Address security vulnerabilities in transitive dependencies and docs updates

[nikhil2611]

Overview

This PR addresses security vulnerabilities in transitive dependencies by adding npm overrides to enforce patched versions.

Changes

Added overrides section in package.json to enforce secure versions of transitive dependencies:

Package	Version	Security Fix
js-yaml	5.2.2	Quadratic CPU consumption in omap resolution
undici	8.9.0	Multiple cross-user disclosure and injection issues
markdown-it	15.0.0	DoS in smartquotes rule via replaceAt operations
linkify-it	6.1.0	DoS via mailto validator scan-loop
brace-expansion	5.0.9	DoS in glob expansion

HAR Security Compliance

All package versions meet HAR security policy requirements:

• ✅ 14-day minimum release age enforced
• ✅ All packages verified from pkg.harness.io registry
• ✅ No direct dependency version changes

Test Results

• ✅ Build passes: npm run vscode:prepublish
• ✅ Reduced from 8 HIGH/MODERATE to 3 LOW severity issues
• ✅ Remaining LOW issues are indirect dependencies (@tootallnate/once)

Impact

• Addresses 8 of 9 Dependabot alerts (89% resolution)
• No breaking changes to extension functionality
• Minimal change approach (only overrides, no dependency upgrades)

[Copilot]

Pull request overview

This PR updates the extension’s development toolchain dependencies (TypeScript, VSCE, VS Code test tooling, and type packages) and removes deprecated TSLint usage, with the goal of restoring a green build and reducing security/deprecation risk.

Changes:

• Updated several devDependencies (TypeScript, @vscode/vsce, @vscode/test-electron, @types/*) and regenerated package-lock.json.
• Removed the legacy tslint:disable directive from extension.ts.
• Added explicit contents: read job permissions to the GitHub Actions CI workflow.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
package.json	Bumps dev tooling dependencies and adds a js-yaml override.
package-lock.json	Regenerated lockfile reflecting updated tooling dependency tree.
extension.ts	Removes obsolete TSLint directive comment.
.github/workflows/ci.yml	Adds job-level contents: read permissions for CI jobs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (3)

.github/workflows/ci.yml:30

• The build job still uses Node 20.x, but the updated dev toolchain now includes packages that declare Node >=22 (e.g. @vscode/test-electron@3.0.0, and transitive deps like undici@8.9.0). This is likely to break npm ci/npx vsce package in CI, or at least produce engine-related failures.

Either pin devDependencies to Node-20-compatible versions, or update the CI Node version to match the new dependency requirements.

      permissions:
        contents: read
      strategy:
        matrix:
          node-version: [20.x]

package.json:43

• @vscode/test-electron was bumped to 3.0.0, but the resolved package in package-lock.json declares engines.node >=22. If this repo/tooling is intended to keep building on Node 20.x (as CI currently does), this upgrade will likely make installs or test tooling fail.

Consider either (a) keeping @vscode/test-electron on a Node-20-compatible major, or (b) moving the repo’s build/test toolchain to Node 22+ (and aligning @types/node accordingly).

    "typescript": "5.7.2",
    "@vscode/vsce": "3.9.2",
    "@vscode/test-electron": "3.0.0"

package.json:48

• The new overrides are forcing major-version upgrades that conflict with the semver ranges declared by your transitive dependencies (e.g. markdown-it depends on linkify-it: ^5.0.2, but the lock resolves linkify-it 6.1.0; other deps request js-yaml: ^4.1.1, but the lock resolves js-yaml 5.2.2). Overriding outside the supported major can cause subtle runtime failures in tooling (vsce/markdown rendering/config loading), and makes future dependency updates harder.

Prefer upgrading the direct dependents to versions that accept the newer majors, or keep overrides within the major versions those packages declare support for.

  "overrides": {
    "js-yaml": "5.2.2",
    "linkify-it": "6.1.0",
    "undici": "8.9.0"

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/ci.yml:30

• The build job still uses Node 20.x, but the updated tooling now pulls in packages that declare Node >=22 (e.g., @vscode/test-electron@3.0.0 in package-lock.json has engines.node ">=22" and undici@8.9.0 has engines.node ">=22.19.0"). This can cause installs or build tooling (npx vsce package) to fail or behave inconsistently depending on local/CI Node version.

