chore(deps): extend elliptic audit exception to 2026-11-06 and correct advisory notes

[tkislan]

npx better-npm-audit audit (Audit - All) and qlty check --filter=osv-scanner (Qlty Check) fail on main for one reason: the accepted-risk entry for elliptic (GHSA-848j-6mx2-7j84, low) expired on 2026-10-17. Audit - Production passes.

No new advisory has been published. A fresh rescan found the same three advisories for the root package-lock.json, and none for src/test/vscode-notebook-perf/package-lock.json. Sources: npm audit, better-npm-audit (all and --production), osv-scanner 2.3.0 (the version qlty pins) and 2.7.0, a direct OSV querybatch over all 2,298 locked name@version pairs, and the GitHub Advisory DB.

Each advisory was assessed separately against the decision ladder from #551: direct bump → lockfile-only → delete/bump a stale override → new override → .nsprc exception only when no patched release exists. Each assessment was then challenged by two independent reviewers, one on facts and reachability, one on remediation and consistency.

Decisions

Advisory	Package	Sev	Gate	Patched release	Decision
GHSA-848j-6mx2-7j84	elliptic 6.6.1	low	❌ expired	none (6.6.1 is latest)	renew to 2026-11-06, note corrected
GHSA-vfj7-8cjw-p6xm	braces 3.0.3	high	✅ until 2026-11-06	none (3.0.3 is latest)	keep, note corrected
GHSA-hp3w-g68c-fv3c	sprintf-js 1.0.3	mod	✅ until 2026-11-06	none (1.1.3 is latest, also affected)	keep, note corrected

None is a direct dependency, and no package has a patched release, so rungs 1–4 never apply in their usual form.

elliptic: renew (rung 5), expiry aligned to 2026-11-06

• Why renew: elliptic 6.6.1 (2024-11-13) is still the latest release, and the GHSA lists first_patched_version: null. Upstream has had no commit since 2024-11-13, and the fix PRs fix: preserve leading zeros in k-value during ECDSA signing (RFC 6979) indutny/elliptic#345, chore(deps): update dependency tar to v7.5.10 [security] #351 and chore(deps): bump dompurify from 3.3.1 to 3.3.2 #354 are open and unmerged. The parents are all at their latest releases and still require elliptic: crypto-browserify 3.12.1, create-ecdh 4.0.4, browserify-sign 4.2.6, node-stdlib-browser 1.3.1. Same shape as chore(deps): extend elliptic audit exception to 2026-10-17 #531.
• Why 2026-11-06 rather than one month: it matches braces and sprintf-js, so one renewal PR handles all three. fix(deps): Address npm security advisories #327 did the same when it moved every exception to one date.
• Still not shipped: npm ls elliptic --omit=dev is empty. dist/*.esbuild.meta.json has 0 elliptic, browserify-sign or crypto-browserify inputs. out/** and node_modules/** are excluded from the VSIX.

Corrections to the note, after re-checking every claim as #531 did:

-... when k has leading zeros, emitting a truncated signature; an attacker ... can recover the private key.
+... when k has leading zeros and truncates it, emitting an incorrect signature; an attacker ... can, under
+certain conditions, recover the private key. Only ECDSA signing (crypto-browserify's createSign with an EC key) is affected.
 ...
-(src/test/web/index.ts -> out/extension.web.bundle.js, excluded from the VSIX by `out/**` in .vscodeignore); the production ...
+(src/test/web/index.ts -> out/extension.web.bundle.js, excluded from the VSIX by `out/**` in .vscodeignore). That bundle does
+include elliptic, because the plugin resolves node:crypto to crypto-browserify both for @deepnote/convert's static import of
+createHash and randomUUID, which loads it at startup, and for the Node-only dynamic import in src/platform/common/crypto.ts. The production ...
-No code in this extension performs ECDSA signing.
+No code in this extension or in @deepnote/convert calls createSign, createVerify or createECDH.
-... GitHub lists no patched version, and npm audit reports fixAvailable:false. The real remediation is an upstream elliptic
-release, or dropping node-stdlib-browser from the web test bundle in favour of native browser crypto.
+... GitHub lists no patched version, npm audit reports fixAvailable:false, and the upstream fix PRs (indutny/elliptic#345, #351,
+#354) are unmerged. Native browser crypto cannot replace the polyfill, because @deepnote/convert needs a synchronous createHash.
+Alternative remediation if no upstream fix lands: a root `elliptic` override to npm:empty-pkg@1.0.0 plus an alias of elliptic to a
+`module.exports = {}` stub in the web test build only (...). That replaces elliptic@6.6.1 in the lockfile with empty-pkg, removes it
+from the bundle, and leaves only createECDH and EC-key createSign/createVerify non-functional in the web test polyfill.
-        "expiry": "2026-10-17"
+        "expiry": "2026-11-06"

