chore(deps, rust): update rust-lang.rust-analyzer, usernamehw.errorlens in devcontainer-metadata.json - #122

error: A high vulnerability in python package: urllib3, version 2.7.0 was found at: /.devcontainer/cpp/requirements.txt

error: A high vulnerability in python package: urllib3, version 2.7.0 was found at: /.devcontainer/cpp/requirements.txt

warning: A medium vulnerability in python package: urllib3, version 2.7.0 was found at: /.devcontainer/cpp/requirements.txt

warning: 1 warnings emitted
error: 2 errors emitted

Scanning dir .
Starting filesystem walk for root: /
Scanned package-lock.json file and found 73 packages
Scanned .devcontainer/cpp/requirements.txt file and found 20 packages
Scanned test/rust/workspace/clippy/Cargo.lock file and found 1 package
Scanned test/rust/workspace/cortex-mf/Cargo.lock file and found 30 packages
Scanned test/rust/workspace/cargo/Cargo.lock file and found 1 package
Scanned test/rust/workspace/test/Cargo.lock file and found 1 package
Scanned test/rust/workspace/cortex-m/Cargo.lock file and found 30 packages
End status: 61 dirs visited, 220 inodes visited, 7 Extract calls, 32.373366ms elapsed, 32.373597ms wall time
Loaded filter from: test/rust/workspace/cortex-m/osv-scanner.toml
Loaded filter from: test/rust/workspace/cortex-mf/osv-scanner.toml
RUSTSEC-2026-0110 has been filtered out because: bare-metal is deprecated/unmaintained upstream with no fixed version; pulled in transitively by cortex-m in this test fixture crate
RUSTSEC-2026-0110 has been filtered out because: bare-metal is deprecated/unmaintained upstream with no fixed version; pulled in transitively by cortex-m in this test fixture crate
Filtered 2 vulnerabilities from output

Total 3 packages affected by 7 known vulnerabilities (0 Critical, 5 High, 2 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
6 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+-----------------------+---------+---------------+------------------------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE               | VERSION | FIXED VERSION | SOURCE                             |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+------------------------------------+
| https://osv.dev/PYSEC-2026-4175     | 7.6  | PyPI      | urllib3               | 2.7.0   | 2.8.0         | .devcontainer/cpp/requirements.txt |
| https://osv.dev/GHSA-8988-9cw3-xx77 |      |           |                       |         |               |                                    |
| https://osv.dev/PYSEC-2026-4176     | 6.9  | PyPI      | urllib3               | 2.7.0   | 2.8.0         | .devcontainer/cpp/requirements.txt |
| https://osv.dev/GHSA-gh4c-6fx4-qh6g |      |           |                       |         |               |                                    |
| https://osv.dev/PYSEC-2026-4177     | 8.9  | PyPI      | urllib3               | 2.7.0   | 2.8.0         | .devcontainer/cpp/requirements.txt |
| https://osv.dev/GHSA-vxq7-64xx-v4gw |      |           |                       |         |               |                                    |
| https://osv.dev/GHSA-6j4f-fj2g-mc7p | 7.5  | npm       | brace-expansion (dev) | 5.0.9   | 5.0.10        | package-lock.json                  |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev) | 5.0.9   | 5.0.12        | package-lock.json                  |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev) | 5.0.9   | 5.0.11        | package-lock.json                  |
| https://osv.dev/GHSA-vfj7-8cjw-p6xm | 8.7  | npm       | braces (dev)          | 3.0.3   | --            | package-lock.json                  |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+------------------------------------+

error: Package: urllib3
Installed Version: 2.7.0
Vulnerability CVE-2026-97687
Severity: HIGH
Fixed Version: 2.8.0
Link: [CVE-2026-97687](https://avd.aquasec.com/nvd/cve-2026-97687)
    ┌─ .devcontainer/cpp/requirements.txt:518:1
    │
518 │ urllib3==2.7.0 \
    │ ^
    │
    = urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override
    = urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.

error: Package: urllib3
Installed Version: 2.7.0
Vulnerability CVE-2026-97689
Severity: HIGH
Fixed Version: 2.8.0
Link: [CVE-2026-97689](https://avd.aquasec.com/nvd/cve-2026-97689)
    ┌─ .devcontainer/cpp/requirements.txt:518:1
    │
518 │ urllib3==2.7.0 \
    │ ^
    │
    = urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser
    = urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.

warning: Package: urllib3
Installed Version: 2.7.0
Vulnerability CVE-2026-97688
Severity: MEDIUM
Fixed Version: 2.8.0
Link: [CVE-2026-97688](https://avd.aquasec.com/nvd/cve-2026-97688)
    ┌─ .devcontainer/cpp/requirements.txt:518:1
    │
518 │ urllib3==2.7.0 \
    │ ^
    │
    = urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding
    = urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.

warning: 1 warnings emitted
error: 2 errors emitted

📝 Summary
---------------------
🔍 Total..........133
🔗 Unique.........112
✅ Successful.....127
⏳ Timeouts.........0
🔀 Redirected......13
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1

Errors in .github/TOOL_VERSION_ISSUE_TEMPLATE.md
[403] https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads (at 30:7) | Rejected status code: 403 Forbidden

Hint: Followed 13 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`