From 2db81a9f5be97f1e734df787d93cc0573ad2ab19 Mon Sep 17 00:00:00 2001 From: Patrick Bertsch Date: Sun, 25 Oct 2026 07:16:58 -0600 Subject: [PATCH] chore(deps): override @azure/msal-node to 7.1.0 in the VS Code extension's dev tree The patched release for GHSA-xcx6-jx8p-x3h5 is 7.1.0. Releases from 5.0.0-beta.0 up to but not including 7.1.0 are affected. In vscode/, @azure/msal-node is reached only through @azure/identity, which @vscode/vsce depends on. Both are development dependencies, and the extension has no runtime dependencies. @azure/identity declares @azure/msal-node ^6.0.0, which excludes 7.x, so a plain update cannot reach 7.1.0. The npm override is the lockfile-level fix. Checked with npm ci, npm run lint, npm test and npm run package: the packaged VSIX contains no node_modules, so the override does not reach the extension at runtime. --- CHANGELOG.md | 1 + vscode/package-lock.json | 18 ++++-------------- vscode/package.json | 3 +++ 3 files changed, 8 insertions(+), 14 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 15bc84c7..500e9fc3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -61,6 +61,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). - **VS Code: the Run Test commands no longer pass `--name` to `probe test`.** This version of the CLI defines no such flag, so those runs failed with an unknown-flag error. "FlutterProbe: Run Test File at Cursor", the CodeLens buttons and the Tests view now run the file that contains the test, and their titles and tooltips say so. Until the CLI has a per-test filter, the extension runs whole files. - **Studio: the top bar is a window drag handle on macOS.** It used `-webkit-app-region`, which Wails does not read, so the full-size content view had no drag handle. It now sets `--wails-draggable: drag`; its buttons and device picker opt out so their clicks still work. - **Studio: the macOS window has its native title bar again.** The title bar was transparent, and Wails then makes the web view cover it, so the window had no native drag area and some toolbar controls did not show. The title bar is now opaque and sits above the top bar, so the window can be dragged from it and every control shows. +- **Dev tooling: `@azure/msal-node` is pinned to 7.1.0 in the VS Code extension's development tree, which closes GHSA-xcx6-jx8p-x3h5.** The package reaches that tree through `@azure/identity`, and the packaged extension does not include it. ## [0.26.0] - 2026-10-14 diff --git a/vscode/package-lock.json b/vscode/package-lock.json index db6d42cb..d03e630f 100644 --- a/vscode/package-lock.json +++ b/vscode/package-lock.json @@ -183,29 +183,19 @@ } }, "node_modules/@azure/msal-node": { - "version": "6.0.1", - "resolved": "https://registry.npmjs.org/@azure/msal-node/-/msal-node-6.0.1.tgz", - "integrity": "sha512-ixSO1Y/kCVRthRs+hSx/5qkwaunX1/RAePhlMN0wIpIQ4WEZ6AREGGnGd1AP0qspHVsAwzWQKGubpjh50JyJIQ==", + "version": "7.1.0", + "resolved": "https://registry.npmjs.org/@azure/msal-node/-/msal-node-7.1.0.tgz", + "integrity": "sha512-s1O6hSY/C/dmqykTmmeHY6GhSkDuY8N1gxyhuLyaCwbY7N+UBvU2Wu4flas7+NxZiAPcXNPVpgt3n/HP/5yL+w==", "dev": true, "license": "MIT", "dependencies": { - "@azure/msal-common": "16.14.1", + "@azure/msal-common": "16.14.2", "jsonwebtoken": "^9.0.0" }, "engines": { "node": ">=20" } }, - "node_modules/@azure/msal-node/node_modules/@azure/msal-common": { - "version": "16.14.1", - "resolved": "https://registry.npmjs.org/@azure/msal-common/-/msal-common-16.14.1.tgz", - "integrity": "sha512-Or6xhPNyi4zHW25158yxBoyxuCqNSPa5YBVqfF1J5Ks4MJWBo/USXdp05DQIPu1Zli00YZu6t0+h6KvHJealxQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.8.0" - } - }, "node_modules/@napi-rs/keyring": { "version": "1.3.0", "resolved": "https://registry.npmjs.org/@napi-rs/keyring/-/keyring-1.3.0.tgz", diff --git a/vscode/package.json b/vscode/package.json index 32060142..6b3a7326 100644 --- a/vscode/package.json +++ b/vscode/package.json @@ -519,5 +519,8 @@ "@types/vscode": "^1.85.0", "@vscode/vsce": "^4.0.0", "typescript": "^7.0.2" + }, + "overrides": { + "@azure/msal-node": "7.1.0" } }