 # osv-scanner.toml
 id = "GHSA-848j-6mx2-7j84"
-ignoreUntil = 2026-10-17
+ignoreUntil = 2026-11-06

Options considered for elliptic and set aside (each tested in a clean copy of the repo)

• Remove elliptic structurally: a root "elliptic": "npm:empty-pkg@1.0.0" override, plus a 3-line module.exports = {} stub aliased in the isWebTestSource branch of build/esbuild/build.ts, plus deleting both exception entries.
  • Results: both gates pass with no exception. Dev and production esbuild builds pass. The drift check is stable. dist/ is unchanged. The lockfile loses 5 entries (elliptic, its nested bn.js, hash.js, hmac-drbg, minimalistic-crypto-utils).
  • Set aside to keep this PR to the renewal, as chore(deps): extend elliptic audit exception to 2026-10-17 #531 and chore(deps): resolve dependency vulnerabilities (2026-10-06) #551 did for sprintf-js. The note records it as the fallback.
• Override alone, without a build change:
  • Overriding crypto-browserify breaks every esbuild build, because node-stdlib-browser calls require.resolve('crypto-browserify') when it loads.
  • Overriding elliptic breaks the web test bundle (Could not resolve "elliptic" ×3).
  • Scoping the override under node-stdlib-browser changes nothing: npm 10.9.4 leaves the lockfile as it is.
• Map crypto to an empty or native shim in the polyfill plugin: elliptic stays in the lockfile, so neither gate clears. It also breaks @deepnote/convert (createHash is not a function).
• Drop node-stdlib-browser: 14 builtins would need replacements, and a synchronous hash polyfill is still needed. Out of proportion for a low-severity, dev-only finding.
• Patched third-party forks (@mapped/elliptic, @soatok/elliptic-to-noble): a new crypto dependency from little-used publishers, for code that never runs here. Not adopted.

braces: exception kept (expiry unchanged), note corrected

There is still no fix. The maintainer disputes the report (micromatch/braces#70), and fix PRs #72, #83, #86 and #89 were closed unmerged. Three claims in the note had gone stale or were wrong:

-The dev-time callers (mocha and gulp via chokidar; esbuild-plugin-import-glob and @vscode/vsce via fast-glob) expand only glob
-patterns written in this repository.
+The dev-time callers (gulp via glob-watcher -> chokidar and gulp-cli -> liftoff -> findup-sync -> micromatch; esbuild-plugin-import-glob
+and @vscode/vsce via fast-glob) expand only glob patterns written in this repository or hard-coded in those tools.
-... GitHub lists no patched version, npm audit reports fixAvailable:false, and micromatch@4.0.8 and fast-glob@3.3.3 (both latest)
-require braces ^3.0.3. When a patched braces is published, raise or delete the exact `braces` override (...) and remove this entry.
+... GitHub lists no patched version, and the maintainer disputes the report (micromatch/braces#70). npm audit's fixAvailable for
+braces is a semver-major change that leaves braces installed (a downgrade to gulp@3.9.1, or @vscode/vsce@4.0.0 on some runs).
+micromatch@4.0.8 (latest, also required by fast-glob@3.3.3, latest) requires braces ^3.0.3, and chokidar@3.5.3 requires ~3.0.2.
+When a patched braces is published, raise or delete the exact `braces` override (...) and remove this entry and its osv-scanner.toml mirror.

