Problem
Dependabot alert #13 (high): brace-expansion <= 5.0.7 ReDoS, first patched version is 5.0.8 ONLY — no in-major 2.x patch exists. The vulnerable copy (2.1.2) reaches the vsix via napl -> vscode-languageclient@9.0.1 -> minimatch@5.1.9.
Why the obvious fix is unsound (verified adversarially)
A pnpm override to 5.0.8 was applied and reviewed: lockfile effect was exactly as intended, but brace-expansion 5.x under CJS require() returns {expand} instead of the function itself. minimatch@5 calls expand(pattern) directly -> TypeError at runtime on any brace-containing pattern inside the language client (empirically reproduced). 5.x also requires Node >= 20 while the extension declares vscode ^1.75.0. Override reverted; tree is back to the dual-version pre-override state.
Options for the real fix (post-store)
- Bump vscode-languageclient when a release moves off minimatch@5, or bump its minimatch via override to a version that consumes brace-expansion 5.x correctly AND preserves the CJS call shape languageclient uses (must be proven at runtime, not assumed).
- The vsix is bundled (6 files); confirm whether the vulnerable code is even reachable in the packaged extension and whether bundle-time resolution changes the exposure.
Exposure while open
Editor-local ReDoS requiring attacker-influenced glob patterns in an extension host; no server/network surface.
Sequenced after the store rewrite (#30) per maintainer direction: this refactor class is much cheaper once the store lands.
🤖 Generated with Claude Code
Problem
Dependabot alert #13 (high): brace-expansion <= 5.0.7 ReDoS, first patched version is 5.0.8 ONLY — no in-major 2.x patch exists. The vulnerable copy (2.1.2) reaches the vsix via napl -> vscode-languageclient@9.0.1 -> minimatch@5.1.9.
Why the obvious fix is unsound (verified adversarially)
A pnpm override to 5.0.8 was applied and reviewed: lockfile effect was exactly as intended, but brace-expansion 5.x under CJS
require()returns{expand}instead of the function itself. minimatch@5 callsexpand(pattern)directly -> TypeError at runtime on any brace-containing pattern inside the language client (empirically reproduced). 5.x also requires Node >= 20 while the extension declares vscode ^1.75.0. Override reverted; tree is back to the dual-version pre-override state.Options for the real fix (post-store)
Exposure while open
Editor-local ReDoS requiring attacker-influenced glob patterns in an extension host; no server/network surface.
Sequenced after the store rewrite (#30) per maintainer direction: this refactor class is much cheaper once the store lands.
🤖 Generated with Claude Code