Open
Conversation
…g specific errors encountered during directory access.
…cy specifications for various packages
…r both mi-extension and mi-visualizer
… autoinstaller Add pnpm override to force fast-xml-parser to 5.3.7 in rush-plugins and regenerate lockfile using rush update-autoinstaller. Co-authored-by: Cursor <cursoragent@cursor.com>
[Hotfix] Enhance Windows environment detection in BallerinaExtension
|
|
Contributor
📝 WalkthroughWalkthroughUpdates fast-xml-parser dependency to version 5.3.7 across multiple configuration files, bumps ballerina-extension to v5.8.1, and enhances Windows path detection for Ballerina distributions through new fallback logic and improved environment variable handling. Changes
Sequence Diagram(s)sequenceDiagram
participant Extension as VS Code Extension
participant VersionDetection as getBallerinaVersion()
participant ShellEnv as getShellEnvironment()
participant PowerShell as PowerShell
participant PathDetection as findWindowsBallerinaPath()
Extension->>VersionDetection: Request Ballerina version
VersionDetection->>ShellEnv: Get environment variables
ShellEnv->>PowerShell: Execute registry PATH merge script
PowerShell-->>ShellEnv: Return merged environment JSON
ShellEnv-->>VersionDetection: Return environment with registry PATHs
VersionDetection->>VersionDetection: Check for ballerinaHome
alt No ballerinaHome on Windows
VersionDetection->>PathDetection: Find Windows Ballerina path
PathDetection->>PathDetection: Search registry and PATH
PathDetection-->>VersionDetection: Return Ballerina bin path
VersionDetection->>VersionDetection: Set distPath from fallback
end
VersionDetection-->>Extension: Return version with distPath
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.trivyignore (1)
8-15: Add traceability metadata for new CVE suppressions.Lines 9, 12, and 15 add long-lived ignores without a linked tracking issue or review-by date. Please add both so these suppressions don’t become permanent blind spots.
♻️ Suggested format
# No fix released by the author +# Tracking: https://github.com/wso2/vscode-extensions/issues/<issue-id> +# Review-by: 2026-06-30 CVE-2025-14505 # Library is used in nested dependencies and not directly used by our codebase. No fix released by the author. +# Tracking: https://github.com/wso2/vscode-extensions/issues/<issue-id> +# Review-by: 2026-06-30 CVE-2025-69873 # used in nested dependencies and not directly used by our codebase. No fix released by the author. +# Tracking: https://github.com/wso2/vscode-extensions/issues/<issue-id> +# Review-by: 2026-06-30 CVE-2026-26996🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.trivyignore around lines 8 - 15, Update the three CVE suppressions (CVE-2025-14505, CVE-2025-69873, CVE-2026-26996) in .trivyignore to include traceability metadata: append a tracking issue reference (e.g., GH issue number or internal ticket id) and a "review-by" date for each entry (e.g., review-by: YYYY-MM-DD), using the suggested format from the review so each ignored CVE line contains the CVE identifier plus the tracking issue and review date; ensure the metadata is clearly associated with the matching CVE entry so future reviewers can find the justification and scheduled re-review.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@workspaces/ballerina/ballerina-extension/CHANGELOG.md`:
- Around line 9-12: Add a concise "Security" bullet under the 5.8.1 changelog
entry to note the security/dependency updates shipped with this release; in the
section around the existing "### Fixed" notes for version 5.8.1, insert a new
"Security" subheading or bullet (e.g., "Security — Updated vulnerable
dependencies to patched versions") so the changelog reflects the
dependency/security fixes included in this PR.
In `@workspaces/ballerina/ballerina-extension/src/core/extension.ts`:
- Around line 2753-2759: The code iterates fs.readdirSync(root) and returns the
first versioned bin containing 'bal.bat', which is non-deterministic; modify the
loop in extension.ts (the block that builds children, versionedBin and checks
for 'bal.bat') to sort the children array so the newest version is checked first
(use semver-aware comparison or sort by parsed version tokens descending), then
iterate the sorted list and return the first matching versionedBin + path.sep;
ensure skipped non-version entries are handled and fallback behavior remains
unchanged.
