diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 7f00614c5..8ceb5f815 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -16,6 +16,16 @@ To avoid conflicts with your existing installation, it is recommended to delete
- Run `gulp` and check `dist` folder for extension files (now the tasks from gulpfile.js are being exported following the latest guidance from https://gulpjs.com/docs/en/getting-started/creating-tasks/ as the task() API isn't the recommended pattern anymore)
- After completing above steps, run `gulp release` to package extension `.vsix` file. A VSIX package can help you install the latest extension maunally in VS Code extension tab.
+### Temporary security dependency override
+
+The root `serialize-javascript` override uses the official v7.1.3 source archive,
+pinned to commit `4d36b828f7c1c6a1f0de9ef932fefadcca0edace`, to fix
+[GHSA-m5mm-p8h7-m29v](https://github.com/advisories/GHSA-m5mm-p8h7-m29v) while the
+configured npm registry does not provide the patched release. Installation
+requires access to `codeload.github.com`. Once a patched registry release is
+available, replace the archive URL with version `7.1.3` or later and regenerate
+the root lockfile. The smoke package has an independent override and lockfile.
+
## Debugging
There are currently 2 components to our extension: The extension running in the VS Code process with the debug adapter, and some code wrapping the user React Native code which is launched by the debug adapter. These are all debugged in different ways:
diff --git a/package-lock.json b/package-lock.json
index 1007b08dc..83e9b5ef3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5986,9 +5986,9 @@
"license": "MIT"
},
"node_modules/fast-uri": {
- "version": "3.1.7",
- "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-uri/-/fast-uri-3.1.7.tgz",
- "integrity": "sha1-dDFX2Vfzy7TGUxDgM9wq1K19xgo=",
+ "version": "3.1.9",
+ "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-uri/-/fast-uri-3.1.9.tgz",
+ "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==",
"dev": true,
"funding": [
{
@@ -11526,9 +11526,9 @@
}
},
"node_modules/serialize-javascript": {
- "version": "7.0.5",
- "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.5.tgz",
- "integrity": "sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw==",
+ "version": "7.1.3",
+ "resolved": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace",
+ "integrity": "sha512-6vthQA8cNte+KY5OgWwcM8Pi7+fLlLU+rMguhMHLOkQOtBOHjVhqgKaTLq3cMFUdjXmjL8fi+r8/lb09c7BL8w==",
"dev": true,
"license": "BSD-3-Clause",
"engines": {
@@ -14489,7 +14489,7 @@
"dev": true,
"requires": {
"fast-deep-equal": "^3.1.3",
- "fast-uri": "3.1.7",
+ "fast-uri": "3.1.9",
"json-schema-traverse": "^1.0.0",
"require-from-string": "^2.0.2"
}
@@ -15908,7 +15908,7 @@
"dev": true,
"requires": {
"fast-deep-equal": "^3.1.3",
- "fast-uri": "3.1.7",
+ "fast-uri": "3.1.9",
"json-schema-traverse": "^1.0.0",
"require-from-string": "^2.0.2"
}
@@ -18059,9 +18059,9 @@
"dev": true
},
"fast-uri": {
- "version": "3.1.7",
- "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-uri/-/fast-uri-3.1.7.tgz",
- "integrity": "sha1-dDFX2Vfzy7TGUxDgM9wq1K19xgo=",
+ "version": "3.1.9",
+ "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-uri/-/fast-uri-3.1.9.tgz",
+ "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==",
"dev": true
},
"fastest-levenshtein": {
@@ -18983,7 +18983,7 @@
"log-symbols": "^4.1.0",
"minimatch": "^5.1.6",
"ms": "^2.1.3",
- "serialize-javascript": "7.0.5",
