From 0f7d6f278ff282254e43393c76ebd05b9d1c8128 Mon Sep 17 00:00:00 2001 From: tomas Date: Mon, 27 Jul 2026 17:52:17 +0000 Subject: [PATCH 1/4] chore(deps): Resolve dependency vulnerabilities (2026-07-27) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remediate all 19 non-ignored npm audit advisories reported by better-npm-audit. Fixable advisories are pinned to patched versions (overrides / direct-dep bumps, matching repo convention); the one advisory with no backport is documented as accepted risk in .nsprc. Each pin targets the *lowest* version that clears the advisory while staying inside every consumer's declared range, so no consumer is forced across a major. Pinned to patched versions: - brace-expansion [GHSA-3jxr-9vmj-r5cp, high]: selectors widened per major line — <1.1.13 -> <1.1.16 (1.1.16), >=2.0.0 <2.0.3 -> >=2.0.0 <2.1.2 (2.1.2), plus a new >=5.0.0 <5.0.8 -> 5.0.8. The three selectors are pairwise disjoint and cover every installed copy. - fast-uri [GHSA-v2hh-gcrm-f6hx + GHSA-4c8g-83qw-93j6, high]: override ^3.1.2 -> pinned 3.1.4. Switched caret to an exact pin: the caret was leaving 3.1.2 in the lockfile, the same failure mode aef728e94 fixed for dompurify. 3.1.4 clears both ranges (<=3.1.3 and <3.1.3) and stays within ajv's ^3.0.1. - js-yaml [GHSA-52cp-r559-cp3m, high]: direct dep ^4.2.0 -> ^4.3.0 for the 4.x copy, plus a new `js-yaml@3` -> 3.15.0 override for the 3.x copies. The @3 selector does not intersect the direct dep's ^4.3.0, so it does not trigger EOVERRIDE (verified by install). - postcss [GHSA-r28c-9q8g-f849, high]: devDependency AND override both ^8.5.14 -> ^8.5.18, changed in lockstep. npm rejects an override whose spec string differs from a direct dependency's, so a one-sided edit is a hard EOVERRIDE failure. - shell-quote [GHSA-395f-4hp3-45gv, high]: selector widened <1.8.4 -> <1.9.0 (1.9.0), since the previously pinned 1.8.4 is itself now vulnerable — same shape as the undici widening in aef728e94. - tar [5 advisories, worst critical]: override 7.5.16 -> 7.5.21. The binding constraint is GHSA-r292-9mhp-454m (<=7.5.20). npm reported fixAvailable:false because it cannot route a fix through node-gyp's and cacache's ^6 ranges, but the existing pin already forces those to 7.x, so 7.5.21 adds no new compatibility risk. - immutable [GHSA-v56q-mh7h-f735 + GHSA-xvcm-6775-5m9r, high]: new override 4.3.9. Patch-level bump inside @nteract/types' and @nteract/commutable's declared ^4.0.0-rc.12. - dompurify [GHSA-c2j3-45gr-mqc4, low]: override 3.4.11 -> 3.4.12, within mermaid's ^3.3.1. - body-parser [GHSA-v422-hmwv-36x6, low]: new override 2.3.0. A direct express bump is not available — express@5.2.1 is already latest and declares body-parser ^2.2.1, which admits 2.3.0. Accepted-risk exception added to .nsprc: - brace-expansion [GHSA-mh99-v99m-4gvg, high]: the range is <=5.0.7 with no lower bound, so only 5.0.8 escapes it and the EXPANSION_MAX_LENGTH fix was never backported — 1.1.16 and 2.1.2 are the latest 1.x/2.x releases and both remain affected. Forcing those consumers to 5.x is a breaking change, not just a semver violation: 1.x/2.x export a callable default while 5.x exports only a named `expand`, so minimatch@3/5/8/9 throw at runtime (minimatch itself tried ^5 in 9.0.6-9.0.8 and reverted in 9.0.9). Glob patterns in this extension are never built from untrusted input. Removed from .nsprc: - js-yaml [GHSA-h67p-54hq-rp68]: obsolete. The note claimed "no 3.x backport exists (latest 3.x is 3.14.2)", but js-yaml 3.15.0 has since been published as the v3-legacy backport and both consumers declare ^3.13.1. The new `js-yaml@3` -> 3.15.0 override fixes those copies outright, so the exception is no longer warranted. Note on applying override changes: npm validates an existing lockfile against raw dependency specs, not overridden ones, so widening a range-selector override is silently ignored when the locked version still satisfies the consumer's own range. The stale brace-expansion entries had to be dropped from package-lock.json to force re-resolution. Verified afterwards that all three lines moved. Verified: `npx better-npm-audit audit` and `--production` both pass; `tsc --noEmit` passes; 2491 unit tests pass; `npm run esbuild-all` succeeds (exercises the bumped postcss build path). Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01YFmRiqkZebrHeTBTHdwV3z --- .nsprc | 4 +- package-lock.json | 386 ++++++++++++++++++++++++---------------------- package.json | 24 +-- 3 files changed, 217 insertions(+), 197 deletions(-) diff --git a/.nsprc b/.nsprc index 5c162e34eb..5035b19df7 100644 --- a/.nsprc +++ b/.nsprc @@ -15,8 +15,8 @@ "notes": "@opentelemetry/core unbounded memory allocation in W3C Baggage propagation parsing (moderate). Reached only via @vscode/extension-telemetry@0.7.7 -> applicationinsights@2.5.0 -> @opentelemetry/core@1.10.1. Accepted risk: telemetry is permanently disabled in this extension (isTelemetryDisabled() in src/platform/telemetry/index.ts hard-returns true), so the Baggage propagator is never exercised. No safe transitive override exists: the fix is @opentelemetry/core>=2.8.0, but applicationinsights@2.5.0 and the 1.x @opentelemetry/sdk-trace-base and @opentelemetry/resources still in the tree call symbols removed in otel 2.x (getEnv, DEFAULT_ATTRIBUTE_COUNT_LIMIT, TracesSamplerValues), so forcing core to 2.x breaks them at runtime. The real remediation is upgrading @vscode/extension-telemetry to >=1.5.2 (which drops applicationinsights and @opentelemetry entirely) — a major upgrade deferred to a dedicated change.", "expiry": "2026-08-15" }, - "GHSA-h67p-54hq-rp68": { - "notes": "js-yaml quadratic-complexity DoS in merge-key handling via repeated aliases (moderate). The top-level js-yaml dependency is bumped to the patched ^4.2.0 (an explicit `js-yaml@4` override is rejected by npm because js-yaml is also a direct dependency), which dedupes the other 4.x consumers. The remaining vulnerable copies are js-yaml@3.14.2, reached only through dev/test tooling (tslint -> js-yaml and @istanbuljs/load-nyc-config -> js-yaml, both declaring ^3.x). Accepted risk: no 3.x backport exists (latest 3.x is 3.14.2, still affected) and forcing these consumers to 4.x is a breaking API change (v4 removed safeLoad/safeDump). These paths run only during local lint/coverage, never in the shipped extension bundle, and do not parse untrusted YAML.", + "GHSA-mh99-v99m-4gvg": { + "notes": "CVE-2026-14257: brace-expansion DoS — expand() bounds the number of results (max, default 100000) but not the cumulative length of each result, so a small input built from repeated non-expanding groups exhausts the heap and crashes the process with an uncatchable OOM. The advisory range is <=5.0.7 with no lower bound, so it covers every published version except 5.0.8; the fix (EXPANSION_MAX_LENGTH, default 4000000 chars) exists only on the 5.x line and was never backported — 1.1.16 and 2.1.2 are the latest 1.x/2.x releases and both still cap only the result count. The 5.x copies (@vscode/vsce -> minimatch@10.2.5, vscode-extension-tester -> glob@13 -> minimatch@10.2.5) are pinned to the patched 5.0.8 via the `brace-expansion@>=5.0.0 <5.0.8` override, and the 1.x/2.x copies are pinned to 1.1.16/2.1.2 via the sibling overrides, which clears GHSA-3jxr-9vmj-r5cp on every line. Accepted risk: the residual copies are brace-expansion@1.1.16 and @2.1.2, held on their majors by minimatch@3.1.5 (^1.1.7), minimatch@5.1.9/8.0.7 (^2.0.1) and minimatch@9.0.9 (^2.0.2). Forcing them to 5.x is a breaking change, not just a semver violation: 1.x/2.x export a callable default (module.exports = expandTop) while 5.x exports only a named `expand`, so minimatch@3/5 (require('brace-expansion')(...)) and minimatch@8/9 (__importDefault(...).default(...)) throw at runtime — minimatch itself tried brace-expansion@^5 in 9.0.6-9.0.8 and reverted in 9.0.9. Reachability: glob patterns are never built from untrusted input — the shipped call site (FileSystem.globFiles in src/platform/common/platform/fileSystem.node.ts) passes extension-authored patterns, and the remaining paths (glob@9.3.5, vscode-languageclient, @deepnote/sql-language-server -> sqlite3/node-gyp and -> @google-cloud/bigquery -> rimraf) glob local build and workspace paths, not user-supplied brace expressions. The real remediation is upstream minimatch adopting brace-expansion 5.x.", "expiry": "2026-08-15" } } diff --git a/package-lock.json b/package-lock.json index 3d2dcd6a52..1b8654d297 100644 --- a/package-lock.json +++ b/package-lock.json @@ -52,7 +52,7 @@ "inversify": "^6.0.1", "isomorphic-ws": "^4.0.1", "jquery": "^3.6.0", - "js-yaml": "^4.2.0", + "js-yaml": "^4.3.0", "jsonc-parser": "3.3.1", "lodash": "^4.18.1", "marked": "^4.0.10", @@ -224,7 +224,7 @@ "node-html-parser": "^6.1.13", "node-stdlib-browser": "^1.3.1", "nyc": "^15.1.0", - "postcss": "^8.5.14", + "postcss": "^8.5.18", "prettier": "^3.0.0", "relative": "^3.0.2", "rimraf": "^5.0.1", @@ -3282,9 +3282,9 