Dependency advisory GHSA-fxqj-rqcc-2cmp applies
Expected behavior · high confidence
The scanner flagged a known issue in a build tool, but the version actually used here is newer than the fixed release, so the problem does not apply. The tool is also only used during development, not when the extension runs for users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.
Contextual assessment: The advisory corresponds to an esbuild development-server issue affecting versions below the patched release. The lockfile pins esbuild at 0.28.1 with matching platform helper packages at 0.28.1, which is above the fixed version, so the vulnerable code is not present in the shipped dependency set. Additionally, esbuild is declared only as a devDependency for building extension bundles; the production extension ships prebuilt dist bundles, so the development server is not part of runtime behavior. No vulnerable version is installed and no runtime reachability exists for end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fxqj-rqcc-2cmp
- File role
- production
- Source
- bun.lock