chore(deps): remediate Dependabot alerts for undici, tar, brace-expansion, and ip-address

[dborgards]

Summary

Clears the GitHub Dependabot/security alerts currently reported against package-lock.json for undici, brace-expansion, tar, and ip-address. These are dev-only / release-toolchain packages, not runtime dependencies of the VS Code extension.

How they were pulled in

None of the four packages are direct dependencies. Investigation of the lockfile showed:

Package	Previous lockfile version	How it entered the tree
undici 6.x	6.26.0	Bundled inside npm@11.17.0 (@semantic-release/npm → npm)
undici 8.x	8.5.0	Hoisted by the previous "undici": ">=6.24.0" override (used by @semantic-release/github / @actions/http-client)
brace-expansion	5.0.6	Bundled inside npm@11.17.0
tar	7.5.16	Bundled inside npm@11.17.0
ip-address	10.2.0	Bundled inside npm@11.17.0 (socks → ip-address)

@semantic-release/npm is configured with npmPublish: false (version bump only), but it still depends on the npm CLI package, which vendors the vulnerable copies. npm overrides cannot replace bundleDependencies, so a parent npm bump is required.

Published npm@11.19.0 and npm@12.0.2 still vendor ip-address@10.2.0. The patched set is on npm/cli release/v11 commit 4791b27 (npm/cli#9872, merged 2026-08-25). Registry releases 11.20.0 / 12.1.0 are not published yet (npm/cli#9839 is still open).

What changed

• Pin npm via overrides to git+https://github.com/npm/cli.git#4791b27f… (stays on the 11.x line required by @semantic-release/npm@^11.6.2).
• Scope undici overrides per dependent so each major stays in-range: @actions/http-client → ^6.28.0, @semantic-release/github → ^7.29.0. No global 8.x pin.
• CI workflows rewrite GitHub SSH git URLs (quoted url."https://github.com/" plus SCP-style git@github.com:) to HTTPS.

Patched versions (lockfile)

Package	Before	After	GitHub-requested floor
undici (bundled in npm)	6.26.0	6.28.0	~> 6.27.0
undici (@actions/http-client)	(hoisted 8.5.0)	6.28.0	~> 6.27.0
undici (@semantic-release/github)	(hoisted 8.5.0)	7.29.0	7.29.0+ for 7.x CVEs
brace-expansion	5.0.6	5.0.9	~> 5.0.7
tar	7.5.16	7.5.22	~> 7.5.18
ip-address	10.2.0	10.5.0	~> 10.2.1 (CVE-2026-69192 is 10.3.1+)

CVEs addressed

undici — CVE-2026-13697 (High; 7.x/8.x, fixed 7.29.0 / 8.9.0), CVE-2026-16728 (Moderate; fixed 6.28.0 / 7.29.0 / 8.9.0), CVE-2026-9679 (Moderate), CVE-2026-6733 (Low), CVE-2026-11525 (Low), plus later 6.27.0 advisories.

brace-expansion — CVE-2026-13149 (High; < 5.0.7).

tar — CVE-2026-59871 (Moderate; <= 7.5.17).

ip-address — CVE-2026-69192 (High; < 10.3.1), CVE-2026-54272 (Moderate), CVE-2026-69198 (Moderate).

Follow-up: when npm@11.20.0 or 12.1.0 ships on the registry, replace the git pin with that published version.

Test plan

• npm ci succeeds
• npm audit reports 0 vulnerabilities
• npm audit signatures succeeds (release workflow check)
• vsce package still produces a VSIX
• Bundled npm CLI reports 11.19.0 and loads from the pinned commit
• CI Build VSIX Package workflow passes on this PR (re-run after review fixes)

Made with Cursor

  

[Copilot]

🟡 Changes recommended

The workflow git URL rewrite command is currently malformed (likely ineffective), and the global undici override forces a major version beyond several dependents’ declared semver ranges, which risks breaking the release toolchain.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR remediates Dependabot/security alerts in the Node.js dev/release toolchain by updating the lockfile (including a git-pinned npm CLI) and adjusting CI workflows to support installing git-based dependencies.

Changes:

• Tightens undici and pins npm (CLI) via overrides to pick up upstream security fixes.
• Updates package-lock.json to reflect patched transitive versions (e.g., undici, tar, brace-expansion, ip-address) pulled in via the pinned npm bundle.
• Adds a CI step intended to force GitHub git dependencies to fetch over HTTPS.

File summaries

File	Description
package.json	Updates overrides for undici and pins npm to a specific upstream git commit.
package-lock.json	Refreshes the dependency tree to the patched versions (including npm bundled deps).
.github/workflows/semantic-release.yml	Adds git URL rewrite step before npm ci to support git dependencies.
.github/workflows/release.yml	Adds git URL rewrite step before npm install.
.github/workflows/publish-marketplace.yml	Adds git URL rewrite step before npm install.
.github/workflows/build-vsix.yml	Adds git URL rewrite step before npm install.

Review details

• Files reviewed: 5/6 changed files
• Comments generated: 5
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The changes are narrowly scoped to dependency remediation and CI install reliability, and the updated overrides/lockfile align with the stated remediation strategy without introducing incompatible major upgrades.

Review details

• Files reviewed: 5/6 changed files
• Comments generated: 0 new
• Review effort level: Lite