chore(deps): resolve dependency vulnerabilities (2026-11-10)

.nsprc

@@ -10,9 +10,5 @@
     "GHSA-g3hv-75wg-m249": {
         "notes": "CVE-2026-118764: at optimizationLevel >= 2, minimatch's firstPhasePreProcess() splits every `**/..` portion of a pattern inside a fixpoint loop and secondPhasePreProcess() then compares every pair, so a short crafted pattern (14 repetitions of `**/../a/b` take about 4 s) exhausts CPU. Only the pattern triggers it, never the matched path, and only at optimizationLevel 2, which glob 9+ sets and minimatch's default (1) does not. Accepted risk: the fix exists only in minimatch 11.0.1+ (3.x, 5.x, 9.x and 10.x have no backport), no dependent in this tree except glob 14 admits 11, and 11.0 is a rewrite (no default export, makeRe and matchOne removed) that an override cannot force without breaking glob 7 and 10 matching, test-exclude 6 and eslint-plugin-import (they call minimatch as a function) and the default import in src/platform/interpreter/reservedNamedProvider.node.ts. The shipped copies do not contain the vulnerable preprocessing and are flagged by version range only: 3.1.5 (hoisted; bundled through reservedNamedProvider.node.ts's direct import, and prod-optional via @deepnote/sql-language-server -> sqlite3 -> node-gyp/cacache -> glob 7, install-time tooling) and 5.1.9 (vscode-languageclient 9.0.1). The shipped glob 14.0.3 runs its own inlined, fixed minimatch. The copies that contain the vulnerable code are dev-only and receive patterns only from this repository's own configuration: 9.0.9 under mocha 11.8.0 and rimraf 5.0.10 (via glob 10), and 10.2.5/10.2.6 under @vscode/vsce, @vscode/test-cli, c8, vscode-extension-tester and @actions/glob; in src/test/vscode-notebook-perf (mirrored in its osv-scanner.toml), 10.2.6 (hoisted) and 9.0.9 under @vscode/test-cli's mocha. The latest vscode-languageclient 11.0.0, mocha 12.0.3, @vscode/vsce 4.1.0, @vscode/test-cli 0.0.15 and test-exclude 8.0.0 still declare minimatch ^10, and eslint-plugin-import 2.32.0 declares ^3.1.2. Revisit at expiry for backports or dependents that admit minimatch >=11.0.1.",
         "expiry": "2026-11-15"
-    },
-    "GHSA-xcx6-jx8p-x3h5": {
-        "notes": "CVE-2026-109461: @azure/msal-node's authorization code flow (acquireTokenByCode) may disclose request parameters to an attacker-controlled endpoint. Accepted risk: dev-only and not shipped (`npm ls @azure/msal-node --omit=dev` is empty; node_modules/** is excluded from the VSIX). One copy, @azure/msal-node@6.0.1, reached via @vscode/vsce (root and under vscode-extension-tester) -> @azure/identity@4.14.0. vsce uses @azure/identity only for `vsce publish` / `verify-pat --azure-credential`, through a chain of environment, Azure CLI and managed-identity credentials that never runs the authorization code flow; this repository only runs `vsce package`. The fix exists only on the 7.x line (first patched 7.1.0; 6.x has no backport), and the latest @azure/identity (4.14.0) still declares @azure/msal-node ^6.0.0, so a lockfile bump cannot reach it. Remove this entry and its osv-scanner.toml mirror once an @azure/identity release admits msal-node >=7.1.0.",
-        "expiry": "2026-11-10"
     }
 }

osv-scanner.toml

@@ -15,8 +15,3 @@ reason = "CVE-2025-14505 (elliptic): dev-only, via node-stdlib-browser; no patch
 id = "GHSA-g3hv-75wg-m249"
 ignoreUntil = 2026-11-15
 reason = "CVE-2026-118764 (minimatch): crafted-pattern DoS; shipped copies lack the code, dev copies get repo patterns only; fix only in 11.x. See .nsprc."
-
-[[IgnoredVulns]]
-id = "GHSA-xcx6-jx8p-x3h5"
-ignoreUntil = 2026-11-10
-reason = "CVE-2026-109461 (@azure/msal-node): dev-only, via @vscode/vsce; flow never used; no 6.x fix. See .nsprc."