diff --git a/.nsprc b/.nsprc index a59af647b..cf9c03bbe 100644 --- a/.nsprc +++ b/.nsprc @@ -10,9 +10,5 @@ "GHSA-g3hv-75wg-m249": { "notes": "CVE-2026-118764: at optimizationLevel >= 2, minimatch's firstPhasePreProcess() splits every `**/..` portion of a pattern inside a fixpoint loop and secondPhasePreProcess() then compares every pair, so a short crafted pattern (14 repetitions of `**/../a/b` take about 4 s) exhausts CPU. Only the pattern triggers it, never the matched path, and only at optimizationLevel 2, which glob 9+ sets and minimatch's default (1) does not. Accepted risk: the fix exists only in minimatch 11.0.1+ (3.x, 5.x, 9.x and 10.x have no backport), no dependent in this tree except glob 14 admits 11, and 11.0 is a rewrite (no default export, makeRe and matchOne removed) that an override cannot force without breaking glob 7 and 10 matching, test-exclude 6 and eslint-plugin-import (they call minimatch as a function) and the default import in src/platform/interpreter/reservedNamedProvider.node.ts. The shipped copies do not contain the vulnerable preprocessing and are flagged by version range only: 3.1.5 (hoisted; bundled through reservedNamedProvider.node.ts's direct import, and prod-optional via @deepnote/sql-language-server -> sqlite3 -> node-gyp/cacache -> glob 7, install-time tooling) and 5.1.9 (vscode-languageclient 9.0.1). The shipped glob 14.0.3 runs its own inlined, fixed minimatch. The copies that contain the vulnerable code are dev-only and receive patterns only from this repository's own configuration: 9.0.9 under mocha 11.8.0 and rimraf 5.0.10 (via glob 10), and 10.2.5/10.2.6 under @vscode/vsce, @vscode/test-cli, c8, vscode-extension-tester and @actions/glob; in src/test/vscode-notebook-perf (mirrored in its osv-scanner.toml), 10.2.6 (hoisted) and 9.0.9 under @vscode/test-cli's mocha. The latest vscode-languageclient 11.0.0, mocha 12.0.3, @vscode/vsce 4.1.0, @vscode/test-cli 0.0.15 and test-exclude 8.0.0 still declare minimatch ^10, and eslint-plugin-import 2.32.0 declares ^3.1.2. Revisit at expiry for backports or dependents that admit minimatch >=11.0.1.", "expiry": "2026-11-15" - }, - "GHSA-xcx6-jx8p-x3h5": { - "notes": "CVE-2026-109461: @azure/msal-node's authorization code flow (acquireTokenByCode) may disclose request parameters to an attacker-controlled endpoint. Accepted risk: dev-only and not shipped (`npm ls @azure/msal-node --omit=dev` is empty; node_modules/** is excluded from the VSIX). One copy, @azure/msal-node@6.0.1, reached via @vscode/vsce (root and under vscode-extension-tester) -> @azure/identity@4.14.0. vsce uses @azure/identity only for `vsce publish` / `verify-pat --azure-credential`, through a chain of environment, Azure CLI and managed-identity credentials that never runs the authorization code flow; this repository only runs `vsce package`. The fix exists only on the 7.x line (first patched 7.1.0; 6.x has no backport), and the latest @azure/identity (4.14.0) still declares @azure/msal-node ^6.0.0, so a lockfile bump cannot reach it. Remove this entry and its osv-scanner.toml mirror once an @azure/identity release admits msal-node >=7.1.0.", - "expiry": "2026-11-10" } } diff --git a/osv-scanner.toml