From 4f16f7f32ff712be9221074cf8eb1815064fbc71 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Thu, 16 Jul 2026 21:14:14 +0000 Subject: [PATCH 1/3] fix: remote/package.json & remote/package-lock.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-WS-17988732 --- remote/package-lock.json | 39 +++++++++++---------------------------- remote/package.json | 2 +- 2 files changed, 12 insertions(+), 29 deletions(-) diff --git a/remote/package-lock.json b/remote/package-lock.json index a7a687c1656c..31e91a27957e 100644 --- a/remote/package-lock.json +++ b/remote/package-lock.json @@ -52,7 +52,7 @@ "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", "vscode-textmate": "^9.3.2", - "ws": "^8.19.0", + "ws": "^8.21.1", "yauzl": "^3.3.1", "yazl": "^2.4.3", "zod": "^3.25.76" @@ -119,9 +119,6 @@ "cpu": [ "arm64" ], - "libc": [ - "glibc" - ], "license": "SEE LICENSE IN LICENSE.md", "optional": true, "os": [ @@ -138,9 +135,6 @@ "cpu": [ "x64" ], - "libc": [ - "glibc" - ], "license": "SEE LICENSE IN LICENSE.md", "optional": true, "os": [ @@ -157,9 +151,6 @@ "cpu": [ "arm64" ], - "libc": [ - "musl" - ], "license": "SEE LICENSE IN LICENSE.md", "optional": true, "os": [ @@ -176,9 +167,6 @@ "cpu": [ "x64" ], - "libc": [ - "musl" - ], "license": "SEE LICENSE IN LICENSE.md", "optional": true, "os": [ @@ -545,15 +533,6 @@ "url": "https://opencollective.com/parcel" } }, - "node_modules/@parcel/watcher/node_modules/@parcel/watcher-linux-arm-musl": { - "optional": true - }, - "node_modules/@parcel/watcher/node_modules/@parcel/watcher-linux-arm64-musl": { - "optional": true - }, - "node_modules/@parcel/watcher/node_modules/@parcel/watcher-linux-x64-musl": { - "optional": true - }, "node_modules/@parcel/watcher/node_modules/node-addon-api": { "version": "7.1.1", "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz", @@ -1625,9 +1604,6 @@ "nan": "^2.23.0" } }, - "node_modules/ssh2/node_modules/cpu-features": { - "optional": true - }, "node_modules/string_decoder": { "version": "1.3.0", "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz", @@ -1720,6 +1696,13 @@ "integrity": "sha512-pkY1fj1cKHb2seWDy0B16HeWyczlJA9/WW3u3c4z/NiWDsO3DOU5D7nhTLE9CF0yXv/QZFY7sEJmj24dK+Rrqw==", "license": "MIT" }, + "node_modules/tslib": { + "version": "2.8.1", + "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz", + "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==", + "license": "0BSD", + "peer": true + }, "node_modules/tunnel-agent": { "version": "0.6.0", "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz", @@ -1809,9 +1792,9 @@ "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8= sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==" }, "node_modules/ws": { - "version": "8.20.1", - "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz", - "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==", + "version": "8.21.1", + "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz", + "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==", "license": "MIT", "engines": { "node": ">=10.0.0" diff --git a/remote/package.json b/remote/package.json index 5d9e8c2c0b40..ce129a78d12e 100644 --- a/remote/package.json +++ b/remote/package.json @@ -47,7 +47,7 @@ "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", "vscode-textmate": "^9.3.2", - "ws": "^8.19.0", + "ws": "^8.21.1", "yauzl": "^3.3.1", "yazl": "^2.4.3", "zod": "^3.25.76" From e289b7c644249aa15ac4fc8c2d61cba69e52d03a Mon Sep 17 00:00:00 2001 From: Tim Mok Date: Fri, 17 Jul 2026 11:02:00 -0400 Subject: [PATCH 2/3] Regenerate remote/package-lock.json for ws 8.21.1 Snyk's automated fix regenerated the lock file but dropped several optional placeholder entries (@parcel/watcher-linux-*-musl, ssh2/cpu-features), leaving it out of sync with package.json and causing npm ci to fail in CI with EUSAGE. Co-Authored-By: Claude Sonnet 5 --- remote/package-lock.json | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/remote/package-lock.json b/remote/package-lock.json index 31e91a27957e..9d65696449bd 100644 --- a/remote/package-lock.json +++ b/remote/package-lock.json @@ -533,6 +533,15 @@ "url": "https://opencollective.com/parcel" } }, + "node_modules/@parcel/watcher/node_modules/@parcel/watcher-linux-arm-musl": { + "optional": true + }, + "node_modules/@parcel/watcher/node_modules/@parcel/watcher-linux-arm64-musl": { + "optional": true + }, + "node_modules/@parcel/watcher/node_modules/@parcel/watcher-linux-x64-musl": { + "optional": true + }, "node_modules/@parcel/watcher/node_modules/node-addon-api": { "version": "7.1.1", "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz", @@ -1604,6 +1613,9 @@ "nan": "^2.23.0" } }, + "node_modules/ssh2/node_modules/cpu-features": { + "optional": true + }, "node_modules/string_decoder": { "version": "1.3.0", "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz", @@ -1696,13 +1708,6 @@ "integrity": "sha512-pkY1fj1cKHb2seWDy0B16HeWyczlJA9/WW3u3c4z/NiWDsO3DOU5D7nhTLE9CF0yXv/QZFY7sEJmj24dK+Rrqw==", "license": "MIT" }, - "node_modules/tslib": { - "version": "2.8.1", - "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz", - "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==", - "license": "0BSD", - "peer": true - }, "node_modules/tunnel-agent": { "version": "0.6.0", "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz", From ed59cbdf67fba43b176e1579bd1445f384536173 Mon Sep 17 00:00:00 2001 From: Tim Mok Date: Fri, 17 Jul 2026 13:38:39 -0400 Subject: [PATCH 3/3] fix: bump ws to 8.21.1 in remote/reh-web to match remote/ remote/reh-web has its own package.json/package-lock.json for the ws dependency that the Snyk fix didn't update, causing npm ci to fail with a lock file mismatch (ws@8.20.0 vs required ^8.21.1). Co-Authored-By: Claude Sonnet 5 --- remote/reh-web/package-lock.json | 29 +++++++++++++++++++++++++---- remote/reh-web/package.json | 2 +- 2 files changed, 26 insertions(+), 5 deletions(-) diff --git a/remote/reh-web/package-lock.json b/remote/reh-web/package-lock.json index 479535efcb02..35cf0588e206 100644 --- a/remote/reh-web/package-lock.json +++ b/remote/reh-web/package-lock.json @@ -58,7 +58,7 @@ "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", "vscode-textmate": "^9.3.2", - "ws": "^8.19.0", + "ws": "^8.21.1", "yauzl": "^3.3.1", "yazl": "^2.4.3", "zod": "^3.25.76" @@ -2112,6 +2112,13 @@ "integrity": "sha512-oezN7mJVm5qZDVEby7OzxCLKUpUN5of0rY4dvOWaDF2JZBlGpd3BXceFN8B53qlTaIkVSzP65aAMT0Vc+/N25Q==", "license": "MIT" }, + "node_modules/tslib": { + "version": "2.8.1", + "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz", + "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==", + "license": "0BSD", + "peer": true + }, "node_modules/tunnel-agent": { "version": "0.6.0", "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz", @@ -2130,6 +2137,20 @@ "integrity": "sha512-KXXFFdAbFXY4geFIwoyNK+f5Z1b7swfXABfL7HXCmoIWMKU3dmS26672A4EeQtDzLKy7SXmfBu51JolvEKwtGA==", "license": "Unlicense" }, + "node_modules/typescript": { + "version": "5.9.3", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", + "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==", + "license": "Apache-2.0", + "peer": true, + "bin": { + "tsc": "bin/tsc", + "tsserver": "bin/tsserver" + }, + "engines": { + "node": ">=14.17" + } + }, "node_modules/undici": { "version": "7.3.0", "resolved": "https://registry.npmjs.org/undici/-/undici-7.3.0.tgz", @@ -2207,9 +2228,9 @@ "license": "ISC" }, "node_modules/ws": { - "version": "8.20.0", - "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz", - "integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==", + "version": "8.21.1", + "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz", + "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==", "license": "MIT", "engines": { "node": ">=10.0.0" diff --git a/remote/reh-web/package.json b/remote/reh-web/package.json index 24c40853766f..318d3dc61f2f 100644 --- a/remote/reh-web/package.json +++ b/remote/reh-web/package.json @@ -53,7 +53,7 @@ "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", "vscode-textmate": "^9.3.2", - "ws": "^8.19.0", + "ws": "^8.21.1", "yauzl": "^3.3.1", "yazl": "^2.4.3", "zod": "^3.25.76"