.json
@@ -... +... @@
   "dependencies": {
-    "protobufjs": "8.0.0"
+    "protobufjs": "8.0.1"
   }
```
Then execute `npm install` or `yarn install` to update `packages/kafka/load-tests/package-lock.json` with the patched version.

For reference: rule CVE-2026-41242. Rated critical.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.