• mocha: since chore(deps): update devdependencies #289, mocha 11.8.0 uses chokidar 4.0.3, which has no braces dependency.
• fixAvailable:false: wrong today. Neither suggested change removes braces, because jest-message-util and chokidar still require it.
• chokidar's ~3.0.2 range: recorded because it means a future 3.1.x fix would need the override raised, not deleted.

sprintf-js: exception kept (expiry unchanged), note corrected

-... and argparse formats only its own usage/help templates with sprintf.
+... and argparse formats only its caller's usage/help templates and one fixed error message (`ignored explicit argument %r`) with sprintf.
-... published 2023-09-11), GitHub lists no patched version, and npm audit reports fixAvailable:false.
+... published 2023-09-11), and GitHub lists no patched version. npm audit's fixAvailable is a semver-major downgrade to nyc@14.1.1,
+which still depends on js-yaml ^3.13.1 and so on sprintf-js; the latest nyc (18.0.0) still requires @istanbuljs/load-nyc-config
+^1.0.0, whose latest release (1.1.0) requires js-yaml ^3.13.1. CVE-2026-97058 was rejected by its CNA (VulnCheck) on 2026-10-12
+and NVD lists it as Rejected, but GHSA-hp3w-g68c-fv3c is not withdrawn; once it is, delete this entry and its osv-scanner.toml mirror.

The "argparse@1": "2.0.1" structural alternative already recorded in the note was re-verified and still works. It isn't needed while the exception holds.

Verification

Check	main	this PR
npx better-npm-audit audit	exit 1 (advisory 1112030)	exit 0, all 3 exceptions active until Fri, 06 Nov 2026
npx better-npm-audit audit --production	exit 0	exit 0 (dev-only elliptic/sprintf-js exceptions listed as unused, informational)
osv-scanner 2.3.0 --config=osv-scanner.toml on package-lock.json	exit 1 (elliptic 6.6.1)	exit 0, "No issues found"
osv-scanner 2.3.0 on the perf fixture lockfile	exit 0	exit 0

• .nsprc parses as JSON. Its three IDs and expiries match osv-scanner.toml exactly.
• package.json, package-lock.json and the build are untouched, so no install, drift or bundle change.
• Expiry semantics checked: better-npm-audit (dayjs().isAfter(expiry)) and osv-scanner (ignoreUntil) both stop applying an exception at local midnight of the expiry date. CI runs in UTC, so these exceptions stop applying at 2026-11-06T00:00Z.

Heads-up

All three exceptions expire on 2026-11-06. Unless upstream ships fixes (or GitHub withdraws the sprintf-js GHSA after the CVE rejection), both gates will go red again that day. The notes now record the fallback remediations: the elliptic empty-pkg + stub path, and the sprintf-js argparse@1 override.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NMBxX24nF2qRaSRtmgH9mB

Summary by CodeRabbit

• Chores
  • Refreshed security advisory tracking notes for three vulnerabilities, including review dates, affected development-time paths, and audit-fix details. Updated the scheduled review date for one advisory. No changes to product features or behavior are included in this update.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: c5bf99ba-712d-44c1-9d46-8ab72626a4c2

📥 Commits

Reviewing files that changed from the base of the PR and between 3fe3e15 and a6b8330.

📒 Files selected for processing: 2

• .nsprc
• osv-scanner.toml

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The .nsprc notes for elliptic, braces, and sprintf-js were revised with updated dependency, usage-path, audit, and cleanup details. The ignoreUntil date for GHSA-848j-6mx2-7j84 changed to 2026-11-06.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Suggested reviewers: dinohamzic

Merge Risk: ⚪ Minimal · up to a6b83

The change updates audit-exception dates and advisory notes without establishing new shipped-product exposure. The elliptic exception expires November 6; no concrete merge-blocking risk remains.

Pre-merge checks: 6

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately summarizes the two main changes: extending the elliptic audit exception to 2026-11-06 and correcting advisory notes.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Updates Docs		No feature is implemented in this PR. The authoritative diff changes only .nsprc and osv-scanner.toml audit notes and expiry dates. The documentation-update requirement therefore does not apply.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38%. Comparing base (3fe3e15) to head (a6b8330).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #574   +/-   ##
=====================================
  Coverage     38%     38%           
=====================================
  Files        822     822           
  Lines      41098   41098           
  Branches    9044    9044           
=====================================
  Hits       15622   15622           
  Misses     23404   23404           
  Partials    2072    2072           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.