From c4027af0fc1fffc764166c84943ca67d11e5d797 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jiri=20Dan=C4=9Bk?= Date: Thu, 7 May 2026 19:53:32 +0200 Subject: [PATCH] Add es5-ext to .moduleignore to exclude quarantined module es5-ext (0.10.63 and 0.10.64) is quarantined by Nexus Firewall (sonatype-2022-2248) due to undisclosed postinstall code execution. es5-ext is only consumed in websocket's browser.js inside a try/catch with a globalThis fallback, so it is unnecessary in the browsers/runtimes VS Code supports. Adding it to .moduleignore strips it from the build output entirely. Fixes #310541 Co-authored-by: Cursor --- build/.moduleignore | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/build/.moduleignore b/build/.moduleignore index f83624f893c37..d1a8a227d958c 100644 --- a/build/.moduleignore +++ b/build/.moduleignore @@ -238,3 +238,8 @@ zone.js/dist/** @github/copilot-sdk/node_modules/@github/copilot-linux-x64/** @github/copilot-sdk/node_modules/@github/copilot-win32-arm64/** @github/copilot-sdk/node_modules/@github/copilot-win32-x64/** + +# es5-ext is quarantined protestware (sonatype-2022-2248). It is only consumed +# in websocket's browser.js inside a try/catch with a globalThis fallback, +# so it is unnecessary in the browsers/runtimes VS Code supports. +es5-ext/**