Update the CI Node version to a Node 22.19+ release (or alternatively revert the dependency upgrades to Node-20-compatible versions).

      permissions:
        contents: read
      strategy:
        matrix:
          node-version: [22.x]

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (3)

.github/workflows/ci.yml:30

• CI uses node-version: [22.x], but the lockfile now includes packages with stricter engine requirements (e.g. undici@8.9.0 requires Node >=22.19.0). Using a floating 22.x can pick a 22 release that’s below 22.19, which may cause install/runtime issues. Consider pinning the CI Node version to at least 22.19.x (or whatever minimum you intend to support) to match the dependency engine constraints.

          node-version: [22.x]

package.json:49

• The new top-level overrides force major-version jumps that are outside the ranges declared by dependents in the lockfile (e.g. markdown-it depends on linkify-it: ^5.0.2 but linkify-it is forced to 6.1.0; cheerio depends on undici: ^7.19.0 but undici is forced to 8.9.0). This can break assumptions about compatibility and makes future dependency upgrades harder to reason about. Prefer using versions that satisfy declared ranges (or upgrade the dependents to versions that officially support the newer major), and scope overrides as narrowly as possible.

  "overrides": {
    "js-yaml": "5.2.2",
    "undici": "8.9.0"
  },
  "extensionDependencies": [

package.json:43

• The dependency upgrades effectively raise the required Node version for dev/build tooling: @vscode/test-electron@3.0.0 declares engines.node: >=22 (see lockfile), and some @azure/* transitive deps used by @vscode/vsce@3.9.2 declare >=22.0.0. This conflicts with the PR description calling out “Node.js 20 LTS type definitions” and may surprise developers still on Node 20. Please clarify the supported Node version and align the repo metadata accordingly (e.g., update @types/node/docs/CI pin) so installs and builds are predictable.

    "@types/node": "20.17.15",
    "@types/vscode": "1.83.3",
    "path": "0.12.7",
    "typescript": "5.7.2",
    "@vscode/vsce": "3.9.2",
    "@vscode/test-electron": "3.0.0"

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/ci.yml:30

• The workflow sets Node.js to 22.x, but the updated dependency tree includes undici@8.9.0 which declares an engine requirement of node >=22.19.0 (see package-lock.json entry). Using a broad 22.x range can select a Node 22 release below 22.19.0 and fail npm ci/tool execution. Pin the CI Node version to at least 22.19.0 (or a 22.19.x range) to match the dependency engines constraint.

      strategy:
        matrix:
          node-version: [22.x]

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

package.json:41

• The devDependency versions for @types/vscode and @vscode/test-electron are using caret ranges, which contradicts the PR description's stated policy of exact version pinning. Also, @types/vscode is set to ^1.125.0 while engines.vscode is ^1.83.0; using typings for a much newer VS Code version undermines type-safety for the declared engine range and can hide accidental usage of APIs not available in 1.83.x.

    "@types/node": "20.17.15",
    "@types/vscode": "^1.125.0",
    "@vscode/test-electron": "^3.1.0",
    "@vscode/vsce": "3.9.2",

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

.github/workflows/ci.yml:31

• CI now runs on Node 22.19.0, which conflicts with the PR description framing @types/node as “Node.js 20 LTS type definitions”. Given package-lock.json now includes dependencies requiring Node >=22 (and undici requires >=22.19.0), consider updating the PR description and/or making the required Node version explicit for contributors (e.g., via package.json engines.node, .nvmrc, or documentation).

      strategy:
        matrix:
          node-version: [22.19.0]
      steps:

package.json:41

• PR description says @vscode/test-electron was updated to 3.0.0, but package.json pins it to 3.1.0 (and package-lock.json matches 3.1.0). Please align the description with the actual version, or adjust the dependency versions if 3.0.0 was intended.

    "@vscode/test-electron": "3.1.0",
    "@vscode/vsce": "3.9.2",

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (6)

• Same issue here: “tomorrow” is relative and will become wrong. Use an explicit date.

- ⏳ **1 alert pending** (fast-uri - available tomorrow Aug 15)

package.json:44

• This dependency update effectively raises the minimum Node.js version needed for dev tooling (e.g., @vscode/test-electron now declares node >=22 in package-lock). Consider declaring a Node engine requirement in package.json so local installs/builds fail fast with a clear message instead of cryptic runtime/tool errors.

  "devDependencies": {
    "@types/node": "20.17.15",
    "@types/vscode": "1.83.3",
    "@vscode/test-electron": "3.1.0",
    "@vscode/vsce": "3.9.2",
    "path": "0.12.7",
    "typescript": "5.7.2"
  },

package.json:41

• PR description says @vscode/test-electron is updated to 3.0.0, but package.json pins it to 3.1.0. Please align the PR description with the actual version (or adjust the dependency if 3.0.0 was intended).

