Corrected 2026-08-26. This issue originally claimed no CI check could fail on an npm vulnerability. That was wrong — it came from reading only part of ci.yml. audit-prod and audit-all are blocking jobs and they work. The real gap is much narrower; rewritten below.
Follow-up to #480 / #481, which fixed the Qlty Check job but deliberately left the new dependency-scan step reporting-only.
What already works
Root-tree npm vulnerabilities are covered, twice over:
That is a working setup. Nothing in this issue asks to change it.
The actual gap
src/test/vscode-notebook-perf/ is a standalone extension fixture with its own package.json and package-lock.json. It is not an npm workspace (the root package.json declares none), so npm ci at the root never installs it and better-npm-audit never audits it.
It is live code, not dead weight — src/test/performance/notebookPerf.vscode.common.test.ts, src/test/standardTest.node.ts and .vscode/launch.json all reference it.
Its lockfile has drifted well behind the root tree. Every package osv-scanner flags there is already patched at the root:
| Package |
In the fixture |
At the root |
brace-expansion |
1.1.12, 2.0.2 |
1.1.18, 2.1.4, 5.0.9 |
diff |
5.2.0 |
5.2.2 |
glob |
10.3.12 |
10.5.0, 13.0.6 |
serialize-javascript |
6.0.2 |
7.0.5 |
That is the signature of a tree nothing gates: the root got maintained by the audit jobs, the fixture did not.
The 12 findings
qlty check --all --filter osv-scanner reports 12 medium CVEs, all in that one lockfile:
Severity in context is low: this fixture is a test extension loaded by the perf suite, it is excluded from the VSIX, and none of it runs for users. The point is not urgency, it is that a tree with no gate drifts indefinitely.
Proposed fix
npm update inside src/test/vscode-notebook-perf/ and commit the refreshed lockfile.- Drop
--no-fail from the Run qlty dependency scan step in ci.yml, so the fixture stays gated from then on. If any finding is a deliberate accept, record it as an [[ignore]] / [[triage]] entry in .qlty/qlty.toml with a reason, the way .nsprc does — better than leaving the whole step non-blocking.
- Optional: add
- package-ecosystem: 'npm' / directory: /src/test/vscode-notebook-perf to dependabot.yml so version updates reach it too. Scoped to that directory this is low volume, unlike the commented-out root block.
Two notes for whoever picks this up
Do not try to make qlty scan the root lockfile. It cannot. package-lock.json is 2,682,557 bytes and qlty silently drops files above roughly 2.1–2.5 MB from its target set — bisected in a scratch repo: a 2,097,153-byte copy is analyzed, a 2,682,557-byte copy is not, with no warning either way. This does not matter, because better-npm-audit reads that tree properly, but it does mean osv-scanner's scope here is the fixture and only the fixture.
deps.yml is redundant, not broken. deps.yml:37 runs npm audit --json > audit-report.json || true weekly and uploads the JSON as an artifact. The || true is intentional — the step exists to produce a report, and the gating already happens in ci.yml. Worth deleting as duplicate coverage at some point, but it is not a security gap.
Related
🤖 Generated with Claude Code
https://claude.ai/code/session_011Kgq63XyXuKc6QM4WK4gi2
Follow-up to #480 / #481, which fixed the
Qlty Checkjob but deliberately left the new dependency-scan step reporting-only.What already works
Root-tree npm vulnerabilities are covered, twice over:
ci.ymlrunsaudit-prod(npx better-npm-audit audit --production) andaudit-all(npx better-npm-audit audit) on every push and PR. No|| true, nocontinue-on-error— they gate.dependabot.yml, which is why they keep landing (chore(deps): bump linkify-it from 5.0.1 to 5.0.2 #452 linkify-it, chore(deps-dev): bump morgan from 1.10.1 to 1.11.0 #437 morgan, chore(deps): bump js-yaml from 4.1.1 to 4.3.1 in /src/test/vscode-notebook-perf #464 js-yaml) even though thenpmblock independabot.ymlis commented out..nsprcholds exactly one exception —GHSA-848j-6mx2-7j84(elliptic) — with a written justification and an expiry of 2026-09-17.That is a working setup. Nothing in this issue asks to change it.
The actual gap
src/test/vscode-notebook-perf/is a standalone extension fixture with its ownpackage.jsonandpackage-lock.json. It is not an npm workspace (the rootpackage.jsondeclares none), sonpm ciat the root never installs it andbetter-npm-auditnever audits it.It is live code, not dead weight —
src/test/performance/notebookPerf.vscode.common.test.ts,src/test/standardTest.node.tsand.vscode/launch.jsonall reference it.Its lockfile has drifted well behind the root tree. Every package osv-scanner flags there is already patched at the root:
brace-expansiondiffglobserialize-javascriptThat is the signature of a tree nothing gates: the root got maintained by the audit jobs, the fixture did not.
The 12 findings
qlty check --all --filter osv-scannerreports 12 medium CVEs, all in that one lockfile:brace-expansion@1.1.12brace-expansion@2.0.2diff@5.2.0glob@10.3.12serialize-javascript@6.0.2Severity in context is low: this fixture is a test extension loaded by the perf suite, it is excluded from the VSIX, and none of it runs for users. The point is not urgency, it is that a tree with no gate drifts indefinitely.
Proposed fix
npm updateinsidesrc/test/vscode-notebook-perf/and commit the refreshed lockfile.--no-failfrom theRun qlty dependency scanstep inci.yml, so the fixture stays gated from then on. If any finding is a deliberate accept, record it as an[[ignore]]/[[triage]]entry in.qlty/qlty.tomlwith a reason, the way.nsprcdoes — better than leaving the whole step non-blocking.- package-ecosystem: 'npm'/directory: /src/test/vscode-notebook-perftodependabot.ymlso version updates reach it too. Scoped to that directory this is low volume, unlike the commented-out root block.Two notes for whoever picks this up
Do not try to make qlty scan the root lockfile. It cannot.
package-lock.jsonis 2,682,557 bytes and qlty silently drops files above roughly 2.1–2.5 MB from its target set — bisected in a scratch repo: a 2,097,153-byte copy is analyzed, a 2,682,557-byte copy is not, with no warning either way. This does not matter, becausebetter-npm-auditreads that tree properly, but it does mean osv-scanner's scope here is the fixture and only the fixture.deps.ymlis redundant, not broken.deps.yml:37runsnpm audit --json > audit-report.json || trueweekly and uploads the JSON as an artifact. The|| trueis intentional — the step exists to produce a report, and the gating already happens inci.yml. Worth deleting as duplicate coverage at some point, but it is not a security gap.Related
Qlty Checkjob analyzed zero files--no-failthis issue tracks removing🤖 Generated with Claude Code
https://claude.ai/code/session_011Kgq63XyXuKc6QM4WK4gi2