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "license": "MIT", "dependencies": { "argparse": "^1.0.7", @@ -9344,9 +9344,9 @@ } }, "node_modules/@vscode/test-cli/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "dev": true, "license": "MIT", "dependencies": { @@ -9912,16 +9912,16 @@ } }, "node_modules/@vscode/vsce/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/@vscode/vsce/node_modules/chalk": { @@ -11566,20 +11566,20 @@ "license": "MIT" }, "node_modules/body-parser": { - "version": "2.2.2", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz", - "integrity": "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==", + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz", + "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", "license": "MIT", "dependencies": { "bytes": "^3.1.2", - "content-type": "^1.0.5", + "content-type": "^2.0.0", "debug": "^4.4.3", - "http-errors": "^2.0.0", - "iconv-lite": "^0.7.0", + "http-errors": "^2.0.1", + "iconv-lite": "^0.7.2", "on-finished": "^2.4.1", - "qs": "^6.14.1", - "raw-body": "^3.0.1", - "type-is": "^2.0.1" + "qs": "^6.15.2", + "raw-body": "^3.0.2", + "type-is": "^2.1.0" }, "engines": { "node": ">=18" @@ -11589,6 +11589,19 @@ "url": "https://opencollective.com/express" } }, + "node_modules/body-parser/node_modules/content-type": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz", + "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, "node_modules/body-parser/node_modules/iconv-lite": { "version": "0.7.2", "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz", @@ -11605,21 +11618,6 @@ "url": "https://opencollective.com/express" } }, - "node_modules/body-parser/node_modules/qs": { - "version": "6.15.2", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz", - "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==", - "license": "BSD-3-Clause", - "dependencies": { - "side-channel": "^1.1.0" - }, - "engines": { - "node": ">=0.6" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, "node_modules/boolbase": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/boolbase/-/boolbase-1.0.0.tgz", @@ -11669,9 +11667,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -15499,9 +15497,9 @@ } }, "node_modules/dompurify": { - "version": "3.4.11", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.11.tgz", - "integrity": "sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==", + "version": "3.4.12", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz", + "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -17457,9 +17455,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz", - "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", "funding": [ { "type": "github", @@ -18356,9 +18354,9 @@ } }, "node_modules/glob/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" @@ -19548,9 +19546,10 @@ } }, "node_modules/immutable": { - "version": "4.3.8", - "resolved": "https://registry.npmjs.org/immutable/-/immutable-4.3.8.tgz", - "integrity": "sha512-d/Ld9aLbKpNwyl0KiM2CT1WYvkitQ1TSvmRtkcV8FKStiDoA7Slzgjmb/1G2yhKM1p0XeNOieaTbFZmU1d3Xuw==" + "version": "4.3.9", + "resolved": "https://registry.npmjs.org/immutable/-/immutable-4.3.9.tgz", + "integrity": "sha512-ObHy4YN7ycwZOUCLI1/6svfyAFu7vL8RhAvVu/bh/RZW9EPlOyDaQ9jDQWCtdqzaXUjgXZCW1migtHE7YI7UGQ==", + "license": "MIT" }, "node_modules/import-fresh": { "version": "3.3.1", @@ -22668,9 +22667,9 @@ "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==" }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "funding": [ { "type": "github", @@ -25144,9 +25143,9 @@ } }, "node_modules/mocha/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "dev": true, "license": "MIT", "dependencies": { @@ -25466,9 +25465,9 @@ } }, "node_modules/nanoid": { - "version": "3.3.11", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz", - "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==", + "version": "3.3.16", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", + "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", "funding": [ { "type": "github", @@ -27692,9 +27691,9 @@ } }, "node_modules/postcss": { - "version": "8.5.14", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz", - "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==", + "version": "8.5.23", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz", + "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==", "funding": [ { "type": "opencollective", @@ -27711,7 +27710,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.11", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, @@ -28232,7 +28231,6 @@ "version": "6.15.2", "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz", "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==", - "dev": true, "license": "BSD-3-Clause", "dependencies": { "side-channel": "^1.1.0" @@ -29217,9 +29215,9 @@ } }, "node_modules/rimraf/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" @@ -30367,9 +30365,9 @@ } }, "node_modules/shell-quote": { - "version": "1.8.4", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", - "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", + "version": "1.9.0", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz", + "integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==", "dev": true, "license": "MIT", "engines": { @@ -31699,9 +31697,9 @@ } }, "node_modules/tar": { - "version": "7.5.16", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz", - "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==", + "version": "7.5.21", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.21.tgz", + "integrity": "sha512-XdhtCvlMywwxpCW8YEq3lOXBJpUPTR2OHHcwLPO3HwsJqOHa2Ok/oJ7ruGzp+JrKoRPVCzJwAdEjqLW/vNRPHA==", "license": "BlueOak-1.0.0", "dependencies": { "@isaacs/fs-minipass": "^4.0.0", @@ -32552,9 +32550,9 @@ } }, "node_modules/tslint/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, "license": "MIT", "peer": true, @@ -32700,17 +32698,34 @@ } }, "node_modules/type-is": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz", - "integrity": "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==", + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz", + "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==", "license": "MIT", "dependencies": { - "content-type": "^1.0.5", + "content-type": "^2.0.0", "media-typer": "^1.1.0", "mime-types": "^3.0.0" }, "engines": { - "node": ">= 0.6" + "node": ">= 18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/type-is/node_modules/content-type": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz", + "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/type-is/node_modules/mime-db": { @@ -34245,16 +34260,16 @@ } }, "node_modules/vscode-extension-tester/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/vscode-extension-tester/node_modules/c8": { @@ -34564,9 +34579,9 @@ } }, "node_modules/vscode-languageclient/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" @@ -37455,7 +37470,7 @@ "camelcase": "^5.3.1", "find-up": "^4.1.0", "get-package-type": "^0.1.0", - "js-yaml": "^3.13.1", + "js-yaml": "3.15.0", "resolve-from": "^5.0.0" }, "dependencies": { @@ -37477,9 +37492,9 @@ } }, "js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "requires": { "argparse": "^1.0.7", "esprima": "^4.0.0" @@ -38298,7 +38313,7 @@ "htmlparser2": "^8.0.0", "is-plain-object": "^5.0.0", "parse-srcset": "^1.0.2", - "postcss": "^8.5.14" + "postcss": "^8.5.18" } } } @@ -39257,7 +39272,7 @@ "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==", "requires": { "fast-deep-equal": "^3.1.3", - "fast-uri": "^3.1.2", + "fast-uri": "3.1.4", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } @@ -39989,7 +40004,7 @@ "resolved": "https://registry.npmjs.org/@nteract/commutable/-/commutable-7.4.6.tgz", "integrity": "sha512-/SHntsZVMKaK7Ckqe2NDPZz7mx0a2l2Cjf2WDzdK/LB3khVCRfmTBC2dX7wVsx+FHlPU6dhVf7HO7XCdA9+22g==", "requires": { - "immutable": "^4.0.0-rc.12", + "immutable": "4.3.9", "uuid": "^8.0.0" }, "dependencies": { @@ -40114,7 +40129,7 @@ "integrity": "sha512-a7lGMWdjfz2QGlZbAiFHifU9Nhk9ntwg/iKUTMIMRPY1Wfs5UreHSMt+vZ8OY5HGjxicfHozBatGDKXeKXFHMQ==", "requires": { "@nteract/commutable": "^7.4.5", - "immutable": "^4.0.0-rc.12", + "immutable": "4.3.9", "rxjs": "^6.6.0", "uuid": "^8.0.0" }, @@ -40399,7 +40414,7 @@ "dev": true, "requires": { "fast-deep-equal": "^3.1.3", - "fast-uri": "^3.1.2", + "fast-uri": "3.1.4", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } @@ -40694,7 +40709,7 @@ "@tailwindcss/oxide-win32-arm64-msvc": "4.1.14", "@tailwindcss/oxide-win32-x64-msvc": "4.1.14", "detect-libc": "^2.0.4", - "tar": "7.5.16" + "tar": "7.5.21" } }, "@tailwindcss/oxide-android-arm64": { @@ -40853,7 +40868,7 @@ "@alloc/quick-lru": "^5.2.0", "@tailwindcss/node": "4.1.14", "@tailwindcss/oxide": "4.1.14", - "postcss": "^8.5.14", + "postcss": "^8.5.18", "tailwindcss": "4.1.14" } }, @@ -42169,9 +42184,9 @@ }, "dependencies": { "brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "dev": true, "requires": { "balanced-match": "^1.0.0" @@ -42467,9 +42482,9 @@ "dev": true }, "brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "requires": { "balanced-match": "^4.0.2" @@ -43708,21 +43723,26 @@ "dev": true }, "body-parser": { - "version": "2.2.2", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz", - "integrity": "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==", + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz", + "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", "requires": { "bytes": "^3.1.2", - "content-type": "^1.0.5", + "content-type": "^2.0.0", "debug": "^4.4.3", - "http-errors": "^2.0.0", - "iconv-lite": "^0.7.0", + "http-errors": "^2.0.1", + "iconv-lite": "^0.7.2", "on-finished": "^2.4.1", - "qs": "6.15.2", - "raw-body": "^3.0.1", - "type-is": "^2.0.1" + "qs": "^6.15.2", + "raw-body": "^3.0.2", + "type-is": "^2.1.0" }, "dependencies": { + "content-type": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz", + "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==" + }, "iconv-lite": { "version": "0.7.2", "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz", @@ -43730,14 +43750,6 @@ "requires": { "safer-buffer": ">= 2.1.2 < 3.0.0" } - }, - "qs": { - "version": "6.15.2", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz", - "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==", - "requires": { - "side-channel": "^1.1.0" - } } } }, @@ -43774,9 +43786,9 @@ } }, "brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "requires": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" @@ -44135,7 +44147,7 @@ "promise-inflight": "^1.0.1", "rimraf": "^3.0.2", "ssri": "^8.0.1", - "tar": "7.5.16", + "tar": "7.5.21", "unique-filename": "^1.1.1" }, "dependencies": { @@ -45044,7 +45056,7 @@ "date-fns": "^2.30.0", "lodash": "^4.18.1", "rxjs": "^7.8.1", - "shell-quote": "1.8.4", + "shell-quote": "1.9.0", "spawn-command": "0.0.2", "supports-color": "^8.1.1", "tree-kill": "^1.2.2", @@ -46495,9 +46507,9 @@ } }, "dompurify": { - "version": "3.4.11", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.11.tgz", - "integrity": "sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==", + "version": "3.4.12", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz", + "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==", "requires": { "@types/trusted-types": "^2.0.7" } @@ -47792,7 +47804,7 @@ "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==", "requires": { "accepts": "^2.0.0", - "body-parser": "^2.2.1", + "body-parser": "2.3.0", "content-disposition": "^1.0.0", "content-type": "^1.0.5", "cookie": "^0.7.1", @@ -47967,9 +47979,9 @@ "integrity": "sha512-Ue0LwpDYErFbmNnZSF0UH6eImUwDmogUO1jyE+JbN2gsQz/jICm1Ve7t9QT0rNSsfJt+Hs4/S3GnsDVjL4HVrw==" }, "fast-uri": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz", - "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==" + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==" }, "fastest-levenshtein": { "version": "1.0.16", @@ -48559,9 +48571,9 @@ }, "dependencies": { "brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "requires": { "balanced-match": "^1.0.0" } @@ -49424,9 +49436,9 @@ "integrity": "sha512-tmjF/k8QDKydUlm3mZU+tjM6zeq9/fFpPqH9SzWmBnVVKsPBg/V66qsMwb3/Bo90cgUN+ghdVBess+hPsxUyRw==" }, "immutable": { - "version": "4.3.8", - "resolved": "https://registry.npmjs.org/immutable/-/immutable-4.3.8.tgz", - "integrity": "sha512-d/Ld9aLbKpNwyl0KiM2CT1WYvkitQ1TSvmRtkcV8FKStiDoA7Slzgjmb/1G2yhKM1p0XeNOieaTbFZmU1d3Xuw==" + "version": "4.3.9", + "resolved": "https://registry.npmjs.org/immutable/-/immutable-4.3.9.tgz", + "integrity": "sha512-ObHy4YN7ycwZOUCLI1/6svfyAFu7vL8RhAvVu/bh/RZW9EPlOyDaQ9jDQWCtdqzaXUjgXZCW1migtHE7YI7UGQ==" }, "import-fresh": { "version": "3.3.1", @@ -51543,9 +51555,9 @@ "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==" }, "js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "requires": { "argparse": "^2.0.1" } @@ -52930,7 +52942,7 @@ "d3-sankey": "^0.12.3", "dagre-d3-es": "7.0.14", "dayjs": "^1.11.19", - "dompurify": "3.4.11", + "dompurify": "3.4.12", "es-toolkit": "^1.45.1", "katex": "^0.16.25", "khroma": "^2.1.0", @@ -53038,7 +53050,7 @@ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz", "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", "requires": { - "brace-expansion": "^1.1.7" + "brace-expansion": "1.1.16" } }, "minimist": { @@ -53225,9 +53237,9 @@ }, "dependencies": { "brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "dev": true, "requires": { "balanced-match": "^1.0.0" @@ -53484,9 +53496,9 @@ "dev": true }, "nanoid": { - "version": "3.3.11", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz", - "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==" + "version": "3.3.16", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", + "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==" }, "napi-build-utils": { "version": "2.0.0", @@ -53676,7 +53688,7 @@ "npmlog": "^6.0.0", "rimraf": "^3.0.2", "semver": "^7.3.5", - "tar": "7.5.16", + "tar": "7.5.21", "which": "^2.0.2" }, "dependencies": { @@ -55061,11 +55073,11 @@ "dev": true }, "postcss": { - "version": "8.5.14", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz", - "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==", + "version": "8.5.23", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz", + "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==", "requires": { - "nanoid": "^3.3.11", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } @@ -55437,7 +55449,6 @@ "version": "6.15.2", "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz", "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==", - "dev": true, "requires": { "side-channel": "^1.1.0" } @@ -56146,9 +56157,9 @@ }, "dependencies": { "brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "requires": { "balanced-match": "^1.0.0" } @@ -56571,7 +56582,7 @@ "htmlparser2": "^8.0.0", "is-plain-object": "^5.0.0", "parse-srcset": "^1.0.2", - "postcss": "^8.5.14" + "postcss": "^8.5.18" }, "dependencies": { "escape-string-regexp": { @@ -56931,9 +56942,9 @@ "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==" }, "shell-quote": { - "version": "1.8.4", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", - "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", + "version": "1.9.0", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz", + "integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==", "dev": true }, "shellwords": { @@ -57295,7 +57306,7 @@ "node-addon-api": "^7.0.0", "node-gyp": "8.x", "prebuild-install": "^7.1.1", - "tar": "7.5.16" + "tar": "7.5.21" }, "dependencies": { "node-addon-api": { @@ -57679,7 +57690,7 @@ "@types/stylis": "4.2.7", "css-to-react-native": "3.2.0", "csstype": "3.2.3", - "postcss": "^8.5.14", + "postcss": "^8.5.18", "shallowequal": "1.1.0", "stylis": "4.3.6", "tslib": "2.6.2" @@ -57826,7 +57837,7 @@ "dev": true, "requires": { "fast-deep-equal": "^3.1.3", - "fast-uri": "^3.1.2", + "fast-uri": "3.1.4", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } @@ -57898,9 +57909,9 @@ "dev": true }, "tar": { - "version": "7.5.16", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz", - "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==", + "version": "7.5.21", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.21.tgz", + "integrity": "sha512-XdhtCvlMywwxpCW8YEq3lOXBJpUPTR2OHHcwLPO3HwsJqOHa2Ok/oJ7ruGzp+JrKoRPVCzJwAdEjqLW/vNRPHA==", "requires": { "@isaacs/fs-minipass": "^4.0.0", "chownr": "^3.0.0", @@ -58493,7 +58504,7 @@ "commander": "^2.12.1", "diff": "4.0.4", "glob": "^7.1.1", - "js-yaml": "^3.13.1", + "js-yaml": "3.15.0", "minimatch": "^3.0.4", "mkdirp": "^0.5.3", "resolve": "^1.3.2", @@ -58542,9 +58553,9 @@ } }, "js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, "peer": true, "requires": { @@ -58652,15 +58663,20 @@ "integrity": "sha512-diALGSg9wBpvowixHbIeCJtXNxUKJHUNR8oE67K9zuPkpBe5FMmg+dpevDWmEwGQDmn/RJD3m7szs6Ssdz5A4w==" }, "type-is": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz", - "integrity": "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==", + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz", + "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==", "requires": { - "content-type": "^1.0.5", + "content-type": "^2.0.0", "media-typer": "^1.1.0", "mime-types": "^3.0.0" }, "dependencies": { + "content-type": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz", + "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==" + }, "mime-db": { "version": "1.54.0", "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz", @@ -59929,9 +59945,9 @@ "dev": true }, "brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "requires": { "balanced-match": "^4.0.2" @@ -60127,9 +60143,9 @@ }, "dependencies": { "brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "requires": { "balanced-match": "^1.0.0" } diff --git a/package.json b/package.json index 8dc22af21d..d2adcbfaff 100644 --- a/package.json +++ b/package.json @@ -2714,7 +2714,7 @@ "inversify": "^6.0.1", "isomorphic-ws": "^4.0.1", "jquery": "^3.6.0", - "js-yaml": "^4.2.0", + "js-yaml": "^4.3.0", "jsonc-parser": "3.3.1", "lodash": "^4.18.1", "marked": "^4.0.10", @@ -2886,7 +2886,7 @@ "node-html-parser": "^6.1.13", "node-stdlib-browser": "^1.3.1", "nyc": "^15.1.0", - "postcss": "^8.5.14", + "postcss": "^8.5.18", "prettier": "^3.0.0", "relative": "^3.0.2", "rimraf": "^5.0.1", @@ -2951,7 +2951,7 @@ "flatted": "3.4.2", "vega-embed": "^7.1.0", "@mermaid-js/layout-elk": "npm:empty-pkg@1.0.0", - "tar": "7.5.16", + "tar": "7.5.21", "mocha": { "diff": "5.2.2" }, @@ -2974,18 +2974,22 @@ "serialize-javascript@<7.0.5": "7.0.5", "undici@<6.27.0": "6.27.0", "flatted@<3.4.2": "3.4.2", - "brace-expansion@<1.1.13": "1.1.13", - "brace-expansion@>=2.0.0 <2.0.3": "2.0.3", + "brace-expansion@<1.1.16": "1.1.16", + "brace-expansion@>=2.0.0 <2.1.2": "2.1.2", + "brace-expansion@>=5.0.0 <5.0.8": "5.0.8", "yaml": "2.8.3", - "dompurify": "3.4.11", - "fast-uri": "^3.1.2", + "dompurify": "3.4.12", + "fast-uri": "3.1.4", "ip-address": "^10.1.1", "mermaid": "11.15.0", - "postcss": "^8.5.14", + "postcss": "^8.5.18", "qs@<6.15.2": "6.15.2", - "shell-quote@<1.8.4": "1.8.4", + "shell-quote@<1.9.0": "1.9.0", "@babel/core@<7.29.6": "7.29.6", "form-data@>=3.0.0 <3.0.5": "3.0.5", - "form-data@>=4.0.0 <4.0.6": "4.0.6" + "form-data@>=4.0.0 <4.0.6": "4.0.6", + "body-parser": "2.3.0", + "immutable": "4.3.9", + "js-yaml@3": "3.15.0" } } From dae1d7d1dedefdd0fe8d5e62923e39357fb742c7 Mon Sep 17 00:00:00 2001 From: tomas Date: Mon, 27 Jul 2026 18:21:17 +0000 Subject: [PATCH 2/4] fix(build): Propagate security overrides into sql-lsp-modules MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `buildSqlLanguageServer` writes a synthetic package.json into dist/sql-lsp-modules and runs `npm install --omit=dev --ignore-scripts` there, then deletes the lockfile. That install inherits neither the repo's `overrides` nor its lockfile, so transitive dependencies pinned for security at the repo level silently resolved to vulnerable versions inside the shipped VSIX. `.vscodeignore`'s `node_modules/**` is root-anchored and does not match dist/sql-lsp-modules/node_modules/**, so those copies ship. `npm audit` cannot see any of it. Two packages were affected: - ssh2: the root pins 1.17.0, but the isolated install resolved node-ssh-forward's own `^0.8.9` to ssh2@0.8.9 — GHSA-652h-xwhf-q4h6, high, OS command injection (<1.4.0). This is the copy that actually executes: the bundle marks `ssh2` and `node-ssh-forward` external and loads them from dist, so the repo-level pin never protected the shipped SSH tunneling path. - tar: resolved to 6.2.1 via sqlite3's `^6.1.11`, covered by all five current tar advisories. Dead weight rather than live exposure — no file in the shipped sqlite3 copy requires tar, and --ignore-scripts means the build-from-source path never runs — but it still shipped. The pins are sourced from the root package.json rather than hardcoded, so a future bump of either override cannot drift out of sync with this build step; a missing or non-string entry fails the build loudly rather than silently shipping an unpinned version. Verified after a clean rebuild: dist/sql-lsp-modules resolves ssh2@1.17.0 and tar@7.5.21, and node-ssh-forward loads against ssh2 1.x with Client/connect/forwardOut all present — the only API surface it uses (`new Client()`, `connect({privateKey, agentForward})`, `forwardOut()`), all stable across 0.8 -> 1.x. An end-to-end SSH-tunneled database connection was NOT exercised; that needs a real SSH host. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01YFmRiqkZebrHeTBTHdwV3z --- build/esbuild/build.ts | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/build/esbuild/build.ts b/build/esbuild/build.ts index c313ce8cf8..2762d26752 100644 --- a/build/esbuild/build.ts +++ b/build/esbuild/build.ts @@ -81,6 +81,13 @@ const watchAll = process.argv.includes('--watch-all'); const isWatchMode = watchAll || process.argv.includes('--watch'); const extensionFolder = path.join(__dirname, '..', '..'); +// Package names whose root package.json `overrides` entry must be propagated into the generated +// sql-lsp-modules package.json. That install runs in isolation with no lockfile and no inherited +// overrides, so a transitive dependency pinned for security at the repo level would otherwise +// resolve to a vulnerable version inside the shipped VSIX. Sourcing the pins from the root +// package.json keeps them from drifting apart. +const sqlLspOverridesToPropagate = ['ssh2', 