Replace unmaintained aab-parser to clear protobufjs CVEs (REV-36)

protobufjs entered the tree only via aab-parser@1.0.1, which hard-pins
protobufjs ^6.11.2. Every reachable 6.x version is affected by 11 npm audit
advisories (worst: critical 9.8 RCE), and all fixes land above the pinned
range, so npm audit fix could not resolve it.

An npm `overrides` bump was insufficient: overrides are honored only for the
root project (so end-users installing the published CLI stay vulnerable), and
protobufjs 7.x's strict import resolution exposed that aab-parser ships a
broken Resources.proto (imports an unshipped Configuration.proto), breaking AAB
parsing at runtime. No maintained pure-JS alternative exists — the maintained
options wrap Google's Java bundletool and would add a JRE requirement.

Instead, vendor the small piece actually used:
- Remove aab-parser; add maintained protobufjs ^7.6.3 and jszip ^3.10.1 as
  direct deps.
- script/utils/aab-utils.ts: parseAabManifest() reproducing aab-parser's logic
  (jszip -> decode aapt.pb.XmlNode -> extract attributes), same shape/errors.
- script/utils/aab-resources-descriptor.ts: exact aapt.pb schema embedded as a
  compiled JSON descriptor, so it ships through plain tsc with no .proto asset
  and no Configuration.proto import.
- Swap the single call site in command-executor.ts.

Verified: tsc clean; protobufjs gone from npm audit; differential test on a
real 36MB app-release.aab shows byte-identical output between old aab-parser
(protobufjs 6.11.x) and the vendored parser (7.6.5).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: revopushbot

package-lock.json

@@ -24,7 +24,6 @@
   ],
   "dependencies": {
     "@devicefarmer/adbkit-apkreader": "^3.2.4",
-    "aab-parser": "^1.0.1",
     "adm-zip": "^0.5.16",
     "backslash": "^0.2.0",
     "bplist-parser": "^0.3.2",
@@ -34,13 +33,15 @@
     "email-validator": "^2.0.4",
     "gradle-to-js": "2.0.1",
     "jsonwebtoken": "^9.0.2",
+    "jszip": "^3.10.1",
     "moment": "^2.29.4",
     "opener": "^1.5.2",
     "parse-duration": "1.1.0",
     "plist": "^3.1.0",
     "progress": "^2.0.3",
     "prompt": "^1.3.0",
     "properties": "^1.2.1",
+    "protobufjs": "^7.6.3",
     "q": "~1.5.1",
     "recursive-fs": "2.1.0",
     "rimraf": "^2.5.1",

package.json

@@ -15,7 +15,7 @@ import * as semver from "semver";
 import * as cli from "../script/types/cli";
 import sign from "./sign";
 const ApkReader = require("@devicefarmer/adbkit-apkreader");
-const aabParser = require("aab-parser");
+import { parseAabManifest } from "./utils/aab-utils";
 import {
   AccessKey,
   Account,
@@ -1564,7 +1564,7 @@ export const releaseNative = (command: cli.IReleaseNativeCommand): Promise<void>
           } else if (targetBinaryPathNormalised.endsWith(".aab")) {
             log(chalk.cyan(`\nExtracting AAB file:\n`));
             await extractAAB(targetBinaryPath, extractFolder);
-            const { versionName: appStoreVersion, versionCode } = await aabParser.parseAabManifest(targetBinaryPath);
+            const { versionName: appStoreVersion, versionCode } = await parseAabManifest(targetBinaryPath);
 
             const metadataZip = await extractMetadataFromAndroid(`${extractFolder}/base`, outputFolder); // base folder is nested in AAB
             releaseCommandPartial = {