From 6e9972c1cdf5d362b81a7fe3c4661352b9e40cc5 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 26 Aug 2026 19:56:35 +0000 Subject: [PATCH 1/2] chore(deps): remediate Dependabot alerts in the npm lockfile Bump the bundled npm CLI (from @semantic-release/npm) to the patched v11 commit and pin hoisted undici to ^8.10.0 so GitHub no longer reports known vulnerabilities in undici, brace-expansion, tar, and ip-address. Co-authored-by: Dietmar Borgards --- .github/workflows/build-vsix.yml | 3 ++ .github/workflows/publish-marketplace.yml | 3 ++ .github/workflows/release.yml | 3 ++ .github/workflows/semantic-release.yml | 3 ++ package-lock.json | 66 +++++++++++------------ package.json | 3 +- 6 files changed, 47 insertions(+), 34 deletions(-) diff --git a/.github/workflows/build-vsix.yml b/.github/workflows/build-vsix.yml index d550a74..362abbe 100644 --- a/.github/workflows/build-vsix.yml +++ b/.github/workflows/build-vsix.yml @@ -22,6 +22,9 @@ jobs: with: node-version: 24 + - name: Prefer HTTPS for GitHub git dependencies + run: git config --global url.https://github.com/.insteadOf ssh://git@github.com/ + - name: Install dependencies run: npm install diff --git a/.github/workflows/publish-marketplace.yml b/.github/workflows/publish-marketplace.yml index ba7f823..a64fefa 100644 --- a/.github/workflows/publish-marketplace.yml +++ b/.github/workflows/publish-marketplace.yml @@ -37,6 +37,9 @@ jobs: with: node-version: 24 + - name: Prefer HTTPS for GitHub git dependencies + run: git config --global url.https://github.com/.insteadOf ssh://git@github.com/ + - name: Install dependencies run: npm install diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5df4232..ba273b6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,6 +19,9 @@ jobs: with: node-version: 24 + - name: Prefer HTTPS for GitHub git dependencies + run: git config --global url.https://github.com/.insteadOf ssh://git@github.com/ + - name: Install dependencies run: npm install diff --git a/.github/workflows/semantic-release.yml b/.github/workflows/semantic-release.yml index 85a525d..5d15c8e 100644 --- a/.github/workflows/semantic-release.yml +++ b/.github/workflows/semantic-release.yml @@ -27,6 +27,9 @@ jobs: with: node-version: 24 + - name: Prefer HTTPS for GitHub git dependencies + run: git config --global url.https://github.com/.insteadOf ssh://git@github.com/ + - name: Install dependencies run: npm ci diff --git a/package-lock.json b/package-lock.json index cc07e8b..31192c7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2424,9 +2424,9 @@ } }, "node_modules/npm": { - "version": "11.17.0", - "resolved": "https://registry.npmjs.org/npm/-/npm-11.17.0.tgz", - "integrity": "sha512-PurxiZexEHDTE4SSaLI3ZrnbAGiZfeyUcQcxcP5D+hfytNAze/D1IzDuInTn9XVLIbAQUnQuSPXJx02LHjLvQw==", + "version": "11.19.0", + "resolved": "git+https://github.com/npm/cli.git#4791b27f15c81d474a68daabb10b3ba6d20a0e71", + "integrity": "sha512-kPgtrgE0Rzh3/3Bcb5jWvN7cEt2lb7H73kMtqdmGmhhktJnyuY4tIsuqOy/u6B8iPHXJmowwAYFfaD8Mu+f4AA==", "bundleDependencies": [ "@isaacs/string-locale-compare", "@npmcli/arborist", @@ -2505,8 +2505,8 @@ ], "dependencies": { "@isaacs/string-locale-compare": "^1.1.0", - "@npmcli/arborist": "^9.8.0", - "@npmcli/config": "^10.11.0", + "@npmcli/arborist": "^9.9.1", + "@npmcli/config": "^10.12.0", "@npmcli/fs": "^5.0.0", "@npmcli/map-workspaces": "^5.0.3", "@npmcli/metavuln-calculator": "^9.0.3", @@ -2530,11 +2530,11 @@ "is-cidr": "^6.0.4", "json-parse-even-better-errors": "^5.0.0", "libnpmaccess": "^10.0.3", - "libnpmdiff": "^8.1.10", - "libnpmexec": "^10.3.0", - "libnpmfund": "^7.0.24", + "libnpmdiff": "^8.1.12", + "libnpmexec": "^10.3.2", + "libnpmfund": "^7.0.26", "libnpmorg": "^8.0.1", - "libnpmpack": "^9.1.10", + "libnpmpack": "^9.1.12", "libnpmpublish": "^11.2.0", "libnpmsearch": "^9.0.1", "libnpmteam": "^8.0.2", @@ -2550,7 +2550,7 @@ "npm-install-checks": "^8.0.0", "npm-package-arg": "^13.0.2", "npm-pick-manifest": "^11.0.3", - "npm-profile": "^12.0.1", + "npm-profile": "^12.0.2", "npm-registry-fetch": "^19.1.1", "npm-user-validate": "^4.0.0", "p-map": "^7.0.4", @@ -2559,11 +2559,11 @@ "proc-log": "^6.1.0", "qrcode-terminal": "^0.12.0", "read": "^5.0.1", - "semver": "^7.8.4", + "semver": "^7.8.5", "spdx-expression-parse": "^4.0.0", "ssri": "^13.0.1", "supports-color": "^10.2.2", - "tar": "^7.5.16", + "tar": "^7.5.22", "text-table": "~0.2.0", "tiny-relative-date": "^2.0.2", "treeverse": "^3.0.0", @@ -2652,7 +2652,7 @@ } }, "node_modules/npm/node_modules/@npmcli/arborist": { - "version": "9.8.0", + "version": "9.9.1", "dev": true, "inBundle": true, "license": "ISC", @@ -2700,7 +2700,7 @@ } }, "node_modules/npm/node_modules/@npmcli/config": { - "version": "10.11.0", + "version": "10.12.0", "dev": true, "inBundle": true, "license": "ISC", @@ -3045,7 +3045,7 @@ } }, "node_modules/npm/node_modules/brace-expansion": { - "version": "5.0.6", + "version": "5.0.9", "dev": true, "inBundle": true, "license": "MIT", @@ -3053,7 +3053,7 @@ "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/npm/node_modules/cacache": { @@ -3337,7 +3337,7 @@ } }, "node_modules/npm/node_modules/ip-address": { - "version": "10.2.0", + "version": "10.5.0", "dev": true, "inBundle": true, "license": "MIT", @@ -3419,12 +3419,12 @@ } }, "node_modules/npm/node_modules/libnpmdiff": { - "version": "8.1.10", + "version": "8.1.12", "dev": true, "inBundle": true, "license": "ISC", "dependencies": { - "@npmcli/arborist": "^9.8.0", + "@npmcli/arborist": "^9.9.1", "@npmcli/installed-package-contents": "^4.0.0", "binary-extensions": "^3.0.0", "diff": "^8.0.2", @@ -3438,13 +3438,13 @@ } }, "node_modules/npm/node_modules/libnpmexec": { - "version": "10.3.0", + "version": "10.3.2", "dev": true, "inBundle": true, "license": "ISC", "dependencies": { "@gar/promise-retry": "^1.0.0", - "@npmcli/arborist": "^9.8.0", + "@npmcli/arborist": "^9.9.1", "@npmcli/package-json": "^7.0.0", "@npmcli/run-script": "^10.0.0", "ci-info": "^4.0.0", @@ -3461,12 +3461,12 @@ } }, "node_modules/npm/node_modules/libnpmfund": { - "version": "7.0.24", + "version": "7.0.26", "dev": true, "inBundle": true, "license": "ISC", "dependencies": { - "@npmcli/arborist": "^9.8.0" + "@npmcli/arborist": "^9.9.1" }, "engines": { "node": "^20.17.0 || >=22.9.0" @@ -3486,12 +3486,12 @@ } }, "node_modules/npm/node_modules/libnpmpack": { - "version": "9.1.10", + "version": "9.1.12", "dev": true, "inBundle": true, "license": "ISC", "dependencies": { - "@npmcli/arborist": "^9.8.0", + "@npmcli/arborist": "^9.9.1", "@npmcli/run-script": "^10.0.0", "npm-package-arg": "^13.0.0", "pacote": "^21.0.2" @@ -3860,13 +3860,13 @@ } }, "node_modules/npm/node_modules/npm-profile": { - "version": "12.0.1", + "version": "12.0.2", "dev": true, "inBundle": true, "license": "ISC", "dependencies": { "npm-registry-fetch": "^19.0.0", - "proc-log": "^6.0.0" + "proc-log": "^6.1.0" }, "engines": { "node": "^20.17.0 || >=22.9.0" @@ -4071,7 +4071,7 @@ "optional": true }, "node_modules/npm/node_modules/semver": { - "version": "7.8.4", + "version": "7.8.5", "dev": true, "inBundle": true, "license": "ISC", @@ -4196,7 +4196,7 @@ } }, "node_modules/npm/node_modules/tar": { - "version": "7.5.16", + "version": "7.5.22", "dev": true, "inBundle": true, "license": "BlueOak-1.0.0", @@ -4292,7 +4292,7 @@ } }, "node_modules/npm/node_modules/undici": { - "version": "6.26.0", + "version": "6.28.0", "dev": true, "inBundle": true, "license": "MIT", @@ -5518,9 +5518,9 @@ } }, "node_modules/undici": { - "version": "8.5.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-8.5.0.tgz", - "integrity": "sha512-xamtWoB1EshgjpmlXd7GGm2VfdDtw1+rD8uhry8pSNW3If6S8E0m2T2+orSKeZXEn/aPJMviCpDBA65WJt8zhg==", + "version": "8.10.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.0.tgz", + "integrity": "sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index b504043..d982d47 100644 --- a/package.json +++ b/package.json @@ -54,7 +54,8 @@ ] }, "overrides": { - "undici": ">=6.24.0" + "undici": "^8.10.0", + "npm": "git+https://github.com/npm/cli.git#4791b27f15c81d474a68daabb10b3ba6d20a0e71" }, "devDependencies": { "@semantic-release/changelog": "^7.0.0", From 08c7a8afc4ae5cb024d818324def7ed292ef456b Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 26 Aug 2026 20:12:18 +0000 Subject: [PATCH 2/2] chore(deps): scope undici overrides and quote git insteadOf URLs Keep patched undici on the 6.x and 7.x lines requested by dependents instead of forcing 8.x globally. Quote git url.insteadOf keys and also rewrite the SCP-style git@github.com: SSH form to HTTPS. Co-authored-by: Dietmar Borgards --- .github/workflows/build-vsix.yml | 4 ++- .github/workflows/publish-marketplace.yml | 4 ++- .github/workflows/release.yml | 4 ++- .github/workflows/semantic-release.yml | 4 ++- package-lock.json | 30 +++++++++++++++-------- package.json | 9 +++++-- 6 files changed, 39 insertions(+), 16 deletions(-) diff --git a/.github/workflows/build-vsix.yml b/.github/workflows/build-vsix.yml index 362abbe..7995b8e 100644 --- a/.github/workflows/build-vsix.yml +++ b/.github/workflows/build-vsix.yml @@ -23,7 +23,9 @@ jobs: node-version: 24 - name: Prefer HTTPS for GitHub git dependencies - run: git config --global url.https://github.com/.insteadOf ssh://git@github.com/ + run: | + git config --global url."https://github.com/".insteadOf ssh://git@github.com/ + git config --global --add url."https://github.com/".insteadOf git@github.com: - name: Install dependencies run: npm install diff --git a/.github/workflows/publish-marketplace.yml b/.github/workflows/publish-marketplace.yml index a64fefa..ff25fd3 100644 --- a/.github/workflows/publish-marketplace.yml +++ b/.github/workflows/publish-marketplace.yml @@ -38,7 +38,9 @@ jobs: node-version: 24 - name: Prefer HTTPS for GitHub git dependencies - run: git config --global url.https://github.com/.insteadOf ssh://git@github.com/ + run: | + git config --global url."https://github.com/".insteadOf ssh://git@github.com/ + git config --global --add url."https://github.com/".insteadOf git@github.com: - name: Install dependencies run: npm install diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ba273b6..2d3f7d0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,7 +20,9 @@ jobs: node-version: 24 - name: Prefer HTTPS for GitHub git dependencies - run: git config --global url.https://github.com/.insteadOf ssh://git@github.com/ + run: | + git config --global url."https://github.com/".insteadOf ssh://git@github.com/ + git config --global --add url."https://github.com/".insteadOf git@github.com: - name: Install dependencies run: npm install diff --git a/.github/workflows/semantic-release.yml b/.github/workflows/semantic-release.yml index 5d15c8e..bc4288f 100644 --- a/.github/workflows/semantic-release.yml +++ b/.github/workflows/semantic-release.yml @@ -28,7 +28,9 @@ jobs: node-version: 24 - name: Prefer HTTPS for GitHub git dependencies - run: git config --global url.https://github.com/.insteadOf ssh://git@github.com/ + run: | + git config --global url."https://github.com/".insteadOf ssh://git@github.com/ + git config --global --add url."https://github.com/".insteadOf git@github.com: - name: Install dependencies run: npm ci diff --git a/package-lock.json b/package-lock.json index 31192c7..88a9aa5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -50,6 +50,16 @@ "undici": "^6.23.0" } }, + "node_modules/@actions/http-client/node_modules/undici": { + "version": "6.28.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz", + "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=18.17" + } + }, "node_modules/@actions/io": { "version": "3.0.2", "resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz", @@ -407,6 +417,16 @@ "semantic-release": ">=24.1.0" } }, + "node_modules/@semantic-release/github/node_modules/undici": { + "version": "7.29.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", + "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=20.18.1" + } + }, "node_modules/@semantic-release/npm": { "version": "13.1.5", "resolved": "https://registry.npmjs.org/@semantic-release/npm/-/npm-13.1.5.tgz", @@ -5517,16 +5537,6 @@ "node": ">=0.8.0" } }, - "node_modules/undici": { - "version": "8.10.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.0.tgz", - "integrity": "sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=22.19.0" - } - }, "node_modules/unicode-emoji-modifier-base": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/unicode-emoji-modifier-base/-/unicode-emoji-modifier-base-1.0.0.tgz", diff --git a/package.json b/package.json index d982d47..166bbc3 100644 --- a/package.json +++ b/package.json @@ -54,8 +54,13 @@ ] }, "overrides": { - "undici": "^8.10.0", - "npm": "git+https://github.com/npm/cli.git#4791b27f15c81d474a68daabb10b3ba6d20a0e71" + "npm": "git+https://github.com/npm/cli.git#4791b27f15c81d474a68daabb10b3ba6d20a0e71", + "@actions/http-client": { + "undici": "^6.28.0" + }, + "@semantic-release/github": { + "undici": "^7.29.0" + } }, "devDependencies": { "@semantic-release/changelog": "^7.0.0",