You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
npx better-npm-audit audit (.github/workflows/ci.yml:281, job Audit - All) failed on main with 1 finding. The .nsprc exception for GHSA-xcx6-jx8p-x3h5 expired on 2026-11-10. npx better-npm-audit audit --production (ci.yml:259) was already passing.
After this change, both commands print All good! (exit code 0).
Accepted risks live in .nsprc and are mirrored in osv-scanner.toml (Qlty's osv-scanner). This exception's notes said to remove it, along with its osv mirror, "once an @azure/identity release admits msal-node >=7.1.0" (added in chore(deps): resolve dependency vulnerabilities (2026-10-27) #589).
Advisory:GHSA-xcx6-jx8p-x3h5 / CVE-2026-109461, high. The authorization code flow may disclose request parameters to an attacker-controlled endpoint. Path:@vscode/vsce@3.9.2 (root devDependency) and vscode-extension-tester@8.28.1 → @vscode/vsce@4.0.0 → @azure/identity@4.14.0 → @azure/msal-node@6.0.1. Dev-only.
Decision: lockfile-only.@azure/identity@4.14.1 (published 2026-10-29) now declares @azure/msal-node: ^7.1.0, and both vsce versions declare @azure/identity: ^4.1.0. That range already admits 4.14.1, so neither the manifest nor any override changes. npm update @azure/identity --package-lock-only resolves @azure/msal-node to 7.2.1, the newest release in ^7.1.0. It was published 2026-11-06, which is past Renovate's 3-day minimumReleaseAge, and it requires Node >=20 (the repo uses 22.21.1).
Other packages the update moves:
@azure/msal-node's nested @azure/msal-common: 16.14.1 → 16.16.1 (exact pin from msal-node)
The expired exception is removed from both .nsprc and osv-scanner.toml:
- "GHSA-xcx6-jx8p-x3h5": {- "notes": "CVE-2026-109461: @azure/msal-node's authorization code flow ... Remove this entry and its osv-scanner.toml mirror once an @azure/identity release admits msal-node >=7.1.0.",- "expiry": "2026-11-10"- }
-[[IgnoredVulns]]-id = "GHSA-xcx6-jx8p-x3h5"-ignoreUntil = 2026-11-10-reason = "CVE-2026-109461 (@azure/msal-node): dev-only, via @vscode/vsce; flow never used; no 6.x fix. See .nsprc."
Risk: vsce uses @azure/identity only for vsce publish and verify-pat --azure-credential. This repo only runs vsce package. The 6 → 7 major bump of msal-node is internal to @azure/identity, which chose that range itself.
Verified:
npm ls @azure/identity @azure/msal-node shows 4.14.1 → 7.2.1 under both vsce copies, with no 6.x left.
npm audit --json reports no @azure/* entries.
require('@azure/identity') loads.
npx vsce --version runs.
Decided with the user
Nothing. The fix was lockfile-only and followed the precedent above.
Checks
Command
Result
npm ci --prefer-offline --no-audit
exit 0
npx better-npm-audit audit --production
All good!
npx better-npm-audit audit
All good!
npm install then compare the lockfile (CI's Package Lock Drift Check)
no drift
Not fixed
Exceptions expiring 2026-11-15:GHSA-3g3m-2fjr-6pw4 (glob) and GHSA-g3hv-75wg-m249 (minimatch). They are not failing today and are out of scope here, but they need a revisit before that date.
Stale-exception warnings:better-npm-audit audit --production warns that the remaining three exceptions "did not match any of the found vulnerabilities". It printed the same warning before this change. This is expected: those advisories are dev-only, so the production audit doesn't see them, while the all-dependencies audit still needs the exceptions.
Summary by CodeRabbit
Security
The GHSA-xcx6-jx8p-x3h5 advisory for @azure/msal-node is no longer excluded from vulnerability scan results. Scans can now surface this finding rather than treating it as an accepted risk. Its previous exception and expiry date have been removed from the scanner configuration. This change affects scan reporting; it does not itself change the package or its vulnerability status.
@azure/identity 4.14.1 declares @azure/msal-node ^7.1.0, so a lockfile-only
update within @vscode/vsce's ^4.1.0 range moves msal-node 6.0.1 -> 7.2.1 and
clears GHSA-xcx6-jx8p-x3h5. Remove its expired accepted-risk entry from
.nsprc and osv-scanner.toml.
No actionable comments were generated in the recent review.
Walkthrough
The PR removes the GHSA-xcx6-jx8p-x3h5 exception entries from .nsprc and osv-scanner.toml. The entries included accepted-risk notes, reasons, and expiration dates.
This change removes an expired vulnerability exception after the dependency update. No runtime behavior changes, and no actionable merge risk remains.
Pre-merge checks: 5
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title clearly summarizes the dependency vulnerability fix and matches the changes described in the PR objectives.
