2.0.31 relies on protobufjs 8.0.0 mentioned in CVE-2026-41242

Starting a new issue because the issue was closed but led to a new issue, see follow up comment:

Hi @hassy I see @opentelemetry/[email protected] updated to an another vulnerable version of protobuf version 8.0.0. 8.0.1 should fix it and needs upgrading @opentelemetry packages to v0.215.0. link I see its planned for an upcoming sprint? Should we reopen the issue and update the title?

Originally posted by @arjhun in #3721

We are now overriding otlp-transformer to 8.0.1 for the time being.