Skip to content

Fix CVE-2025-64756 Vulnerability #960

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 13 commits into from
Nov 19, 2025
Merged

Fix CVE-2025-64756 Vulnerability #960

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
8efcd1f
update fantasticon version in font-wso2
gigara Nov 18, 2025
2c2f8ac
Update vscode/vsce version to 3.7.0
gigara Nov 18, 2025
adea361
Remove webpack-merge-and-include-globally plugin
gigara Nov 18, 2025
256e469
Update glob usage
gigara Nov 18, 2025
a3e51a5
replace vsce pkg with @vscode/vsce
gigara Nov 18, 2025
ecd5768
Update gitignore
gigara Nov 18, 2025
99156d4
Update glob to 11.1.0 in local packages
gigara Nov 18, 2025
926298e
Update fonts
gigara Nov 18, 2025
fb03a36
Update jest
gigara Nov 18, 2025
7c554e9
Update lock file
gigara Nov 18, 2025
9257cbf
Update test snapshot header
gigara Nov 19, 2025
5451d38
Merge branch 'bi-1.5.x' of https://github.com/wso2/vscode-extensions …
gigara Nov 19, 2025
9b339a5
Remove command injection vulnerability entry from .trivyignore
gigara Nov 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 0 additions & 8 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,3 @@ CVE-2025-9910
# No fix released by the author
# https://github.com/wso2/vscode-extensions/issues/550
CVE-2020-36851

# Command injection vulnerability in glob CLI
# Affects: glob 10.4.5 and 11.0.3
# Risk Assessment: HIGH severity but CLI-specific vulnerability
# Decision: Not using glob CLI functionality, only using glob as a library dependency
# The vulnerability only affects usage with -c/--cmd flag which executes shell commands
# Related Issue: https://github.com/wso2/product-ballerina-integrator/issues/1943
CVE-2025-64756
Loading
Loading