- Around line 1794-1805: The Windows fallback sets distPath from
findWindowsBallerinaPath() and then builds an unquoted command that is later
passed to exec(), which breaks on paths with spaces; update the code that
constructs and executes the Ballerina version command (the place that uses
distPath to form the command passed to exec()) to wrap the absolute bal.bat path
in quotes (or better, pass the quoted executable as the first argument to
execFile/spawn) so e.g. '"' + path.join(distPath, 'bal.bat') + '"' (or use
execFile with path.join(distPath, 'bal.bat')) is used instead of an unquoted
concatenation; ensure references to distPath and findWindowsBallerinaPath remain
consistent and that any debug log still prints the unmodified path if desired.
---
Nitpick comments:
In @.trivyignore:
- Around line 8-15: Update the three CVE suppressions (CVE-2025-14505,
CVE-2025-69873, CVE-2026-26996) in .trivyignore to include traceability
metadata: append a tracking issue reference (e.g., GH issue number or internal
ticket id) and a "review-by" date for each entry (e.g., review-by: YYYY-MM-DD),
using the suggested format from the review so each ignored CVE line contains the
CVE identifier plus the tracking issue and review date; ensure the metadata is
clearly associated with the matching CVE entry so future reviewers can find the
justification and scheduled re-review.
ℹ️ Review info
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (2)
common/autoinstallers/rush-plugins/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlcommon/config/rush/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (9)
.trivyignorecommon/autoinstallers/rush-plugins/package.jsoncommon/config/rush/.pnpmfile.cjspackage.jsonworkspaces/ballerina/ballerina-extension/CHANGELOG.mdworkspaces/ballerina/ballerina-extension/package.jsonworkspaces/ballerina/ballerina-extension/src/core/extension.tsworkspaces/mi/mi-extension/package.jsonworkspaces/mi/mi-visualizer/package.json
Comment on lines
+9
to
+12
| ### Fixed | ||
|
|
||
| - **Installation** — Enhanced Windows environment detection to properly identify Ballerina distributions on Windows. | ||
|
|
Contributor
There was a problem hiding this comment.
Include security/dependency fixes in the 5.8.1 notes for completeness.
The release notes for Line 9–Line 12 currently mention only the Windows installation fix, but this PR also includes security dependency updates. Please add a concise Security bullet under 5.8.1 so the changelog reflects the shipped changes.
📝 Suggested changelog patch
### Fixed
- **Installation** — Enhanced Windows environment detection to properly identify Ballerina distributions on Windows.
+- **Security** — Updated dependencies to address known vulnerabilities (including fast-xml-parser and bn.js related fixes).📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| ### Fixed | |
| - **Installation** — Enhanced Windows environment detection to properly identify Ballerina distributions on Windows. | |
| ### Fixed | |
| - **Installation** — Enhanced Windows environment detection to properly identify Ballerina distributions on Windows. | |
| - **Security** — Updated dependencies to address known vulnerabilities (including fast-xml-parser and bn.js related fixes). |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@workspaces/ballerina/ballerina-extension/CHANGELOG.md` around lines 9 - 12,
Add a concise "Security" bullet under the 5.8.1 changelog entry to note the
security/dependency updates shipped with this release; in the section around the
existing "### Fixed" notes for version 5.8.1, insert a new "Security" subheading
or bullet (e.g., "Security — Updated vulnerable dependencies to patched
versions") so the changelog reflects the dependency/security fixes included in
this PR.
Comment on lines
+1794
to
+1805
| } else if (isWindows() && !ballerinaHome) { | ||
| // On Windows, if syncEnvironment() already merged the User+Machine PATH the | ||
| // 'bal.bat version' call below will just work via PATH lookup (distPath stays | ||
| // empty). But for restricted environments (where even User | ||
| // PATH is locked, or where VSCode's inherited PATH is still stale), we run a | ||
| // proactive directory search here so that we can use an absolute path instead | ||
| // of relying on PATH resolution. | ||
| const detectedBinPath = findWindowsBallerinaPath(); | ||
| if (detectedBinPath) { | ||
| distPath = detectedBinPath; | ||
| debug(`[VERSION] Windows fallback search found Ballerina bin: ${distPath}`); | ||
| } |
Contributor
There was a problem hiding this comment.
