Dependency advisory GHSA-fxqj-rqcc-2cmp applies
Expected behavior · high confidence
The flagged tool is a build helper used only by developers to compile the extension. It is not included in the finished product that users install. The security issue is in a feature of that build helper that is never used when the extension runs, so it cannot affect people who install and use this extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.
Contextual assessment: The advisory GHSA-fxqj-rqcc-2cmp affects esbuild's local development server. In this lockfile, esbuild 0.28.1 is declared as a devDependency (line 9) used only for building the extension bundles. The README confirms that pre-built dist/ bundles are committed and no local build is required for installation, so esbuild has no runtime presence in the shipped extension. The vulnerable dev-server code path is never reached during normal use; it would only be relevant if a developer ran esbuild's serve mode locally. No attacker-controlled input reaches the vulnerable code in production.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fxqj-rqcc-2cmp
- File role
- production
- Source
- bun.lock