Wait for steam-user bumps steam-appticket to ^2.0.1 in /steam_bot (protobufjs@^7.5.8 required to fix security vulnerability)

[shibeta]

Background

• Upgrading steam-appticket dependency via steam-user in /steam_bot (bump from 1.0.1 to ^2.0.1) is proposed.
• This upgrade requires protobufjs@^7.5.6 to address some security vulnerability.

Blocking/Tracking

• Wait for merge/release of steam-user PR #535

References

• Arbitrary code execution in protobufjs - GHSA-xq3m-2v4x-88gg
• protobufjs has overlong UTF-8 decoding - GHSA-q6x5-8v7m-xcrf
• protobuf.js: Denial of service from crafted field names in generated code - GHSA-2pr8-phx7-x9h3
• protobuf.js: Code injection through bytes field defaults in generated toObject code - GHSA-66ff-xgx4-vchm
• protobuf.js: Prototype injection in generated message constructors - GHSA-fx83-v9x8-x52w
• protobuf.js: Code generation gadget after prototype pollution - GHSA-75px-5xx7-5xc7
• protobuf.js: Process-wide denial of service through unsafe option paths - GHSA-jvwf-75h9-cwgg
• protobuf.js: Denial of service through unbounded protobuf recursion - GHSA-685m-2w69-288q
• protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion - GHSA-jggg-4jg4-v7c6

---

• This issue tracks the dependency upgrade and should be closed when the upstream PR is merged and released, and the fix can be applied locally.