chore(deps): resolve dependency vulnerabilities (2026-08-17)

.nsprc

@@ -1,18 +1,6 @@
 {
     "GHSA-848j-6mx2-7j84": {
-        "notes": "CVE-2025-14505: elliptic ECDSA signature corruption can lead to private key recovery if attacker obtains both faulty and correct signatures for identical inputs. Accepted risk: dev-only transitive dependency (node-stdlib-browser -> crypto-browserify -> browserify-sign), not used for signing in this project, no fix available.",
-        "expiry": "2026-08-15"
-    },
-    "GHSA-vpq2-c234-7xj6": {
-        "notes": "@tootallnate/once AbortSignal control flow (promise may never settle). The current lockfile still resolves vulnerable transitive copies through @deepnote/sql-language-server -> @google-cloud/bigquery -> teeny-request -> http-proxy-agent@5 -> @tootallnate/once@2.0.0, @vscode/jupyter-ipywidgets8 -> @jupyterlab/filebrowser -> jest-environment-jsdom -> jsdom -> http-proxy-agent@5 -> @tootallnate/once@2.0.0, and @vscode/test-electron -> http-proxy-agent@4.0.1 -> @tootallnate/once@1.1.2. No @tootallnate/once override is currently applied in this repo because we are not forcing a major-version transitive override.",
-        "expiry": "2026-08-15"
-    },
-    "GHSA-w5hq-g745-h8pq": {
-        "notes": "CVE-2026-41907: uuid v3/v5/v6 API methods skip bounds validation when the caller passes an external output buffer (and/or offset), allowing silent partial writes that produce malformed/truncated UUIDs. Accepted risk: all vulnerable transitive copies in the lockfile are uuid@8.3.2 reached via @nteract/commutable, @nteract/messaging, @nteract/types, istanbul-lib-processinfo, and node-notifier. Each call site uses only uuid.v4() (verified by grep in node_modules) — v4 is explicitly listed as unaffected. Bumping these transitive deps to a major-version override (>=11.1.1) is unsafe because @nteract packages declare uuid@^8.0.0 and the API surface differs across majors.",
-        "expiry": "2026-08-15"
-    },
-    "GHSA-8988-4f7v-96qf": {
-        "notes": "@opentelemetry/core unbounded memory allocation in W3C Baggage propagation parsing (moderate). Reached only via @vscode/extension-telemetry@0.7.7 -> applicationinsights@2.5.0 -> @opentelemetry/core@1.10.1. Accepted risk: telemetry is permanently disabled in this extension (isTelemetryDisabled() in src/platform/telemetry/index.ts hard-returns true), so the Baggage propagator is never exercised. No safe transitive override exists: the fix is @opentelemetry/core>=2.8.0, but applicationinsights@2.5.0 and the 1.x @opentelemetry/sdk-trace-base and @opentelemetry/resources still in the tree call symbols removed in otel 2.x (getEnv, DEFAULT_ATTRIBUTE_COUNT_LIMIT, TracesSamplerValues), so forcing core to 2.x breaks them at runtime. The real remediation is upgrading @vscode/extension-telemetry to >=1.5.2 (which drops applicationinsights and @opentelemetry entirely) — a major upgrade deferred to a dedicated change.",
-        "expiry": "2026-08-15"
+        "notes": "CVE-2025-14505: elliptic's ECDSA signing mis-computes the byte length of the nonce k when k has leading zeros, emitting a truncated signature; an attacker who obtains both a faulty and a correct signature over the same input can recover the private key. Accepted risk: dev-only transitive dependency, absent from the production tree (`npm ls elliptic --omit=dev` is empty). Reached only via node-stdlib-browser@1.3.1 -> crypto-browserify@3.12.1 -> browserify-sign@4.2.5 / create-ecdh@4.0.4 -> elliptic@6.6.1. node-stdlib-browser is a devDependency used exclusively by build/esbuild/build.ts, whose stdlib polyfill plugin is applied only to the web test entry (src/test/web/index.ts -> out/extension.web.bundle.js, excluded from the VSIX by `out/**` in .vscodeignore); the production desktop and web bundles never pull it in, confirmed by the absence of node_modules/elliptic, node_modules/browserify-sign and node_modules/crypto-browserify inputs in dist/*.esbuild.meta.json. No code in this extension performs ECDSA signing. No override is possible: every published elliptic release is affected (range <=6.6.1, and 6.6.1 is the latest version on npm, published 2024-11-13), GitHub lists no patched version, and npm audit reports fixAvailable:false. The real remediation is an upstream elliptic release, or dropping node-stdlib-browser from the web test bundle in favour of native browser crypto.",
+        "expiry": "2026-09-17"
     }
 }

build/esbuild/build.ts

@@ -83,7 +83,7 @@ const extensionFolder = path.join(__dirname, '..', '..');
 
 // Security pins copied from the root `overrides` into the generated sql-lsp-modules package.json,
 // which npm installs in isolation and would otherwise resolve to vulnerable versions.
-const sqlLspOverridesToPropagate = ['ip-address', 'ssh2', 'tar'];
+const sqlLspOverridesToPropagate = ['ip-address', 'ssh2', 'tar', '@tootallnate/once'];
 
 interface StylePluginOptions {
     /**

build/mocha-esm-loader.js

@@ -349,7 +349,7 @@ export async function load(url, context, nextLoad) {
                 format: 'module',
                 source: `
                     import { vscMockTelemetryReporter } from '${telemetryMockPath}';
-                    export default vscMockTelemetryReporter;
+                    export const TelemetryReporter = vscMockTelemetryReporter;
                 `,
                 shortCircuit: true
             };