Kite 2190f11fcd fix(deps): bump grpc, fast-uri and browserslist to patch high-severity advisories (#1169) ...

Clears six high-severity Dependabot alerts on the default branch.

Runtime (go.mod):
- google.golang.org/grpc v1.83.0 -> v1.83.1
  GHSA-vp52-pcj8-j9qc / CVE-2026-84304: heap memory exhaustion (OOM)
  via HTTP/2 DATA frame fragmentation. Pulled in indirectly through
  internal/telemetry -> otlpmetricgrpc.

VS Code extension (development scope):
- fast-uri 4.1.2 -> 4.1.4, resolution raised from >=4.1.2 to >=4.1.3
  GHSA-f65p-4m7j-42xc / CVE-2026-75975: SSRF via malformed IPv6 normalization
  GHSA-fph4-wmhf-6fwf / CVE-2026-75899: SSRF via repeated hostname percent-decoding
  GHSA-jqff-g426-hqxp / CVE-2026-76172: host confusion via percent-encoded scheme normalization
  GHSA-5jgf-p345-68v8 / CVE-2026-75931: host confusion via skipped IDN canonicalization
  The existing >=4.1.2 resolution landed exactly on the vulnerable version,
  so the lower bound had to move.
- browserslist 4.28.4 -> 4.28.8, new resolution >=4.28.7 <5
  GHSA-73wf-gq98-2v4g / CVE-2026-73088: uncaught crash / prototype write in
  normalizeStats via untrusted browserslist-stats.json.
  The upper bound matches the existing style used for brace-expansion and
  linkify-it.

The remaining yarn.lock churn is browserslist's own data packages
(caniuse-lite, electron-to-chromium, node-releases, baseline-browser-mapping,
update-browserslist-db). No unrelated package was upgraded.

Dependency-only change, so no new tests accompany it. Verified with
make check, make test, and the extension's build, test and lint targets.

2026-09-05 11:57:36 +08:00

19 KiB

Raw Permalink Blame History

View Raw