chore(deps): resolve dependency vulnerabilities (2026-08-17)

[tkislan]

npx better-npm-audit audit was failing, but not because new advisories landed. All four .nsprc accepted-risk entries expired on 2026-08-15, so the same four advisories that had been suppressed became visible again.

Each was re-assessed independently against the current registry. Three of the four rationales had gone stale — fixes were published after those notes were written — so they are fixed for real here rather than re-suppressed. One genuine accepted risk remains.

Decisions

Advisory	Package	Sev	Remediation	Why this rung
GHSA-vpq2-c234-7xj6	@tootallnate/once	low	Override 2.0.1	Transitive; a 2.x backport now exists
GHSA-w5hq-g745-h8pq	uuid	moderate	Override uuid@8 → 11.1.1	Transitive; direct dep already clean
GHSA-8988-4f7v-96qf	@opentelemetry/core	moderate	Direct bump @vscode/extension-telemetry → ^1.5.2	No override possible; the owning dep is direct
GHSA-848j-6mx2-7j84	elliptic	low	Accepted risk, expiry 2026-09-17	No published fix exists anywhere

@tootallnate/once → override 2.0.1

2.0.1 is a backport published 2026-05-03, after the note claiming no fix existed. Two corrections to that note: all three copies are production, not dev-only — the 1.1.2 copy is reached through @deepnote/sql-language-server → sqlite3 → node-gyp → make-fetch-happen, not only via @vscode/test-electron.

A plain pin also moves the 1.1.2 copy across a major. That is safe here because every consumer in the tree is http-proxy-agent calling once(socket, 'connect') at dist/agent.js:139 with the resolved value discarded, so the 1.x→2.x deltas (resolves args[] rather than args[0]; drops .spread/.cancel) are inert. Not taken to 3.0.1: it is ESM-only and all consumers are CJS.

   "immutable": "4.3.9",
-  "js-yaml@3": "3.15.1"
+  "js-yaml@3": "3.15.1",
+  "@tootallnate/once": "2.0.1",

uuid → override uuid@8: 11.1.1

The old note's premise (only fix is >=11.1.1) was right; its conclusion that this is unsafe was not. 11.1.1 still ships a real CJS build (main: ./dist/cjs/index.js) and its export surface is a superset of 8.3.2's. All five consumers call v4() with no buf argument — the explicitly unaffected path.

Pinned to 11.1.1 specifically because 12.0.1 and later are ESM-only. The ranged key mirrors the existing "js-yaml@3" entry, which likewise coexists with a newer direct dependency — uuid stays at ^13.0.2, which was never in range.

+  "uuid@8": "11.1.1"

@opentelemetry/core → bump @vscode/extension-telemetry to ^1.5.2

No 1.x backport exists (the fix is 2.8.0), so no override was possible — forcing core to 2.x breaks applicationinsights@2.5.0, which calls symbols removed in otel 2.x. Bumping the direct dependency past 0.9.0 drops applicationinsights and with it @opentelemetry/core, sdk-trace-base and resources, so this removes the advisory and three chained entries instead of suppressing them.

^1.5.2 specifically, because every release from 0.9.0 through 1.4.0 has an undeclared dependency: they import @microsoft/applicationinsights-common without declaring it, relying on applicationinsights-web-basic to supply it transitively. web-basic 3.4.x dropped it, so those versions fail to bundle:

node_modules/@vscode/extension-telemetry/dist/node/common/appInsightsClientFactory.js:31:45:
ERROR: Could not resolve "@microsoft/applicationinsights-common"

1.5.2 is the first release whose declared dependencies match what it imports. engines.vscode is unchanged at ^1.75.0.

