Sync upstream 2026-10-27

CONTRIBUTING.md

@@ -16,6 +16,16 @@ To avoid conflicts with your existing installation, it is recommended to delete
 - Run `gulp` and check `dist` folder for extension files (now the tasks from gulpfile.js are being exported following the latest guidance from https://gulpjs.com/docs/en/getting-started/creating-tasks/ as the task() API isn't the recommended pattern anymore)
 - After completing above steps, run `gulp release` to package extension `.vsix` file. A VSIX package can help you install the latest extension maunally in VS Code extension tab.
 
+### Temporary security dependency override
+
+The root `serialize-javascript` override uses the official v7.1.3 source archive,
+pinned to commit `4d36b828f7c1c6a1f0de9ef932fefadcca0edace`, to fix
+[GHSA-m5mm-p8h7-m29v](https://github.com/advisories/GHSA-m5mm-p8h7-m29v) while the
+configured npm registry does not provide the patched release. Installation
+requires access to `codeload.github.com`. Once a patched registry release is
+available, replace the archive URL with version `7.1.3` or later and regenerate
+the root lockfile. The smoke package has an independent override and lockfile.
+
 ## Debugging
 
 There are currently 2 components to our extension: The extension running in the VS Code process with the debug adapter, and some code wrapping the user React Native code which is launched by the debug adapter. These are all debugged in different ways:

package.json

@@ -1548,9 +1548,9 @@
         "@babel/core": "7.29.6",
         "brace-expansion": "5.0.12",
         "decode-uri-component": "0.5.0",
-        "fast-uri": "3.1.7",
+        "fast-uri": "3.1.9",
         "js-yaml": "4.3.2",
-        "serialize-javascript": "7.0.5",
+        "serialize-javascript": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace",
         "mochawesome": {
             "uuid": "11.1.1"
         },

test/smoke/README.md

@@ -6,6 +6,15 @@ In project root folder:<br>
 `npm run prepare-smoke-tests`: setup smoke test dependencies.<br>
 `npm run prepare-smoke-tests-project`: setup test sample project dependencies
 
+## Security Dependency Override
+The `serialize-javascript` override uses the official v7.1.3 source archive,
+pinned to commit `4d36b828f7c1c6a1f0de9ef932fefadcca0edace`, because the configured
+npm registry does not currently provide that release. This version fixes
+[GHSA-m5mm-p8h7-m29v](https://github.com/advisories/GHSA-m5mm-p8h7-m29v).
+Dependency installation requires access to `codeload.github.com`. Once the
+release is available from the registry, replace the archive URL with `7.1.3`
+or a newer patched version and regenerate the lockfile.
+
 ## Run Tests
 In project root folder:<br>
 `npm run smoke-tests`: Execute tests

test/smoke/package.json

@@ -35,6 +35,6 @@
   },
   "overrides": {
     "brace-expansion": "5.0.12",
-    "serialize-javascript": "7.0.5"
+    "serialize-javascript": "https://codeload.github.com/yahoo/serialize-javascript/tar.gz/4d36b828f7c1c6a1f0de9ef932fefadcca0edace"
   }
 }