b/osv-scanner.toml index cb82b88d7..cdd1e52f5 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -15,8 +15,3 @@ reason = "CVE-2025-14505 (elliptic): dev-only, via node-stdlib-browser; no patch id = "GHSA-g3hv-75wg-m249" ignoreUntil = 2026-11-15 reason = "CVE-2026-118764 (minimatch): crafted-pattern DoS; shipped copies lack the code, dev copies get repo patterns only; fix only in 11.x. See .nsprc." - -[[IgnoredVulns]] -id = "GHSA-xcx6-jx8p-x3h5" -ignoreUntil = 2026-11-10 -reason = "CVE-2026-109461 (@azure/msal-node): dev-only, via @vscode/vsce; flow never used; no 6.x fix. See .nsprc." diff --git a/package-lock.json b/package-lock.json index e8b41382b..79850c330 100644 --- a/package-lock.json +++ b/package-lock.json @@ -680,9 +680,9 @@ } }, "node_modules/@azure/identity": { - "version": "4.14.0", - "resolved": "https://registry.npmjs.org/@azure/identity/-/identity-4.14.0.tgz", - "integrity": "sha512-8utCLdTZn14CiAe0HW4JbtzUMsc0mdDwnjUvStFMrR4IxQP8S2eL9zVAdplpfORVJGYmidZElpeXRYjJQ4UyUw==", + "version": "4.14.1", + "resolved": "https://registry.npmjs.org/@azure/identity/-/identity-4.14.1.tgz", + "integrity": "sha512-HHuuFrmN1uuF9D5A6aAo5eHzNFNX4Q+P4SksZqDKse5YaJFFy/zDLG3wXHEV2FVGgetZ3QM8jGURNBtnQYf1NQ==", "dev": true, "license": "MIT", "dependencies": { @@ -695,7 +695,7 @@ "@azure/core-util": "^1.11.0", "@azure/logger": "^1.0.0", "@azure/msal-browser": "^5.5.0", - "@azure/msal-node": "^6.0.0", + "@azure/msal-node": "^7.1.0", "open": "^11.0.0", "tslib": "^2.2.0" }, @@ -741,13 +741,13 @@ } }, "node_modules/@azure/msal-node": { - "version": "6.0.1", - "resolved": "https://registry.npmjs.org/@azure/msal-node/-/msal-node-6.0.1.tgz", - "integrity": "sha512-ixSO1Y/kCVRthRs+hSx/5qkwaunX1/RAePhlMN0wIpIQ4WEZ6AREGGnGd1AP0qspHVsAwzWQKGubpjh50JyJIQ==", + "version": "7.2.1", + "resolved": "https://registry.npmjs.org/@azure/msal-node/-/msal-node-7.2.1.tgz", + "integrity": "sha512-6mntsfCNq7H1eAPSZik74jT3C5at4nRqiVk7OC+D5Hy3Pe3s76uwE4+J0xvDvlVPmoX2kasf3mSwUmzeq9rW/A==", "dev": true, "license": "MIT", "dependencies": { - "@azure/msal-common": "16.14.1", + "@azure/msal-common": "16.16.1", "jsonwebtoken": "^9.0.0" }, "engines": { @@ -755,9 +755,9 @@ } }, "node_modules/@azure/msal-node/node_modules/@azure/msal-common": { - "version": "16.14.1", - "resolved": "https://registry.npmjs.org/@azure/msal-common/-/msal-common-16.14.1.tgz", - "integrity": "sha512-Or6xhPNyi4zHW25158yxBoyxuCqNSPa5YBVqfF1J5Ks4MJWBo/USXdp05DQIPu1Zli00YZu6t0+h6KvHJealxQ==", + "version": "16.16.1", + "resolved": "https://registry.npmjs.org/@azure/msal-common/-/msal-common-16.16.1.tgz", + "integrity": "sha512-dSKdL9h/iercb4GumsKFh+wVvLe1ohuDPiviklgnQVHnY2FYNUlbQJ3E1Qd37vkof9CfraK9BQpCW1hoOg0znQ==", "dev": true, "license": "MIT", "engines": { @@ -20318,9 +20318,9 @@ } }, "node_modules/jsonwebtoken/node_modules/semver": { - "version": "7.8.5", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", - "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==", + "version": "7.8.6", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.6.tgz", + "integrity": "sha512-9lpSSU4Mly3mrtruwLs1eLK6+gzbzqeBFwRNjIjE+9LuDpWdYctrQlQ3ej1Ilgi7gknpsTRnPoLP8DpCHqHIJw==", "dev": true, "license": "ISC", "bin": {