-  "@vscode/extension-telemetry": "^0.7.7",
+  "@vscode/extension-telemetry": "^1.5.2",

1.0.0 replaced export default class TelemetryReporter with a named export, which costs four mechanical edits:

 // src/platform/telemetry/index.ts, src/test/testHooks.node.ts
-import TelemetryReporter from '@vscode/extension-telemetry';
+import { TelemetryReporter } from '@vscode/extension-telemetry';

 // src/test/unittests.ts — CJS Module._load hook
-return { default: vscMockTelemetryReporter };
+return { TelemetryReporter: vscMockTelemetryReporter };

 // build/mocha-esm-loader.js — synthesized ESM mock module
-export default vscMockTelemetryReporter;
+export const TelemetryReporter = vscMockTelemetryReporter;

That last one is the non-obvious one: the test loader synthesizes the telemetry mock as source and exported it only as a default, so import { TelemetryReporter } failed ESM instantiation with "does not provide an export named 'TelemetryReporter'" — even though the real package lexes fine. It now matches 1.5.2's actual shape.

elliptic → accepted risk renewed

The only entry with no remediation available: the advisory range is <=6.6.1 and 6.6.1 is the latest published version, so no override or lockfile bump can move it. It is dev-only and absent from the production tree.

Notes corrected to add the create-ecdh path the previous revision omitted, and to record why it is unreachable: node-stdlib-browser is a devDependency whose polyfill plugin is gated to the web test entry (build/esbuild/build.ts), whose output .vscodeignore excludes from the VSIX.

⚠️ Correction worth reviewing

The .nsprc note for @opentelemetry/core asserted that telemetry is disabled so the propagator is never exercised. That was false. isTelemetryDisabled() (src/platform/telemetry/index.ts:39-41) does not gate the send path — sendTelemetryEvent gates on isTelemetrySupported(), which always constructs the reporter, so App Insights events are sent in production.

The advisory was still not exploitable here (the vulnerable code is the inbound W3CBaggagePropagator.extract() parse, and this extension has no inbound listener), but the risk had been accepted on the wrong grounds. Since PostHog is now the live analytics path, deleting the App Insights path outright would remove this dependency class permanently — flagged, not done here.

Verification

All run locally on this branch:

• npm run compile-release → exit 0 (the exact command the 3 build jobs run)
• npm run compile → exit 0
• npx better-npm-audit audit → exit 0
• npx better-npm-audit audit --production → exit 0
• npm run compile-tsc → exit 0
• npm run test:unittests → 2545 passing, 0 failing (unchanged from baseline)
• Tree confirms @opentelemetry/core, applicationinsights and uuid@8.3.2 are gone; @tootallnate/once resolves to a single 2.0.1

Not verified: 1.5.x sends through the 1DS channel rather than the Node App Insights SDK. Worst realistic failure is App Insights events silently stopping — low impact given PostHog is the live analytics path, but it is not observable without checking the AI dashboard.

Fully reversible — revert the files and npm install. No migration.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QzZUkUqhSi8H8mvCpfEftt

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0%. Comparing base (ff4ec1b) to head (2224ab7).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@     Coverage Diff     @@
##   main   #469   +/-   ##
===========================
===========================

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0f02b485-11e0-494f-8fba-b19e3027b537

📥 Commits

Reviewing files that changed from the base of the PR and between 1cbf743 and 288dd2d.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

• build/mocha-esm-loader.js
• package.json
• src/platform/telemetry/index.ts
• src/test/testHooks.node.ts
• src/test/unittests.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• package.json

Included review availability: 0 reviews are currently available. Based on recent review activity, included reviews refill at 2 per hour.

---

📝 Walkthrough

Walkthrough

The package manifest updates @vscode/extension-telemetry and pins two transitive dependencies. Telemetry imports and test mocks now use the named TelemetryReporter export. The .nsprc entry expands the elliptic vulnerability notes and extends the risk expiry date.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 288dd

This PR updates vulnerable transitive dependencies, bumps telemetry dependencies, and renews one documented accepted risk while preserving existing source behavior. The supplied checks pass, and no actionable merge-blocking risk remains beyond normal review.

Suggested reviewers: dinohamzic

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Updates Docs	✅ Passed	The diff only updates dependency/security metadata and telemetry import/mock compatibility; it does not implement a feature, so this documentation check is not applicable.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary changes: resolving dependency vulnerabilities through dependency updates, overrides, and risk-note changes.

---

_{Comment @coderabbitai help to get the list of available commands.}