Patch the vulnerable development dependencies - #6
Merged
Conversation
npm audit reported eight vulnerabilities, seven of which are transitive dependencies of tslint and reachable only when linting: brace-expansion, diff, js-yaml, minimatch, minimist, path-parse and semver. None of them ship, since vsce packages production dependencies only. All seven are fixed by resolutions the declared ranges already allowed, so this is a lockfile change and package.json is untouched. The Dependabot alert on the default branch was js-yaml, pinned at 3.13.1 where tslint asks for ^3.13.1; it now resolves to 3.15.2, past the 3.15.1 that carries the !!omap fix. The critical one was minimist 1.2.5, now 1.2.8. systeminformation is deliberately left alone. It is the one production dependency, it ships with the extension, and clearing its advisories means going from 4.x to 5.x, which renames much of the surface this extension reads. That belongs in its own change, with every reading checked. Verified: tslint still runs clean on the newer js-yaml, the tests pass, and the extension was smoke-tested with every section reporting. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm auditreported eight vulnerabilities. Seven are transitive dependencies oftslint, reachable only when linting; one issysteminformation, which is a different matter and is left for its own change.What this fixes
All seven dev-tree advisories resolve to versions the declared ranges already permitted, so
package.jsonis untouched — this is purely a lockfile refresh.The Dependabot alert on the default branch was js-yaml: the lockfile pinned 3.13.1 while
tslintasks for^3.13.1, so the patched 3.15.x was always permitted and simply had not been picked up.None of these ship to users —
vscepackages production dependencies only, and all seven are dev-scope.What this deliberately does not fix
systeminformationis the extension's only production dependency and does ship. Clearing its advisories requires 4.x → 5.x, which is a major version with renamed properties across exactly the surface this extension reads (currentload_idle,cpuCurrentspeed,hasbatteryand others). That needs code changes and every reading re-checked, so it belongs in its own pull request rather than riding along with a lockfile bump.npm auditaccordingly still reports 1 high after this change, down from 8 vulnerabilities (1 critical, 5 high, 1 moderate, 1 low).Verification
npm run lintclean — tslint still works against the newer js-yaml, which is the one upgrade here with any real chance of breaking it.npm test— 48 passing.vscodemodule: CPU, GPU, memory and disk all report, and the host exits cleanly.🤖 Generated with Claude Code