Quote the absolute Windows bal.bat path before execution.
Line 1803 can set distPath to locations like C:\Program Files\...\bin\. That flows into the command built at Line 1827 without quoting, so exec() can fail by treating C:\Program as the executable.
🐛 Proposed fix
- let ballerinaCommand = distPath + 'bal' + exeExtension + ' version';
+ const balExecutable = `${distPath}bal${exeExtension}`;
+ const escapedBalExecutable = balExecutable.includes(' ')
+ ? `"${balExecutable}"`
+ : balExecutable;
+ let ballerinaCommand = `${escapedBalExecutable} version`;🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@workspaces/ballerina/ballerina-extension/src/core/extension.ts` around lines
1794 - 1805, The Windows fallback sets distPath from findWindowsBallerinaPath()
and then builds an unquoted command that is later passed to exec(), which breaks
on paths with spaces; update the code that constructs and executes the Ballerina
version command (the place that uses distPath to form the command passed to
exec()) to wrap the absolute bal.bat path in quotes (or better, pass the quoted
executable as the first argument to execFile/spawn) so e.g. '"' +
path.join(distPath, 'bal.bat') + '"' (or use execFile with path.join(distPath,
'bal.bat')) is used instead of an unquoted concatenation; ensure references to
distPath and findWindowsBallerinaPath remain consistent and that any debug log
still prints the unmodified path if desired.
Comment on lines
+2753
to
+2759
| const children = fs.readdirSync(root); | ||
| for (const child of children) { | ||
| const versionedBin = path.join(root, child, 'bin'); | ||
| if (fs.existsSync(path.join(versionedBin, 'bal.bat'))) { | ||
| debug(`[WIN_BAL_FIND] Found bal.bat in versioned directory: ${versionedBin}`); | ||
| return versionedBin + path.sep; | ||
| } |
Contributor
There was a problem hiding this comment.
Pick the newest versioned installation deterministically.
Lines 2753-2759 iterate fs.readdirSync(root) in filesystem order, so with multiple installed versions the fallback can choose an older distribution first.
🔧 Proposed fix
- const children = fs.readdirSync(root);
+ const children = fs.readdirSync(root)
+ .sort((a, b) => b.localeCompare(a, undefined, { numeric: true, sensitivity: 'base' }));🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@workspaces/ballerina/ballerina-extension/src/core/extension.ts` around lines
2753 - 2759, The code iterates fs.readdirSync(root) and returns the first
versioned bin containing 'bal.bat', which is non-deterministic; modify the loop
in extension.ts (the block that builds children, versionedBin and checks for
'bal.bat') to sort the children array so the newest version is checked first
(use semver-aware comparison or sort by parsed version tokens descending), then
iterate the sorted list and return the first matching versionedBin + path.sep;
ensure skipped non-version entries are handled and fallback behavior remains
unchanged.
… ballerina-5.8.1
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@common/config/rush/.pnpmfile.cjs`:
- Around line 43-45: Replace the non-existent pinned version '5.3.7' with the
real release '5.3.6' in this file: locate the assignments that set
pkg.dependencies['fast-xml-parser'] = '5.3.7' and the second identical pin (the
other occurrence that also assigns '5.3.7') and change both to '5.3.6' so the
package is pinned to the published version that contains the CVE fixes.
