trending/open-code-review
1
0
Fork 0
mirror of https://github.com/alibaba/open-code-review.git synced 2026-10-02 01:15:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): bump grpc, fast-uri and browserslist to patch high-severity advisories (#1169)

Browse Source 
Clears six high-severity Dependabot alerts on the default branch.

Runtime (go.mod):
- google.golang.org/grpc v1.83.0 -> v1.83.1
  GHSA-vp52-pcj8-j9qc / CVE-2026-84304: heap memory exhaustion (OOM)
  via HTTP/2 DATA frame fragmentation. Pulled in indirectly through
  internal/telemetry -> otlpmetricgrpc.

VS Code extension (development scope):
- fast-uri 4.1.2 -> 4.1.4, resolution raised from >=4.1.2 to >=4.1.3
  GHSA-f65p-4m7j-42xc / CVE-2026-75975: SSRF via malformed IPv6 normalization
  GHSA-fph4-wmhf-6fwf / CVE-2026-75899: SSRF via repeated hostname percent-decoding
  GHSA-jqff-g426-hqxp / CVE-2026-76172: host confusion via percent-encoded scheme normalization
  GHSA-5jgf-p345-68v8 / CVE-2026-75931: host confusion via skipped IDN canonicalization
  The existing >=4.1.2 resolution landed exactly on the vulnerable version,
  so the lower bound had to move.
- browserslist 4.28.4 -> 4.28.8, new resolution >=4.28.7 <5
  GHSA-73wf-gq98-2v4g / CVE-2026-73088: uncaught crash / prototype write in
  normalizeStats via untrusted browserslist-stats.json.
  The upper bound matches the existing style used for brace-expansion and
  linkify-it.

The remaining yarn.lock churn is browserslist's own data packages
(caniuse-lite, electron-to-chromium, node-releases, baseline-browser-mapping,
update-browserslist-db). No unrelated package was upgraded.