    "@types/node": "20.17.15",
    "@types/vscode": "1.83.3",
    "@vscode/test-electron": "3.1.0",
    "@vscode/vsce": "3.9.2",

• The document title is branch-specific, which will be inaccurate once merged (and makes the file harder to reuse/refer to later). Consider using a stable title keyed to the ticket/PR purpose instead.

• Avoid relative time wording like “tomorrow” in a committed document; it becomes incorrect immediately after the date changes. Prefer a specific date or a policy-based statement.

| **fast-uri** | HIGH | Host confusion via backslash authority introducer | 3.1.5 or 4.1.2 | July 31, 2026 | **Aug 14-15, 2026** (tomorrow) |

• This line uses relative time (“tomorrow”), which will quickly become stale/confusing in the repo history. Prefer an explicit date.

This issue also appears on line 185 of the same file.

⏳ Remaining fix (fast-uri) will be available tomorrow  

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (4)

• This alert row says @tootallnate/once is still an indirect dependency, but @tootallnate/once is no longer present in package-lock.json after this update. Update the summary so it reflects the current lockfile state (and doesn't incorrectly claim an unresolved Dependabot alert).

| #23 | @tootallnate/once | LOW | Aug 7, 2026 | ⚠️ Indirect dependency of @vscode/vsce |

• The suggested fast-uri override snippet replaces the entire "overrides" object, which would accidentally drop the other security overrides already required in this PR. Update the snippet to show adding fast-uri alongside the existing overrides.

   ```json
   "overrides": {
     "fast-uri": "3.1.5"
   }

* The verified package tree header uses `chef@2.2.14`, but package.json currently declares version 2.2.15 (and the lockfile should match). Update the snippet so it reflects the current package version.

chef@2.2.14

</details>

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

package.json:51

• The override pins undici to 8.9.0, but the resulting lockfile entry declares engines.node: >=22.19.0 (see package-lock.json around the undici entry). CI currently installs dependencies on Node 20.x (.github/workflows/ci.yml:26), so this override can introduce engine incompatibility warnings or break build/packaging depending on how undici/its consumers behave on Node 20. Either bump the project/CI Node version to >=22.19.0 or select an undici version that is both patched and compatible with the project’s Node 20 toolchain.

  "overrides": {
    "js-yaml": "5.2.2",
    "undici": "8.9.0",
    "markdown-it": "15.0.0",
    "linkify-it": "6.1.0",
    "brace-expansion": "5.0.9"

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

package.json:42

• PR description states "No direct dependency version changes" and a minimal "only overrides" approach, but this diff also upgrades multiple direct devDependencies (e.g., @vscode/vsce, @vscode/test-electron, typescript). This is a scope/communication mismatch and also changes the required Node toolchain (e.g., @vscode/test-electron@3.1.0 requires Node >=22). Consider either splitting the PR (overrides-only vs toolchain upgrades) or updating the PR description/title to reflect these direct upgrades and the Node version bump.

    "@types/node": "20.17.15",
    "@types/vscode": "1.83.3",
    "@vscode/test-electron": "3.1.0",
    "@vscode/vsce": "3.9.2",
    "path": "0.12.7",

.github/workflows/ci.yml:30

• CI pins Node to an exact patch version. Since the dependency tree now requires Node >=22.19.0, using a semver range (e.g., 22.19.x) keeps the minimum while still picking up security/bugfix patch updates automatically.

          node-version: [22.19.0]

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (2)

package.json:50

• These overrides force major versions that don't satisfy some dependents' declared semver ranges (e.g., @vscode/vsce requires markdown-it ^14.1.0 and cheerio requires undici ^7.19.0; package-lock.json:628 and :1144). Prefer overriding to patched versions that remain within the existing major ranges to reduce breakage risk while still addressing the vulnerabilities.

    "js-yaml": "5.2.2",
    "undici": "8.9.0",
    "markdown-it": "15.0.0",
    "linkify-it": "6.1.0",
    "brace-expansion": "5.0.9"

package.json:43

• PR description claims "No direct dependency version changes", but this PR updates several direct devDependencies here (e.g., @vscode/test-electron, @vscode/vsce, typescript). Either update the PR description to clarify that direct devDependencies are being upgraded, or revert these direct version bumps if they’re out of scope for the stated goal.

    "@vscode/test-electron": "3.1.0",
    "@vscode/vsce": "3.9.2",
    "path": "0.12.7",
    "typescript": "5.7.2"