security: clear Dependabot alert #2 (critical wish SCP path traversal) + harden VS Code dev deps - #618
Merged
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files
☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
…CVE-2026-41589) Dependabot alert #2 (the only open alert on the default branch) flags github.com/charmbracelet/wish v1.4.7 in tools/go.mod for CVE-2026-41589 / GHSA-xjvp-7243-rg9h — a critical (CVSS 9.6) path traversal in wish's SCP middleware. There is no fixed v1: the patch ships only as charm.land/wish/v2 >= 2.0.1, a different module path, and the latest vhs (v0.11.0) still requires wish v1.4.7 — so neither a version bump nor a `replace` resolves it in place. wish is pulled in solely as an indirect dependency of the vhs dev tool. vhs is never compiled into the mdsmith binary and nothing invokes `go tool -modfile=tools/go.mod vhs` (the demo workflow installs a prebuilt vhs release binary). Removing vhs from the tool directive and tidying drops wish plus ~38 other indirect modules from the graph (258 -> 219), clearing the alert with no impact on the shipped binary or CI. tools/go.mod keeps its go 1.25.8 directive: the skill-eval workflow reads it via go-version-file to compile a baseline worktree that requires 1.25.8, so the floor stays pinned there now that vhs no longer forces it. golangci-lint and gobco still build and run from the trimmed modfile. Closes #617 https://claude.ai/code/session_01UT8dyBo9sjkBDNbAbAUVgs
Refresh editors/vscode/bun.lock to clear every advisory bun audit reports for the extension's dev/test/packaging transitive deps (pulled by mocha and @vscode/vsce). These are real GitHub advisories but are not separately tracked by this repo's Dependabot; clearing them alongside alert #2 keeps the lockfile green. mocha constrains serialize-javascript and diff below their patched releases, so the patched versions are forced via package.json `overrides`: - serialize-javascript 6.0.2 -> 7.0.5 GHSA-5c6j-r48x-rmvq (RCE) + GHSA-qj8w-gfj5-8c6v (DoS) - diff 7.0.0 -> 8.0.4 GHSA-73rr-hh4g-fpgx (jsdiff DoS) - qs 6.15.1 -> 6.15.2 GHSA-q8mj-m7cp-5q26 (DoS) - fast-uri 3.1.1 -> 3.1.2 GHSA-v39h-62p7-jpjc (host confusion) - tmp 0.2.5 -> 0.2.7 GHSA-ph9p-34f9-6g65 (path traversal) - brace-expansion 5.0.5 -> 5.0.6 GHSA-jxxr-4gwj-5jf2 (DoS) Not shipped in the extension bundle. bun audit reports no vulnerabilities; tsc, the esbuild bundle, and 155 unit tests pass. https://claude.ai/code/session_01UT8dyBo9sjkBDNbAbAUVgs
jeduden
force-pushed
the
claude/wizardly-albattani-enivm8
branch
from
June 14, 2026 20:11
a0c4e48 to
8b067b0
Compare
jeduden
added
queue
Owner
Author
|
🟢 Merge Queue — picked up This PR is in the queue and will be batched with other Next: No action needed — you'll get another comment when CI starts on the batch. View merge queue run. |
Owner
Author
|
🔵 Merge Queue — CI running Merged into batch branch Next: No action needed — you'll be notified when CI completes. |
5 tasks
jeduden
removed
the
queue:active
Owner
Author
|
✅ Merge Queue — merged This PR landed on Next: Done — nothing more to do here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot alert #2 — critical
wishSCP path traversal (CVE-2026-41589)Closes #617.
Alert #2 (the only open alert on the default branch) flags
github.com/charmbracelet/wish v1.4.7intools/go.modfor CVE-2026-41589 / GHSA-xjvp-7243-rg9h — a critical (CVSS 9.6) path traversal in wish's SCP middleware.Why an in-place bump/replace is impossible (as documented in #617):
charm.land/wish/v2 >= 2.0.1, a different module pathreplace?replacecannot alias across different module pathsvhsv0.11.0still requireswish v1.4.7(upstream hasn't migrated)Fix: drop the
vhsdev tool fromtools/go.mod.wishis pulled in only as an indirect dependency ofvhs, which:mdsmithbinary, andgo tool -modfile=tools/go.mod vhs— the demo workflow installs a prebuiltvhsrelease binary (record-demo.yml).Removing
vhsfrom thetooldirective and runninggo mod tidydropswishplus ~38 other indirect modules (258 → 219), clearing the alert with no impact on the shipped binary or CI.vhswas also the only thing forcingtools/go.modto Go 1.25.8, so the floor drops to 1.25.0 (matchinggo.mod). Docs that listedvhsas atools/go.modtool are updated.Verified:
golangci-lint(v2.8.0) andgobcostill build and run from the trimmed modfile;osv-scannerconfirmsGHSA-xjvp-7243-rg9his gone;mdsmith check .passes.Secondary: VS Code extension dev-dependency hardening
While investigating I found 6 real (but not separately Dependabot-tracked) advisories in
editors/vscode/bun.lock, all dev/test/packaging transitive deps ofmocha/@vscode/vsce. Cleared viapackage.jsonoverrides+ lockfile refresh:Not shipped in the extension bundle.
bun auditreports no vulnerabilities;tsc, the esbuild bundle, and 155 unit tests pass.Note on identifying the alert
The session token lacks
dependabot_alertsread permission (REST returns 403), so I identified alert #2 from the push-time "1 critical" banner,osv-scanner, and #617 — which the maintainer had filed with the same diagnosis.https://claude.ai/code/session_01UT8dyBo9sjkBDNbAbAUVgs
Generated by Claude Code