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Updates Docs
The PR updates development dependencies and removes audit exceptions. It does not implement a feature, so the documentation requirement does not apply. The linked repositories are unavailable; please …
Full details: Updates Docs
Explanation
The PR updates development dependencies and removes audit exceptions. It does not implement a feature, so the documentation requirement does not apply. The linked repositories are unavailable; please check their documentation and roadmap if updates are needed.
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Essentials
Run ID: fc5bb0eb-2b9e-49f1-aaca-25143aac408e
Commits
Reviewing files that changed from the base of the PR and between 6cb33fb and b6dec2f.
Files ignored due to path filters: 1
package-lock.json is excluded by !**/package-lock.json
Files selected for processing: 2
.nsprc
osv-scanner.toml
Files with no reviewable changes: 2
osv-scanner.toml
.nsprc
Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.
✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38%. Comparing base (6cb33fb) to head (b6dec2f).
✅ All tests successful. No failed tests found.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Audit
npx better-npm-audit audit(.github/workflows/ci.yml:281, job Audit - All) failed onmainwith 1 finding. The.nsprcexception for GHSA-xcx6-jx8p-x3h5 expired on 2026-11-10.npx better-npm-audit audit --production(ci.yml:259) was already passing.After this change, both commands print
All good!(exit code 0).Precedent
npm update <pkg> --package-lock-only(chore(deps): resolve dependency vulnerabilities (2026-10-27) #589)..nsprcand are mirrored inosv-scanner.toml(Qlty's osv-scanner). This exception's notes said to remove it, along with its osv mirror, "once an @azure/identity release admits msal-node >=7.1.0" (added in chore(deps): resolve dependency vulnerabilities (2026-10-27) #589).chore(deps):title prefix, and date suffix follow chore(deps): resolve dependency vulnerabilities (2026-10-27) #589 and chore(deps): resolve dependency vulnerabilities (2026-11-01) #594.@azure/msal-node
Advisory: GHSA-xcx6-jx8p-x3h5 / CVE-2026-109461, high. The authorization code flow may disclose request parameters to an attacker-controlled endpoint.
Path:
@vscode/vsce@3.9.2(root devDependency) andvscode-extension-tester@8.28.1 → @vscode/vsce@4.0.0→@azure/identity@4.14.0→@azure/msal-node@6.0.1. Dev-only.Decision: lockfile-only.
@azure/identity@4.14.1(published 2026-10-29) now declares@azure/msal-node: ^7.1.0, and both vsce versions declare@azure/identity: ^4.1.0. That range already admits 4.14.1, so neither the manifest nor any override changes.npm update @azure/identity --package-lock-onlyresolves@azure/msal-nodeto 7.2.1, the newest release in^7.1.0. It was published 2026-11-06, which is past Renovate's 3-dayminimumReleaseAge, and it requires Node>=20(the repo uses 22.21.1).Other packages the update moves:
@azure/msal-node's nested@azure/msal-common: 16.14.1 → 16.16.1 (exact pin from msal-node)jsonwebtoken's nestedsemver: 7.8.5 → 7.8.6 (within range)"node_modules/@azure/identity": { - "version": "4.14.0", + "version": "4.14.1", ... - "@azure/msal-node": "^6.0.0", + "@azure/msal-node": "^7.1.0", ... "node_modules/@azure/msal-node": { - "version": "6.0.1", + "version": "7.2.1",The expired exception is removed from both
.nsprcandosv-scanner.toml:Risk: vsce uses
@azure/identityonly forvsce publishandverify-pat --azure-credential. This repo only runsvsce package. The 6 → 7 major bump of msal-node is internal to@azure/identity, which chose that range itself.Verified:
npm ls @azure/identity @azure/msal-nodeshows 4.14.1 → 7.2.1 under both vsce copies, with no 6.x left.npm audit --jsonreports no@azure/*entries.require('@azure/identity')loads.npx vsce --versionruns.Decided with the user
Nothing. The fix was lockfile-only and followed the precedent above.
Checks
npm ci --prefer-offline --no-auditnpx better-npm-audit audit --productionAll good!npx better-npm-audit auditAll good!npm installthen compare the lockfile (CI's Package Lock Drift Check)Not fixed
better-npm-audit audit --productionwarns that the remaining three exceptions "did not match any of the found vulnerabilities". It printed the same warning before this change. This is expected: those advisories are dev-only, so the production audit doesn't see them, while the all-dependencies audit still needs the exceptions.Summary by CodeRabbit
GHSA-xcx6-jx8p-x3h5advisory for@azure/msal-nodeis no longer excluded from vulnerability scan results. Scans can now surface this finding rather than treating it as an accepted risk. Its previous exception and expiry date have been removed from the scanner configuration. This change affects scan reporting; it does not itself change the package or its vulnerability status.