Fix LiquidJS and Morgan Dependabot alerts - #1690
Merged
Priyanshu Agrawal (priyanshu92) merged 2 commits intoSep 17, 2026
Merged
Priyanshu Agrawal (priyanshu92) merged 2 commits into
Priyanshu Agrawal (priyanshu92) merged 2 commits into
Conversation
- Update liquidjs from 10.27.1 to 10.27.2 for CVE-2026-69222 (high).\n- Override morgan from 1.11.0 to 1.12.0 for CVE-2026-15603 (medium), and document the upstream removal condition.\n- Fix existing Liquid object autocomplete token handling and run its regression tests in the default unit suite.\n- Verify clean npm ci, desktop/web/worker builds, lint, 180 unit tests, and four bounded security checks. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c6e4decc-47e7-4674-ac18-53cd4a778656
Priyanshu Agrawal (priyanshu92)
requested review from
a team
as code owners
September 17, 2026 14:51
Priyanshu Agrawal (priyanshu92)
enabled auto-merge (squash)
September 17, 2026 14:52
amitjoshi438
approved these changes
Sep 17, 2026
Priyanshu Agrawal (priyanshu92)
deleted the
users/priyanshu92/dependabot-security-fixes-f5e
branch
September 17, 2026 16:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix the two open Dependabot alerts covering a LiquidJS memory-limit bypass and Morgan log forging.
Changes
liquidjsfrom10.27.1to10.27.2for alert 265, CVE-2026-69222 (high).morganfrom1.11.0to1.12.0for alert 266, CVE-2026-15603 (medium). The latest@vscode/test-webrelease still resolves vulnerable Morgan;CONTRIBUTING.mddocuments when to remove the override.Validation also exposed four existing Liquid autocomplete failures on both the original and patched versions.
Update lookup handling for the current token structure, preserve quoting for bracket keys, and avoid inserting quoted names into dot access or matching unrelated root objects.
Move the mocked autocomplete suite into the default unit-test directory and add regression coverage.
Validation
Run with Node.js
22.23.2:npm cisucceeds.npm run buildandnpm run compile-webpass across desktop, web, and worker targets.npm test: 180 passing.node node_modules/gulp/bin/gulp.js lint: passes.Local bootstrap note:
gulp recompilecould not download PAC from NuGet (ENOTCONN).Generating the build-region input with the same gulp pipeline allowed compilation checks to finish.
Webpack reports four warnings and no errors.