Dependency-only change, so no new tests accompany it. Verified with
make check, make test, and the extension's build, test and lint targets.
This commit is contained in:
Kite
2026-09-05 11:57:36 +08:00
committed by GitHub
parent 9cd9297305
commit 2190f11fcd
4 changed files with 39 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
extensions/vscode/package.json
+3 -2
View File
@@ -114,9 +114,10 @@
"minimatch": "^10.2.6",
"@typescript-eslint/typescript-estree/minimatch": "^10.2.6",
"brace-expansion": ">=5.0.8 <6",
"fast-uri": ">=4.1.2",
"fast-uri": ">=4.1.3",
"postcss": ">=8.5.23",
"linkify-it": ">=5.0.2 <6"
"linkify-it": ">=5.0.2 <6",
"browserslist": ">=4.28.7 <5"
},
"dependencies": {
"preact": "^10.29.8"
extensions/vscode/yarn.lock
+33 -33
View File
@@ -1868,10 +1868,10 @@ base64-js@^1.3.1:
resolved "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a"
integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==
baseline-browser-mapping@^2.10.38:
version "2.10.38"
resolved "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.38.tgz#c84d093c4bf7325c5053c279d90f153c66526042"
integrity sha512-31/02mVB4yuQU6adKk5SlY6m+mxDwUq5KZkyYgnLrrKl7TEm1+3PyDtDBz2kOv/wxZz41GHsvV1A/u6RmiyBvw==
baseline-browser-mapping@^2.11.12:
version "2.11.21"
resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz#99af73cb8e54007e4f5345e132278e26c2662f2c"
integrity sha512-uh8vpY/1/YyFkunIDFH/12p7/7VdPKA1hejMVEbdkEaWnUz0Hesvx5EbiU6XxjyHZIOju+ZMbQJkRh+es3/spQ==
binaryextensions@^6.11.0:
version "6.11.0"
@@ -1913,16 +1913,16 @@ braces@^3.0.3:
dependencies:
fill-range "^7.1.1"
browserslist@^4.24.0, browserslist@^4.28.1:
version "4.28.4"
resolved "https://registry.npmjs.org/browserslist/-/browserslist-4.28.4.tgz#dd8b8167a32845ff5f8cd6ce13f5abba16cd04c9"
integrity sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==
"browserslist@>=4.28.7 <5", browserslist@^4.24.0, browserslist@^4.28.1:
version "4.28.8"
resolved "https://registry.yarnpkg.com/browserslist/-/browserslist-4.28.8.tgz#a3c79ceb70028527e5da7dafc887f3200b5168c0"
integrity sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==
dependencies:
baseline-browser-mapping "^2.10.38"
caniuse-lite "^1.0.30001799"
electron-to-chromium "^1.5.376"
node-releases "^2.0.48"
update-browserslist-db "^1.2.3"
baseline-browser-mapping "^2.11.12"
caniuse-lite "^1.0.30001809"
electron-to-chromium "^1.5.402"
node-releases "^2.0.53"
update-browserslist-db "^1.3.0"
bs-logger@^0.2.6:
version "0.2.6"
@@ -1999,10 +1999,10 @@ camelcase@^6.3.0:
resolved "https://registry.yarnpkg.com/camelcase/-/camelcase-6.3.0.tgz#5685b95eb209ac9c0c177467778c9c84df58ba9a"
integrity sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==
caniuse-lite@^1.0.30001799:
version "1.0.30001799"
resolved "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz#5c909138c27f1a61219d3e092071c1cc7d32dc55"
integrity sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==
caniuse-lite@^1.0.30001809:
version "1.0.30001810"
resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz#4970b477dea3278374de9bc43aa8f5d39fc3cda2"
integrity sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==
chalk@^4.0.0, chalk@^4.1.0, chalk@^4.1.2:
version "4.1.2"
@@ -2326,10 +2326,10 @@ editions@^6.21.0:
dependencies:
version-range "^4.15.0"
electron-to-chromium@^1.5.376:
version "1.5.378"
resolved "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.378.tgz#9ce9591ebed23e8a9119970305084b43a2906454"
integrity sha512-VinvOAuuPmdD1guEgGv5f2Qp7/vlfqOrUOMYNnOD4wj3pit8kRsQHzfIf6teyUGWo15Tg5+bOJaRunvyltpVWQ==
electron-to-chromium@^1.5.402:
version "1.5.422"
resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.422.tgz#e27fb1ca0e6bef612a647022e1469701fea9ee1f"
integrity sha512-UvA/32XqrLDdZSn7Jllo1AYNcWji/G0d5M0GTViE7KoGBiMunw3a34Sb2KO4ZZyrSEhqsxFoVhWWJshdyfKqJA==
emittery@^0.13.1:
version "0.13.1"
@@ -2618,10 +2618,10 @@ fast-levenshtein@^2.0.6:
resolved "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz#3d8a5c66883a16a30ca8643e851f19baa7797917"
integrity sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==
fast-uri@>=4.1.2, fast-uri@^3.0.1:
version "4.1.2"
resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-4.1.2.tgz#1e225af32fb0a178db8f14d7d9ba93ff24485694"
integrity sha512-TyGmBcbDTZXcb2cj5MV89DrF42DKvb3y5DDUNh95iO+IMeAzMkVSxK1PZRrRIpc9yg8U2GhGdbofNa0LS/a4Bw==
fast-uri@>=4.1.3, fast-uri@^3.0.1:
version "4.1.4"
resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-4.1.4.tgz#2076a9d7bce86a86aa31ac40650b935fd5b1cd60"
integrity sha512-dODXrIxlS9JSdgAnhIUKOosKV1oMtU2VtVw87QRaHzyl5jxO290Ii5tEZfCfzfWNHi3jKWwBSdQj0qIyshdZdQ==
fastq@^1.6.0:
version "1.20.1"
@@ -4010,10 +4010,10 @@ node-int64@^0.4.0:
resolved "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz#87a9065cdb355d3182d8f94ce11188b825c68a3b"
integrity sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==
node-releases@^2.0.48:
version "2.0.50"
resolved "https://registry.npmjs.org/node-releases/-/node-releases-2.0.50.tgz#597197a852071ce42fc2550e58e223242bcba969"
integrity sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==
node-releases@^2.0.53:
version "2.0.54"
resolved "https://registry.yarnpkg.com/node-releases/-/node-releases-2.0.54.tgz#09af17d5647aa9f221ec5cf2becb95b68a981afe"
integrity sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==
node-sarif-builder@^3.2.0:
version "3.4.0"
@@ -5137,10 +5137,10 @@ unrs-resolver@^1.12.1:
"@unrs/resolver-binding-win32-ia32-msvc" "1.12.2"
"@unrs/resolver-binding-win32-x64-msvc" "1.12.2"
update-browserslist-db@^1.2.3:
version "1.2.3"
resolved "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz#64d76db58713136acbeb4c49114366cc6cc2e80d"
integrity sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==
update-browserslist-db@^1.3.0:
version "1.3.2"
resolved "https://registry.yarnpkg.com/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz#9d99fbff56c50bb11ba5fd35cece5916da595836"
integrity sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==
dependencies:
escalade "^3.2.0"
picocolors "^1.1.1"
go.mod
+1 -1
View File
@@ -89,6 +89,6 @@ require (
golang.org/x/time v0.15.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
google.golang.org/grpc v1.83.0 // indirect
google.golang.org/grpc v1.83.1 // indirect
google.golang.org/protobuf v1.36.11 // indirect
)
go.sum
+2 -2
View File
@@ -199,8 +199,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d h1:
google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d/go.mod h1:K/+WGbmBY7aNW1HDw1fJnKYo10i0DkAX6pows00dLig=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=
google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y=
google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=