ℹ️ Review info
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (2)
common/autoinstallers/rush-plugins/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlcommon/config/rush/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (3)
common/autoinstallers/rush-plugins/package.jsoncommon/config/rush/.pnpmfile.cjsworkspaces/ballerina/ballerina-extension/package.json
🚧 Files skipped from review as they are similar to previous changes (2)
- workspaces/ballerina/ballerina-extension/package.json
- common/autoinstallers/rush-plugins/package.json
Comment on lines
43
to
45
| if (pkg.dependencies['fast-xml-parser']) { | ||
| pkg.dependencies['fast-xml-parser'] = '5.3.6'; | ||
| pkg.dependencies['fast-xml-parser'] = '5.3.7'; | ||
| } |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
fast-xml-parser version 5.3.7 npm release date published
💡 Result:
fast-xml-parser@5.3.7 does not appear to have been published to npm (no listing for 5.3.7 in public version indexes; the newest published version shown is 5.3.6). [1], [2]
So there is no npm “published” date for 5.3.7. [1], [2]
Sources: [1] shows latest as 5.3.6 and lists recent versions; [2] also shows current version as 5.3.6.
🌐 Web query:
CVE-2026-25896 CVE-2026-26278 fast-xml-parser security advisory
💡 Result:
fast-xml-parser security advisories (CVE-2026-25896, CVE-2026-26278)
CVE-2026-25896 — Entity encoding bypass → XSS/injection (Critical, CVSS 9.3)
- What it is: A
.(dot) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, letting an attacker “shadow” built-in XML entities like<,>,&,",'with arbitrary strings—bypassing entity encoding and enabling XSS when output is rendered (and other injection risks depending on sinks). [1] - Affected:
fast-xml-parser>= 4.1.3 and <= 5.3.4. [1] - Fix: Upgrade to 5.3.5. [1]
- Advisory date: Published Feb 20, 2026. [1]
CVE-2026-26278 — XML entity expansion DoS (High, CVSS 7.5)
- What it is: The parser can be forced into unbounded entity expansion (even with small XML), causing very long parse times and effectively freezing a Node.js service (event-loop blocking). [2][3]
- Affected:
fast-xml-parser>= 4.1.3 and <= 5.3.5. [2] - Fix: Upgrade to 5.3.6. [2][3]
- Workaround: Disable DOCTYPE/entity processing via
processEntities: false. [2][3] - Advisory date: Published Feb 14, 2026 (GitHub); NVD lists the CVE as received/published Feb 19, 2026. [2][3]
Recommended action: If you might receive untrusted XML, upgrade at least to 5.3.6 (covers both: 5.3.5 fixes CVE-2026-25896; 5.3.6 fixes CVE-2026-26278). [1][2]
Sources
- [1] GitHub Security Advisory GHSA-m7jm-9gc2-mpf2 (CVE-2026-25896) (github.com)
- [2] GitHub Security Advisory GHSA-jmr7-xgp7-cmfj (CVE-2026-26278) (github.com)
- [3] NVD entry for CVE-2026-26278 (nvd.nist.gov)
Citations:
- 1: GHSA-m7jm-9gc2-mpf2
- 2: GHSA-jmr7-xgp7-cmfj
- 3: https://nvd.nist.gov/vuln/detail/CVE-2026-26278?utm_source=openai
🏁 Script executed:
cd common/config/rush && cat -n .pnpmfile.cjs | sed -n '40,50p;92,98p'Repository: wso2/vscode-extensions
Length of output: 881
CRITICAL: fast-xml-parser version 5.3.7 does not exist; update to 5.3.6 instead.
Version 5.3.7 is not published to npm (latest is 5.3.6). Both pinned versions at lines 44 and 95 must be corrected to '5.3.6', which is the actual release that fixes both CVE-2026-25896 (entity encoding bypass/XSS, fixed in 5.3.5) and CVE-2026-26278 (entity expansion DoS, fixed in 5.3.6). The current pin to a non-existent version will not resolve the security vulnerabilities as intended.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@common/config/rush/.pnpmfile.cjs` around lines 43 - 45, Replace the
non-existent pinned version '5.3.7' with the real release '5.3.6' in this file:
locate the assignments that set pkg.dependencies['fast-xml-parser'] = '5.3.7'
and the second identical pin (the other occurrence that also assigns '5.3.7')
and change both to '5.3.6' so the package is pinned to the published version
that contains the CVE fixes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Update the
mainbranch by merging the Windows activation hotfix.Changes
Summary by CodeRabbit