Fix Dependabot alert: bump liquidjs to 10.27.1 - #1637
Merged
Conversation
- Updated liquidjs from 10.26.0 to 10.27.1 - Addresses CVE-2026-55575 / GHSA-g357-x5c3-c72p (high): the `pop` filter bypassed the `memoryLimit` accounting enforced by its array-filter siblings - Patch release within 10.x, no API changes; build and unit tests pass Also normalized four package-lock.json entries that had been rewritten by an internal npm proxy (agent-base, https-proxy-agent, uc.micro, liquidjs). Their `resolved` URLs pointed at ms-feed-*.pkgs.visualstudio.com with sha1 integrity instead of registry.npmjs.org with sha512. Each sha512 was recomputed from the tarball after verifying its sha1 against the published shasum. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0bde2a62-741b-4321-8cba-770788c8575d
priyanshu92
enabled auto-merge (squash)
July 28, 2026 04:18
amitjoshi438
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes Dependabot alert 229. liquidjs 10.26.0 is affected by CVE-2026-55575 / GHSA-g357-x5c3-c72p (high): the
popfilter skips thememoryLimitaccounting that its array-filter siblings enforce, so template rendering can exceed the configured limit. We use liquidjs in the HTML language server for Liquid autocomplete, so it processes user template content.What changed
liquidjs10.26.0 -> 10.27.1. Patch release within 10.x with no API changes; the two files that import it (LiquidAutoCompleteRule.ts,LiquidAutoCompleteRuleEngine.ts) only useTokenizer,TokenKind, and token types, none of which moved.Lockfile cleanup
Four
package-lock.jsonentries hadresolvedURLs pointing atms-feed-*.pkgs.visualstudio.comwith sha1 integrity instead ofregistry.npmjs.orgwith sha512. This happens when someone runsnpm installon a machine configured against the internal npm proxy, and it can produceEINTEGRITYfailures for anyone resolving through a different registry. Normalizedagent-base@6.0.2,https-proxy-agent@5.0.1,uc.micro@2.1.0, and the newliquidjs@10.27.1.Each sha512 was recomputed from the actual tarball, and each tarball's sha1 was checked against the registry's published shasum first, so the hashes are derived from verified content rather than hand-written.
Two alerts intentionally left open
Alerts #230 (
tar, needs 7.5.21) and #231 (brace-expansion, needs 5.0.8) are not in this PR. Neither patched version has synced to the internal npm feed yet, which is the only registry reachable from a managed device, so there is nothing installable to bump to. Both packages are transitive and already pinned throughoverrides, so each becomes a one-line change once the feed catches up.Worth flagging for whoever picks up #231: the brace-expansion advisory covers every version
<= 5.0.7, so the nested@vscode/vsce -> brace-expansion 1.1.16override is affected too and will need its own patched 1.x release or removal.Validation
npm cireinstalls cleanly and leaves the lockfile untouched, which confirms the hand-normalized integrity values are correct.npm run buildsucceeds.npm testpasses, 106 tests.