From 9bd05d6ac9bfc746212717946849d97be182057a Mon Sep 17 00:00:00 2001 From: Michael Gasperini Date: Sat, 31 Oct 2026 23:41:21 +0100 Subject: [PATCH 1/2] fix(deps): bump @azure/identity to 4.14.1, clearing the msal-node advisory GHSA-xcx6-jx8p-x3h5 (high) via @vscode/vsce failed the audit gate on main. identity 4.14.1 moves its msal requirement from ^6 to ^7.1.0, resolving msal-node 7.1.2. Verified: check:security exits 0 (3 moderate left, below the high gate), vsce ls passes, 27 unit tests green. --- package-lock.json | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/package-lock.json b/package-lock.json index 166e5d0..b8feacf 100644 --- a/package-lock.json +++ b/package-lock.json @@ -125,9 +125,9 @@ } }, "node_modules/@azure/identity": { - "version": "4.14.0", - "resolved": "https://registry.npmjs.org/@azure/identity/-/identity-4.14.0.tgz", - "integrity": "sha512-8utCLdTZn14CiAe0HW4JbtzUMsc0mdDwnjUvStFMrR4IxQP8S2eL9zVAdplpfORVJGYmidZElpeXRYjJQ4UyUw==", + "version": "4.14.1", + "resolved": "https://registry.npmjs.org/@azure/identity/-/identity-4.14.1.tgz", + "integrity": "sha512-HHuuFrmN1uuF9D5A6aAo5eHzNFNX4Q+P4SksZqDKse5YaJFFy/zDLG3wXHEV2FVGgetZ3QM8jGURNBtnQYf1NQ==", "dev": true, "license": "MIT", "dependencies": { @@ -140,7 +140,7 @@ "@azure/core-util": "^1.11.0", "@azure/logger": "^1.0.0", "@azure/msal-browser": "^5.5.0", - "@azure/msal-node": "^6.0.0", + "@azure/msal-node": "^7.1.0", "open": "^11.0.0", "tslib": "^2.2.0" }, @@ -186,13 +186,13 @@ } }, "node_modules/@azure/msal-node": { - "version": "6.0.1", - "resolved": "https://registry.npmjs.org/@azure/msal-node/-/msal-node-6.0.1.tgz", - "integrity": "sha512-ixSO1Y/kCVRthRs+hSx/5qkwaunX1/RAePhlMN0wIpIQ4WEZ6AREGGnGd1AP0qspHVsAwzWQKGubpjh50JyJIQ==", + "version": "7.1.2", + "resolved": "https://registry.npmjs.org/@azure/msal-node/-/msal-node-7.1.2.tgz", + "integrity": "sha512-52hKQLGpEQzwNufIXG1SPVU+wQ3RIe7Rp2+g+VdAmZojCAZ6yCdGEffzQEQ6RnBZGBEs40nl14rWBmfJpCoHsg==", "dev": true, "license": "MIT", "dependencies": { - "@azure/msal-common": "16.14.1", + "@azure/msal-common": "16.15.0", "jsonwebtoken": "^9.0.0" }, "engines": { @@ -200,9 +200,9 @@ } }, "node_modules/@azure/msal-node/node_modules/@azure/msal-common": { - "version": "16.14.1", - "resolved": "https://registry.npmjs.org/@azure/msal-common/-/msal-common-16.14.1.tgz", - "integrity": "sha512-Or6xhPNyi4zHW25158yxBoyxuCqNSPa5YBVqfF1J5Ks4MJWBo/USXdp05DQIPu1Zli00YZu6t0+h6KvHJealxQ==", + "version": "16.15.0", + "resolved": "https://registry.npmjs.org/@azure/msal-common/-/msal-common-16.15.0.tgz", + "integrity": "sha512-lwdLb1B9Q5nEhPLVIKe78XH5wFMN15fCiDkY7ylPDSWZuWcD93G3jpJajrKhO3CQld8SLKz0sHiOi24mxdvtsg==", "dev": true, "license": "MIT", "engines": { From 296c45383cba833a1feed3de16814004ac3f8e6b Mon Sep 17 00:00:00 2001 From: Michael Gasperini Date: Sat, 31 Oct 2026 23:41:21 +0100 Subject: [PATCH 2/2] ci: scope the @types/vscode ignore rule to npm, align setup-node to v7.1.0 The ignore block sat under the github-actions update where it never applied, so the npm group PR carried the @types/vscode 1.103 to 1.140 major. Move it under npm like the sibling launchers. Bump the three setup-node pins from v6 to v7.1.0. --- .github/dependabot.yml | 8 ++++---- .github/workflows/ci.yml | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b27348d..2f2763e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -26,6 +26,10 @@ updates: open-pull-requests-limit: 5 labels: - dependencies + ignore: + # The @types/vscode major tracks the engine floor declared in package.json; + # advancing the types ahead of the floor breaks the compatibility tests. + - dependency-name: "@types/vscode" - package-ecosystem: github-actions directory: / @@ -45,7 +49,3 @@ updates: open-pull-requests-limit: 5 labels: - dependencies - ignore: - # The @types/vscode major tracks the engine floor declared in package.json; - # advancing the types ahead of the floor breaks the compatibility tests. - - dependency-name: "@types/vscode" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ab366a3..4b39b43 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -36,7 +36,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Setup Node.js - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 22 cache: npm @@ -74,7 +74,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Setup Node.js - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 22 cache: npm @@ -100,7 +100,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Setup Node.js - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 22 cache: npm