[corwinm]

Summary

• Patch the extension's existing test, packaging, and release-tooling transitive dependencies without changing direct dependency versions or forcing any package across a major version.
• Update existing brace-expansion/fast-uri override boundaries and shell-quote replacement; refresh compatible lockfile resolutions for the other affected packages. No new overrides or unrelated lockfile refreshes.

Package	Before	After
brace-expansion	1.1.18 / 2.1.4 / 5.0.9	1.1.21 / 2.1.7 / 5.0.12
fast-uri	3.1.7	3.1.9
follow-redirects	1.16.0	1.16.1
handlebars	4.7.9	4.7.10
markdown-it	14.2.0	14.3.3
shell-quote	1.10.0	1.11.0
undici	6.28.0 / 7.29.0	6.29.1 / 7.30.1

Security evidence

• Unchanged-base pnpm audit --json: 33 findings (3 critical, 13 high, 12 moderate, 5 low). Updated audit: zero findings.
• Covers the live Dependabot alerts numbered 90, 92, 93, 96, 97, 98, 99, 103, 105, 106, 107, 108, 109, 111, 112, 113, 114, 115, plus audit-only findings on fast-uri, brace-expansion's 5.x line, and undici's 6.x line and additional advisories.
• Parent metadata/ranges checked: AJV, VSCE, OVSX, minimatch 3/9/10, conventional-changelog-writer, cheerio, @semantic-release/github, and @actions/http-client. The existing parent ranges accept these compatible versions. Undici uses the latest compatible 6.x and 7.x releases rather than forcing the 6.x consumer onto 7.x/8.x.
• Independent repository-aware codex review --base origin/main approved exact clean head 906b29291eddec49adf47456072f33f956e40efc with no actionable regressions.

Verification

All passed locally with Node 22.23.4 and repository-pinned pnpm 10.23.0:

• pnpm install --frozen-lockfile
• pnpm audit --json and pnpm why fast-uri markdown-it follow-redirects undici brace-expansion handlebars shell-quote --depth 20
• pnpm run check-types, pnpm run lint, pnpm run package, pnpm run verify:release
• pnpm test: 26 passing in the real VS Code extension host on macOS
• pnpm exec vsce package --no-dependencies --out /Users/corwin/.hermes/cache/scratch/oil-code-security.vsix: nonempty VSIX produced
• Disposable consumer smoke: real semantic-release commit analysis and release-note rendering with handlebars 4.7.10; HTTP requests through both installed undici major lines and OVSX's follow-redirects; VSCE's markdown rendering
• pnpm exec run-s check-types lint exercises npm-run-all/shell-quote and the lint graph
• git diff --check

VS Code emitted upstream proposal/account/deprecation warnings, but the suite exited successfully. No publishing commands or live release operations were run.

Remote CI and related PR

• All three CI checks passed on exact head 906b29291eddec49adf47456072f33f956e40efc: macOS, Ubuntu, and Windows (run).
• Optional publishing bugfix chore: update GitHub release plugin to 12.0.10 #91 is separate and targets main independently. This security PR does not depend on it; review this PR first. A disposable combined-worktree check confirmed the two patches apply cleanly together, retain zero audit findings, and pass frozen install, build/release metadata, consumer smokes, pagination, and local VSIX-upload fixture checks.
• No merge performed.

Summary by CodeRabbit

• Chores
  • Updated several underlying components to newer patched versions. No user-facing behavior changes are noted.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-23T16:44:11.358397Z We couldn’t complete this review. Comment @codex review to try again.	906b292	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[corwinm]

@CodeRabbit review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6dfa6692-4f3c-4ad3-a0ef-c7656a0ca806

📥 Commits

Reviewing files that changed from the base of the PR and between e52ad16 and 906b292.

⛔ Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 1

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

The package.json overrides now select newer versions of brace-expansion, fast-uri, and shell-quote. The js-yaml, linkify-it, and qs overrides remain unchanged.

Changes: Dependency Override Updates

Layer / File(s)	Summary
Update dependency overrides package.json	The brace-expansion and fast-uri override ranges and versions changed. The npm-run-all>shell-quote override changed from 1.10.0 to 1.11.0. Other listed overrides remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 906b2

The dependency updates are consistent with the lockfile and do not introduce an actionable merge-blocking risk.

Architecture risk: 🔵 Low · up to 906b2

The change affects 1 system.

Changed systems: package.json

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — package.json (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in package.json: The brace-expansion override ranges now extend through <1.1.21, <2.1.7, and <5.0.12, resolving respectively to 1.1.21, 2.1.7, and 5.0.12 instead of the earlier thresholds and versions. The fast-uri range now covers versions below 3.1.8 and resolves to 3.1.9 instead of covering versions below 3.1.6 and resolving to 3.1.7. The npm-run-all>shell-quote override changes from 1.10.0 to 1.11.0; the intervening js-yaml, linkify-it, and qs overrides are unchanged.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the primary change: patching vulnerable transitive tooling dependencies. It is concise and follows conventional commit format.
Description check		The description is detailed and relevant. It explains the dependency updates, security impact, compatibility decisions, testing, CI results, and related PR context. It does not reproduce every templat…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description is detailed and relevant. It explains the dependency updates, security impact, compatibility decisions, testing, CI results, and related PR context. It does not reproduce every template section, but the missing sections are non-critical given the included verification and security evidence.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}