'tar']; + interface StylePluginOptions { /** * whether to minify the css code. @@ -660,6 +667,20 @@ async function buildSqlLanguageServer() { await fs.ensureDir(sqlLspNodeModules); // Create a minimal package.json and install dependencies + const rootPackageJson = await fs.readJSON(path.join(extensionFolder, 'package.json')); + const rootOverrides: Record = rootPackageJson.overrides || {}; + const overrides: Record = {}; + + for (const name of sqlLspOverridesToPropagate) { + if (typeof rootOverrides[name] === 'string') { + overrides[name] = rootOverrides[name]; + } else { + throw new Error( + `Expected a string "${name}" entry in the root package.json overrides to propagate to sql-lsp-modules.` + ); + } + } + const packageJson = { name: 'sql-lsp-deps', version: '1.0.0', @@ -669,7 +690,8 @@ async function buildSqlLanguageServer() { pg: '^8.9.0', sqlite3: '^5.0.3', '@google-cloud/bigquery': '^8.1.1' - } + }, + overrides }; const packageJsonPath = path.join(sqlLspNodeModules, 'package.json'); From b140079a5a7d22672c773b3f503b8dff0d4474ea Mon Sep 17 00:00:00 2001 From: tomas Date: Mon, 27 Jul 2026 18:27:38 +0000 Subject: [PATCH 3/4] fix(deps): Normalize legacy lockfile spec for brace-expansion MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Package Lock Drift Check failed: `npm install` rewrote one line of package-lock.json, so the committed lockfile was not what a fresh install produces. Fallout from remediating the brace-expansion advisories. npm ignores a widened range-selector override when the locked version still satisfies the consumer's raw spec, so the stale entries had to be pruned from the lockfile to force re-resolution. Regenerating them wrote the *overridden* spec into the legacy `dependencies` tree that lockfileVersion 2 keeps alongside `packages`: "minimatch": { "version": "3.1.5", "requires": { - "brace-expansion": "1.1.16" + "brace-expansion": "^1.1.7" `requires` records the consumer's declared range, not the resolved version, so it must mirror minimatch@3.1.5's own `^1.1.7` — which is exactly what the authoritative `packages` entry already carried, and what a clean `npm install` normalizes it back to. Audited every other legacy entry referencing brace-expansion; this was the only one affected, matching CI's one-line diff. No resolution change: brace-expansion still resolves to 1.1.16 via the `brace-expansion@<1.1.16` override. Verified: `npm install` followed by `git diff --exit-code HEAD` is now clean, reproducing the CI check. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01YFmRiqkZebrHeTBTHdwV3z --- package-lock.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package-lock.json b/package-lock.json index 1b8654d297..a3dcd43d19 100644 --- a/package-lock.json +++ b/package-lock.json @@ -53050,7 +53050,7 @@ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz", "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", "requires": { - "brace-expansion": "1.1.16" + "brace-expansion": "^1.1.7" } }, "minimist": { From 8e61d89de7f7b551d1054cf47c9fc293d8180764 Mon Sep 17 00:00:00 2001 From: tomas Date: Tue, 28 Jul 2026 09:39:49 +0000 Subject: [PATCH 4/4] docs(build): Shorten the sql-lsp overrides comment Five lines restating the commit rationale; trimmed to the one fact a reader needs at the call site. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01YFmRiqkZebrHeTBTHdwV3z --- build/esbuild/build.ts | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/build/esbuild/build.ts b/build/esbuild/build.ts index 2762d26752..d9bf27dd73 100644 --- a/build/esbuild/build.ts +++ b/build/esbuild/build.ts @@ -81,11 +81,8 @@ const watchAll = process.argv.includes('--watch-all'); const isWatchMode = watchAll || process.argv.includes('--watch'); const extensionFolder = path.join(__dirname, '..', '..'); -// Package names whose root package.json `overrides` entry must be propagated into the generated -// sql-lsp-modules package.json. That install runs in isolation with no lockfile and no inherited -// overrides, so a transitive dependency pinned for security at the repo level would otherwise -// resolve to a vulnerable version inside the shipped VSIX. Sourcing the pins from the root -// package.json keeps them from drifting apart. +// Security pins copied from the root `overrides` into the generated sql-lsp-modules package.json, +// which npm installs in isolation and would otherwise resolve to vulnerable versions. const sqlLspOverridesToPropagate = ['ssh2', 'tar']; interface StylePluginOptions {