+ "serialize-javascript": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace",
"strip-json-comments": "^3.1.1",
"supports-color": "^8.1.1",
"workerpool": "^6.5.1",
@@ -20408,7 +20408,7 @@
"minimatch": "^9.0.5",
"ms": "^2.1.3",
"picocolors": "^1.1.1",
- "serialize-javascript": "7.0.5",
+ "serialize-javascript": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace",
"strip-json-comments": "^3.1.1",
"supports-color": "^8.1.1",
"workerpool": "^9.2.0",
@@ -22111,7 +22111,7 @@
"dev": true,
"requires": {
"fast-deep-equal": "^3.1.3",
- "fast-uri": "3.1.7",
+ "fast-uri": "3.1.9",
"json-schema-traverse": "^1.0.0",
"require-from-string": "^2.0.2"
}
@@ -22203,9 +22203,8 @@
}
},
"serialize-javascript": {
- "version": "7.0.5",
- "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.5.tgz",
- "integrity": "sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw==",
+ "version": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace",
+ "integrity": "sha512-6vthQA8cNte+KY5OgWwcM8Pi7+fLlLU+rMguhMHLOkQOtBOHjVhqgKaTLq3cMFUdjXmjL8fi+r8/lb09c7BL8w==",
"dev": true
},
"set-blocking": {
diff --git a/package.json b/package.json
index 45c445376..bf809affc 100644
--- a/package.json
+++ b/package.json
@@ -1548,9 +1548,9 @@
"@babel/core": "7.29.6",
"brace-expansion": "5.0.12",
"decode-uri-component": "0.5.0",
- "fast-uri": "3.1.7",
+ "fast-uri": "3.1.9",
"js-yaml": "4.3.2",
- "serialize-javascript": "7.0.5",
+ "serialize-javascript": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace",
"mochawesome": {
"uuid": "11.1.1"
},
diff --git a/test/smoke/README.md b/test/smoke/README.md
index 8d9b45bfb..bf02f6f41 100644
--- a/test/smoke/README.md
+++ b/test/smoke/README.md
@@ -6,6 +6,15 @@ In project root folder:
`npm run prepare-smoke-tests`: setup smoke test dependencies.
`npm run prepare-smoke-tests-project`: setup test sample project dependencies
+## Security Dependency Override
+The `serialize-javascript` override uses the official v7.1.3 source archive,
+pinned to commit `4d36b828f7c1c6a1f0de9ef932fefadcca0edace`, because the configured
+npm registry does not currently provide that release. This version fixes
+[GHSA-m5mm-p8h7-m29v](https://github.com/advisories/GHSA-m5mm-p8h7-m29v).
+Dependency installation requires access to `codeload.github.com`. Once the
+release is available from the registry, replace the archive URL with `7.1.3`
+or a newer patched version and regenerate the lockfile.
+
## Run Tests
In project root folder:
`npm run smoke-tests`: Execute tests
diff --git a/test/smoke/package-lock.json b/test/smoke/package-lock.json
index dea986652..088a58cb8 100644
--- a/test/smoke/package-lock.json
+++ b/test/smoke/package-lock.json
@@ -1736,9 +1736,9 @@
"license": "MIT"
},
"node_modules/serialize-javascript": {
- "version": "7.0.5",
- "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.5.tgz",
- "integrity": "sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw==",
+ "version": "7.1.3",
+ "resolved": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace",
+ "integrity": "sha512-6vthQA8cNte+KY5OgWwcM8Pi7+fLlLU+rMguhMHLOkQOtBOHjVhqgKaTLq3cMFUdjXmjL8fi+r8/lb09c7BL8w==",
"dev": true,
"license": "BSD-3-Clause",
"engines": {
diff --git a/test/smoke/package.json b/test/smoke/package.json
index 86435f88b..fef57a249 100644
--- a/test/smoke/package.json
+++ b/test/smoke/package.json
@@ -35,6 +35,6 @@
},
"overrides": {
"brace-expansion": "5.0.12",
- "serialize-javascript": "7.0.5"
+ "serialize-javascript": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace"
}
}