[tharindulak]

Purpose

The Trivy scan (e.g. this run) reports 24 fixable vulnerabilities across the two lockfiles: 1 critical, 12 high, 7 medium and 4 low.

Goals

Both common/config/rush/pnpm-lock.yaml and common/autoinstallers/rush-plugins/pnpm-lock.yaml scan clean, without adding entries to .trivyignore.

Approach

Overrides in common/config/rush/pnpm-config.json:

Package	From	To
dompurify	3.4.16	3.4.17
hono	4.13.7	4.13.14
fast-uri	3.1.8	3.1.9
follow-redirects	1.16.0	1.16.2 (new)
ip-address	10.7.1	10.7.5 (new)
markdown-it (14.x)	14.3.1	14.3.3 (new)
undici (7.x)	7.29.1	7.30.1 (new)
body-parser (2.x)	2.3.0	2.4.0 (new)
@azure/msal-node	5.5.0	7.1.1 (new)
zod	3.22.4 / 3.25.76 / 4.1.11	4.6.7 (new)

Also:

• undici 6.28.1 -> 6.29.1 in the rush-plugins autoinstaller.
• zod 4.6.7 in wso2-platform-extension (was 3.22.4) and wso2-platform-webviews (was 4.1.11).

Two major-version jumps need reviewer attention:

• zod 3 -> 4. The zod 3 line has no fix for CVE-2023-54404. The MCP inspector packages declare zod 3.25.76, but at runtime they only load the zod/v4 entry point, and the inspector UI is a prebuilt bundle with its own zod. The inspector proxy runs MCP SDK 1.32.1, which supports zod 4.
• @azure/msal-node 5 -> 7. It is only reached through @vscode/vsce -> @azure/identity, which vsce uses only for --azure-credential. Our publish workflow uses a PAT (-p). msal-node 7 drops acquireTokenByUsernamePassword, so identity's deprecated UsernamePasswordCredential would fail. Nothing here uses it. This is noted in a comment on the override.

Release note

N/A. Dependency updates only.

Documentation

N/A.

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes
• Ran FindSecurityBugs plugin and verified report? N/A (dependency changes only)
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes

Test environment

• Local trivy fs with --ignore-unfixed and .trivyignore: 0 vulnerabilities in both lockfiles.
• rush build -t wso2-platform -t mcp-server-inspector passes.
• MCP Inspector, manually: connected over STDIO to a test MCP server on SDK 1.32.1 + zod 4.6.7, then listed and read resources, listed tools (schema form rendered correctly) and called a tool.
• Scripted SDK client/server on zod 4.6.7: tool calls, invalid tool arguments rejected with an input validation error, resources and prompts.
• @azure/identity loads with msal-node 7.1.1, and every msal export it uses is present. vsce publish --azure-credential was not exercised.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated several underlying libraries to newer versions, including updates to libraries used by platform extensions and web views. These changes update the versions bundled with the product; no user-facing features or behavior changes were specified.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: wso2/vscode-extensions
• Branch: main
• File: .coderabbit.yaml
• Commit: e578f97
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3e481458-ddbd-4536-841c-decf51aef243

Commits

Reviewing files that changed from the base of the PR and between e578f97 and c16ab40.

Files ignored due to path filters: 2

• common/autoinstallers/rush-plugins/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• common/config/rush/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 4

• common/autoinstallers/rush-plugins/package.json
• common/config/rush/pnpm-config.json
• workspaces/wso2-platform/wso2-platform-extension/package.json
• workspaces/wso2-platform/wso2-platform-webviews/package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

Dependency versions and pnpm overrides changed in shared configuration. The WSO2 extension and webviews packages now declare zod version 4.6.7.

Changes: Dependency updates

Layer / File(s)	Summary
Shared dependency overrides common/autoinstallers/rush-plugins/package.json, common/config/rush/pnpm-config.json	The Rush plugin undici override changed to 6.29.1. Global overrides updated versions for hono, fast-uri, and dompurify, and added overrides for follow-redirects, ip-address, markdown-it, undici, body-parser, @azure/msal-node, and zod. Comments describe the @azure/msal-node dependency path and compatibility constraint.
WSO2 zod dependency declarations workspaces/wso2-platform/wso2-platform-extension/package.json, workspaces/wso2-platform/wso2-platform-webviews/package.json	Both packages now declare zod version 4.6.7.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: Minimal · up to c16ab

This dependency update bumps overrides and moves zod to 4.6.7 in the two WSO2 packages. No concrete compatibility problem was found, and it is ready to merge under normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title names the main change: bumping dependency overrides to fix Trivy-reported vulnerabilities. The changeset updates the overrides in pnpm-config.json and the related package.json files to addre…
Description check		The description follows the template structure. It includes Purpose, Goals, Approach, Release note, Documentation, Security checks, and Test environment, with substantive content in each. Sections not…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the main change: bumping dependency overrides to fix Trivy-reported vulnerabilities. The changeset updates the overrides in pnpm-config.json and the related package.json files to address the scan findings, so the title matches the primary change.

Full details: Description check

Explanation

The description follows the template structure. It includes Purpose, Goals, Approach, Release note, Documentation, Security checks, and Test environment, with substantive content in each. Sections not relevant to a dependency-only change (UI Component Development, Manage Icons, User stories, Certification, Marketing, Training, Samples, Related PRs, Migrations, Learning) are omitted. The Purpose section gives the Trivy scan link, the counts, and the affected lockfiles. Automation tests and Learning are not filled in, but the Test environment section documents the validation performed.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 Biome (2.5.15)

common/autoinstallers/rush-plugins/package.json

Biome could not lint this file: configuration resulted in errors. Check the repository's Biome configuration and plugins.

common/config/rush/pnpm-config.json

Biome could not lint this file: configuration resulted in errors. Check the repository's Biome configuration and plugins.

workspaces/wso2-platform/wso2-platform-extension/package.json

Biome could not lint this file: configuration resulted in errors. Check the repository's Biome configuration and plugins.

• 1 others

_{Comment @coderabbitai help to get the list of available commands.}