FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Run npm audit fix to address non-breaking security vulnerabilities by Copilot · Pull Request #25899 · microsoft/vscode-python · GitHub

Run npm audit fix to address non-breaking security vulnerabilities - #25899

Draft
Raymond Zhao (rzhao271) with Copilot wants to merge 2 commits into
mainfrom
copilot/run-npm-audit-fix
Draft

Run npm audit fix to address non-breaking security vulnerabilities#25899
Raymond Zhao (rzhao271) with Copilot wants to merge 2 commits into
mainfrom
copilot/run-npm-audit-fix

Conversation

Copilot AI commented Apr 6, 2026

Copy link
Copy Markdown

Summary

Ran npm audit fix (no force flag, no overrides) to address security vulnerabilities that can be fixed without breaking changes.

Changes

  • Updated package-lock.json with fixed dependency versions

Remaining vulnerabilities

The following vulnerabilities require --force (breaking changes) and were not addressed per task requirements:

  • elliptic: Cryptographic primitive with risky implementation (would require upgrading node-polyfill-webpack-plugin to v4.1.0 — breaking change)
  • got / http-cache-semantics: High severity redirect and ReDoS vulnerabilities (would require downgrading download to v3.3.0 — breaking change)
  • minimatch: ReDoS vulnerabilities (would require upgrading @typescript-eslint/parser to v8.58.0 — breaking change)
  • serialize-javascript: RCE and CPU exhaustion vulnerabilities (would require upgrading copy-webpack-plugin to v14.0.0 — breaking change)

Raymond Zhao (rzhao271) added this to the 1.116.0 milestone Apr 6, 2026
Raymond Zhao (rzhao271) added no-changelog No news entry required skip package*.json package.json and package-lock.json don't both need updating labels Apr 6, 2026
Raymond Zhao (rzhao271) marked this pull request as ready for review April 6, 2026 18:55

Copy link
Copy Markdown

Requires fixing vscode/test.

Raymond Zhao (rzhao271) marked this pull request as draft April 6, 2026 20:34

Copy link
Copy Markdown

I closed microsoft/vscode-test#325 since merging it just to fix Windows tests with spaces might regress an earlier issue.

Copy link
Copy Markdown

Copilot Modify Windows tests to not use paths with spaces

Copilot AI commented Apr 6, 2026

Copy link
Copy Markdown
Author

Copilot Modify Windows tests to not use paths with spaces

Renamed src/testTestingRootWkspc/target workspace → src/testTestingRootWkspc/target_workspace and updated the corresponding reference in testingAdapter.test.ts in commit 4d2b9e2.

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

no-changelog No news entry required skip package*.json package.json and package-lock.json don't both need updating skip-issue-check

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants


Back | FazBrowse Home | New Git URL