security.ts uses an Object instead of a Map to store line number mappings, which makes it vulnerability to Prototype Pollution.
Unfortunately, our repo wasn't performing security scans until yesterday Oct 14, which should help prevent these vulnerabilities in the future.
Steps:
- Merge a fix and push a new release
- Verify our extension would have caught this in the introducing PR e.g. create a branch using
git fetch origin "+pull/41/head:mcp_test"