From 83c6016d4ca914c6b6766f446aec3955d1a2df00 Mon Sep 17 00:00:00 2001 From: EmmaYuan1015 Date: Tue, 27 Oct 2026 09:07:14 +0800 Subject: [PATCH 1/3] fix: update fast-uri to 3.1.9 for security alerts Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- package-lock.json | 18 +++++++++--------- package.json | 2 +- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package-lock.json b/package-lock.json index 72cc3aceb..a84aa1fe1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5986,9 +5986,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.7", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-uri/-/fast-uri-3.1.7.tgz", - "integrity": "sha1-dDFX2Vfzy7TGUxDgM9wq1K19xgo=", + "version": "3.1.9", + "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-uri/-/fast-uri-3.1.9.tgz", + "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==", "dev": true, "funding": [ { @@ -14489,7 +14489,7 @@ "dev": true, "requires": { "fast-deep-equal": "^3.1.3", - "fast-uri": "3.1.7", + "fast-uri": "3.1.9", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } @@ -15908,7 +15908,7 @@ "dev": true, "requires": { "fast-deep-equal": "^3.1.3", - "fast-uri": "3.1.7", + "fast-uri": "3.1.9", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } @@ -18059,9 +18059,9 @@ "dev": true }, "fast-uri": { - "version": "3.1.7", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-uri/-/fast-uri-3.1.7.tgz", - "integrity": "sha1-dDFX2Vfzy7TGUxDgM9wq1K19xgo=", + "version": "3.1.9", + "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-uri/-/fast-uri-3.1.9.tgz", + "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==", "dev": true }, "fastest-levenshtein": { @@ -22111,7 +22111,7 @@ "dev": true, "requires": { "fast-deep-equal": "^3.1.3", - "fast-uri": "3.1.7", + "fast-uri": "3.1.9", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } diff --git a/package.json b/package.json index dc9c77383..5f40ea990 100644 --- a/package.json +++ b/package.json @@ -1541,7 +1541,7 @@ "@babel/core": "7.29.6", "brace-expansion": "5.0.12", "decode-uri-component": "0.5.0", - "fast-uri": "3.1.7", + "fast-uri": "3.1.9", "js-yaml": "4.3.2", "serialize-javascript": "7.0.5", "mochawesome": { From d51a7465acc4d048247623f2290b2a7eaa768f15 Mon Sep 17 00:00:00 2001 From: EmmaYuan1015 Date: Tue, 27 Oct 2026 09:36:15 +0800 Subject: [PATCH 2/3] fix: update smoke serializer to patched 7.1.3 source archive Pin the official release commit while the patched npm version is unavailable, and document the temporary override. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- test/smoke/README.md | 9 +++++++++ test/smoke/package-lock.json | 6 +++--- test/smoke/package.json | 2 +- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/test/smoke/README.md b/test/smoke/README.md index 8d9b45bfb..bf02f6f41 100644 --- a/test/smoke/README.md +++ b/test/smoke/README.md @@ -6,6 +6,15 @@ In project root folder:
`npm run prepare-smoke-tests`: setup smoke test dependencies.
`npm run prepare-smoke-tests-project`: setup test sample project dependencies +## Security Dependency Override +The `serialize-javascript` override uses the official v7.1.3 source archive, +pinned to commit `4d36b828f7c1c6a1f0de9ef932fefadcca0edace`, because the configured +npm registry does not currently provide that release. This version fixes +[GHSA-m5mm-p8h7-m29v](https://github.com/advisories/GHSA-m5mm-p8h7-m29v). +Dependency installation requires access to `codeload.github.com`. Once the +release is available from the registry, replace the archive URL with `7.1.3` +or a newer patched version and regenerate the lockfile. + ## Run Tests In project root folder:
`npm run smoke-tests`: Execute tests diff --git a/test/smoke/package-lock.json b/test/smoke/package-lock.json index dea986652..088a58cb8 100644 --- a/test/smoke/package-lock.json +++ b/test/smoke/package-lock.json @@ -1736,9 +1736,9 @@ "license": "MIT" }, "node_modules/serialize-javascript": { - "version": "7.0.5", - "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.5.tgz", - "integrity": "sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw==", + "version": "7.1.3", + "resolved": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace", + "integrity": "sha512-6vthQA8cNte+KY5OgWwcM8Pi7+fLlLU+rMguhMHLOkQOtBOHjVhqgKaTLq3cMFUdjXmjL8fi+r8/lb09c7BL8w==", "dev": true, "license": "BSD-3-Clause", "engines": { diff --git a/test/smoke/package.json b/test/smoke/package.json index 86435f88b..fef57a249 100644 --- a/test/smoke/package.json +++ b/test/smoke/package.json @@ -35,6 +35,6 @@ }, "overrides": { "brace-expansion": "5.0.12", - "serialize-javascript": "7.0.5" + "serialize-javascript": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace" } } From 673916f62ca88985a7e7f46ed31b155025a3f676 Mon Sep 17 00:00:00 2001 From: EmmaYuan1015 Date: Tue, 27 Oct 2026 10:09:47 +0800 Subject: [PATCH 3/3] fix: update root serializer to patched 7.1.3 source archive Pin the official release commit while the patched npm version is unavailable, and document the temporary root override. