chore(deps): pin fast-uri and qs to clear npm audit - #264
Merged
Conversation
Override fast-uri to 3.1.7 and qs to 6.16.0 so the required npm audit --audit-level=high check passes. Both come from @vscode/vsce (dev only). Production audit was already clean. Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
SebTardif
marked this pull request as ready for review
September 8, 2026 03:38
SebTardif
enabled auto-merge (squash)
September 8, 2026 03:38
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pin transitive
fast-uriandqsso the requirednpm auditcheck is green again.Why
npm audit --audit-level=highis failing on main and on the open Dependabot PRs (#261, #262, #263). The high finding isfast-uri3.1.5 (GHSA-5jgf-p345-68v8 and related host-confusion / SSRF advisories) pulled in by@vscode/vsceviaajv.qs6.15.2 is a moderate finding viatyped-rest-client; it is pinned in the same pass sonpm auditis clean.Production dependencies (
npm audit --omit=dev) were already clean. These packages are only used by the vsce packaging toolchain.The change
Add npm overrides (same pattern as the existing
brace-expansionpin):fast-uri3.1.5 -> 3.1.7 (latest 3.x inajv@8.20.0's^3.0.1range)qs6.15.2 -> 6.16.0 (intyped-rest-client's^6.9.1range)Verification
npm audit --audit-level=highreports 0 vulnerabilitiesnpm auditreports 0 vulnerabilitiesnpm ls fast-uri qsshowsfast-uri@3.1.7 overriddenandqs@6.16.0 overriddennpm run checkpassed (431 tests, 7 skipped, coverage and vsce package succeeded)