Skip to content

Sync Windows hotfix to release/bi-1.8.x #1561

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kanushka wants to merge 14 commits into from
Closed

Sync Windows hotfix to release/bi-1.8.x #1561

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
4cb9435
Merge pull request #1441 from wso2/ballerina-integrator-1.7.0
kanushka Feb 14, 2026
58181fa
Enhance Windows environment detection in BallerinaExtension.
axewilledge Feb 24, 2026
e52df09
Refine comment for Windows environment handling in BallerinaExtension.
axewilledge Feb 24, 2026
9b4a302
Improve error handling in findWindowsBallerinaPath function by loggin…
axewilledge Feb 24, 2026
7833789
Fix bn.js vulnerability
gigara Feb 23, 2026
9e6dc84
Update trivy ignore
gigara Feb 20, 2026
c6da561
Update pnpm-lock.yaml to reflect version changes and improve dependen…
axewilledge Feb 24, 2026
0dd458d
Update fast-xml-parser dependency from version 5.3.4 to 5.3.7 in pack…
axewilledge Feb 24, 2026
2549849
Update fast-xml-parser dependency to version 5.3.7 in package.json fo…
axewilledge Feb 24, 2026
df79cdd
Update fast-xml-parser dependency to version 5.3.7 in pnpmfile.cjs an…
axewilledge Feb 24, 2026
ff32034
Fix fast-xml-parser CVE-2026-25896 and CVE-2026-26278 in rush-plugins…
axewilledge Feb 24, 2026
d1ab577
Merge pull request #1549 from axewilledge/windows-hotfix
kanushka Feb 25, 2026
c7915f1
Update CHANGELOG.md for Ballerina extension version 5.8.1
kanushka Feb 25, 2026
c623472
Update version to ballerina-5.8.1
choreo-cicd Feb 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,3 +4,12 @@
# No fix released by the author
# https://github.com/wso2/vscode-extensions/issues/550
CVE-2020-36851

# No fix released by the author
CVE-2025-14505

# Library is used in nested dependencies and not directly used by our codebase. No fix released by the author.
CVE-2025-69873

# used in nested dependencies and not directly used by our codebase. No fix released by the author.
CVE-2026-26996
Comment on lines +8 to +15
Copy link
Contributor

@coderabbitai coderabbitai bot Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .trivyignore

Repository: wso2/vscode-extensions

Length of output: 656

🏁 Script executed:

rg -i 'github\.com.*issue|tracking|reviewer|date|expires' .trivyignore

Repository: wso2/vscode-extensions

Length of output: 120

🏁 Script executed:

# Search the entire codebase for these CVE IDs to see if there are tracking references elsewhere
rg 'CVE-2025-14505|CVE-2025-69873|CVE-2026-26996' --type markdown --type yaml --type json

Repository: wso2/vscode-extensions

Length of output: 48

Add GitHub issue links to each newly ignored CVE.

The existing suppression (CVE-2020-36851, line 5–6) includes a tracking link (https://github.com/wso2/vscode-extensions/issues/550). The three new CVE entries (CVE-2025-14505, CVE-2025-69873, CVE-2026-26996) lack issue references, making them permanent suppressions without traceability or expiry. Follow the established pattern and include a GitHub issue link for each new entry to maintain governance and enable periodic re-evaluation.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.trivyignore around lines 8 - 15, Update the three new CVE entries in
.trivyignore (CVE-2025-14505, CVE-2025-69873, CVE-2026-26996) to include a
GitHub issue tracking link like the existing CVE-2020-36851 entry; create or
reference an appropriate repo issue for each CVE and append the issue URL to
each CVE comment so every ignored CVE has a traceable GitHub issue for
governance and periodic re-evaluation.

1 change: 1 addition & 0 deletions common/autoinstallers/rush-plugins/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
"private": true,
"pnpm": {
"overrides": {
"fast-xml-parser": "5.3.7"
}
},
"dependencies": {
Expand Down
71 changes: 38 additions & 33 deletions common/autoinstallers/rush-plugins/pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 8 additions & 2 deletions common/config/rush/.pnpmfile.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,14 +76,17 @@ module.exports = {
pkg.dependencies['eslint'] = '^9.27.0';
}
if (pkg.dependencies['fast-xml-parser']) {
pkg.dependencies['fast-xml-parser'] = '5.3.4';
pkg.dependencies['fast-xml-parser'] = '5.3.7';
}
if (pkg.dependencies['hono']) {
pkg.dependencies['hono'] = '^4.11.7';
}
if (pkg.dependencies['lodash']) {
pkg.dependencies['lodash'] = '4.17.23';
}
if (pkg.dependencies['bn.js']) {
pkg.dependencies['bn.js'] = '5.2.3';
}
}

if (pkg.devDependencies) {
Expand Down Expand Up @@ -140,14 +143,17 @@ module.exports = {
pkg.devDependencies['eslint'] = '^9.27.0';
}
if (pkg.devDependencies['fast-xml-parser']) {
pkg.devDependencies['fast-xml-parser'] = '5.3.4';
pkg.devDependencies['fast-xml-parser'] = '5.3.7';
}
if (pkg.devDependencies['hono']) {
pkg.devDependencies['hono'] = '^4.11.7';
}
if (pkg.devDependencies['lodash']) {
pkg.devDependencies['lodash'] = '4.17.23';
}
if (pkg.devDependencies['bn.js']) {
pkg.devDependencies['bn.js'] = '5.2.3';
}
}

return pkg;
Expand Down
Loading
Loading