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- CONTRIBUTING.md | 10 ++++++++++ package-lock.json | 15 +++++++-------- package.json | 2 +- 3 files changed, 18 insertions(+), 9 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 7f00614c5..8ceb5f815 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -16,6 +16,16 @@ To avoid conflicts with your existing installation, it is recommended to delete - Run `gulp` and check `dist` folder for extension files (now the tasks from gulpfile.js are being exported following the latest guidance from https://gulpjs.com/docs/en/getting-started/creating-tasks/ as the task() API isn't the recommended pattern anymore) - After completing above steps, run `gulp release` to package extension `.vsix` file. A VSIX package can help you install the latest extension maunally in VS Code extension tab. +### Temporary security dependency override + +The root `serialize-javascript` override uses the official v7.1.3 source archive, +pinned to commit `4d36b828f7c1c6a1f0de9ef932fefadcca0edace`, to fix +[GHSA-m5mm-p8h7-m29v](https://github.com/advisories/GHSA-m5mm-p8h7-m29v) while the +configured npm registry does not provide the patched release. Installation +requires access to `codeload.github.com`. Once a patched registry release is +available, replace the archive URL with version `7.1.3` or later and regenerate +the root lockfile. The smoke package has an independent override and lockfile. + ## Debugging There are currently 2 components to our extension: The extension running in the VS Code process with the debug adapter, and some code wrapping the user React Native code which is launched by the debug adapter. These are all debugged in different ways: diff --git a/package-lock.json b/package-lock.json index a84aa1fe1..79c0e5134 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11526,9 +11526,9 @@ } }, "node_modules/serialize-javascript": { - "version": "7.0.5", - "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.5.tgz", - "integrity": "sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw==", + "version": "7.1.3", + "resolved": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace", + "integrity": "sha512-6vthQA8cNte+KY5OgWwcM8Pi7+fLlLU+rMguhMHLOkQOtBOHjVhqgKaTLq3cMFUdjXmjL8fi+r8/lb09c7BL8w==", "dev": true, "license": "BSD-3-Clause", "engines": { @@ -18983,7 +18983,7 @@ "log-symbols": "^4.1.0", "minimatch": "^5.1.6", "ms": "^2.1.3", - "serialize-javascript": "7.0.5", + "serialize-javascript": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace", "strip-json-comments": "^3.1.1", "supports-color": "^8.1.1", "workerpool": "^6.5.1", @@ -20408,7 +20408,7 @@ "minimatch": "^9.0.5", "ms": "^2.1.3", "picocolors": "^1.1.1", - "serialize-javascript": "7.0.5", + "serialize-javascript": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace", "strip-json-comments": "^3.1.1", "supports-color": "^8.1.1", "workerpool": "^9.2.0", @@ -22203,9 +22203,8 @@ } }, "serialize-javascript": { - "version": "7.0.5", - "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.5.tgz", - "integrity": "sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw==", + "version": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace", + "integrity": "sha512-6vthQA8cNte+KY5OgWwcM8Pi7+fLlLU+rMguhMHLOkQOtBOHjVhqgKaTLq3cMFUdjXmjL8fi+r8/lb09c7BL8w==", "dev": true }, "set-blocking": { diff --git a/package.json b/package.json index 5f40ea990..8bfcd0319 100644 --- a/package.json +++ b/package.json @@ -1543,7 +1543,7 @@ "decode-uri-component": "0.5.0", "fast-uri": "3.1.9", "js-yaml": "4.3.2", - "serialize-javascript": "7.0.5", + "serialize-javascript": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace", "mochawesome": { "uuid": "11.1.1" },