Skip to content

fix(vscode): resolve 5 high-severity npm dependency vulnerabilities#445

Merged
lizhengfeng101 merged 1 commit into
mainfrom
fix/vscode-npm-security-alerts
Jul 22, 2026
Merged

fix(vscode): resolve 5 high-severity npm dependency vulnerabilities#445
lizhengfeng101 merged 1 commit into
mainfrom
fix/vscode-npm-security-alerts

Conversation

@lizhengfeng101

@lizhengfeng101 lizhengfeng101 commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • Add yarn resolutions for brace-expansion (>=2.1.2), fast-uri (>=3.1.4), js-yaml (>=4.3.0), and linkify-it (>=5.0.2)
  • Fixes Dependabot security alerts 21, 22, 23, 24, 25 (all High severity, Development scope)
  • Vulnerabilities addressed: ReDoS/quadratic-complexity DoS in brace-expansion, js-yaml, linkify-it; host-confusion in fast-uri

Verification

  • yarn audit reports 0 vulnerabilities
  • yarn build compiles successfully
  • All 92 unit tests pass

@lizhengfeng101
fix(vscode): resolve 5 high-severity npm dependency vulnerabilities
444468b 
Add yarn resolutions to pin minimum safe versions for brace-expansion
(>=2.1.2), fast-uri (>=3.1.4), js-yaml (>=4.3.0), and linkify-it
(>=5.0.2), fixing DoS and host-confusion vulnerabilities reported by
Dependabot alerts #21-#25.
@lizhengfeng101
lizhengfeng101 requested a review from xyJen July 22, 2026 05:12
@github-actions

github-actions Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

✅ OpenCodeReview: No comments generated. Looks good to me.

xyJen
xyJen approved these changes Jul 22, 2026
View reviewed changes

@xyJen xyJen left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@lizhengfeng101
lizhengfeng101 merged commit 484b513 into main Jul 22, 2026
11 checks passed
@lizhengfeng101
lizhengfeng101 deleted the fix/vscode-npm-security-alerts branch July 22, 2026 05:17
@lizhengfeng101 lizhengfeng101 mentioned this pull request Jul 23, 2026
Merged
lizhengfeng101 added a commit that referenced this pull request Jul 23, 2026
@lizhengfeng101
fix(vscode): bound brace-expansion resolution to avoid poisoned 5.x (#…
fc9cc76 
…467)

The resolutions entry "brace-expansion": ">=2.1.2" had no upper bound,
so yarn resolved it to the poisoned 5.0.7 release whose changed export
shape breaks minimatch's default import, crashing `yarn lint` with
"brace_expansion_1.default is not a function".

Bound the range to ">=2.1.2 <3" (keeping the CVE-safe lower bound from
#445) and regenerate yarn.lock. brace-expansion now resolves to 2.1.2
and its transitive balanced-match back to 1.0.2. Lint, compile and the
92 unit tests all pass.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@xyJen xyJen xyJen approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lizhengfeng101 @xyJen