Merge pull request #1564 from ChinthakaJ98/sync-main-with-4.1.4

Author: ChinthakaJ98

.github/workflows/build.yml

@@ -150,7 +150,7 @@ jobs:
 
       - name: Run Trivy vulnerability scanner
         id: trivy
-        continue-on-error: ${{ inputs.continueOnTrivyFailure }}
+        continue-on-error: ${{ inputs.continueOnTrivyFailure == true }}
         uses: aquasecurity/trivy-action@0.35.0
         with:
           scan-type: 'fs'

.trivyignore

@@ -17,3 +17,13 @@ CVE-2026-26996
 # file-type v19+ is ESM-only which is incompatible with the CommonJS VS Code extension build.
 # Upgrading requires significant refactoring. Risk is low as this package handles binary file detection.
 CVE-2026-31808
+
+# brace-expansion DoS (GHSA-mh99-v99m-4gvg). The patched releases are already pinned:
+# 1.x -> 1.1.17, 2.x -> 2.1.3, 3.x -> 3.0.5, 5.x -> 5.0.8 (all carry the
+# EXPANSION_MAX / EXPANSION_MAX_LENGTH expansion caps that fix this CVE).
+# The advisory declares a single npm range "introduced=0, fixed=5.0.8", so Trivy still
+# flags the patched 1.x/2.x/3.x backports even though they contain the fix.
+# We cannot move every consumer to 5.x: brace-expansion 5.x changed `module.exports`
+# from a callable function to an object ({ expand, ... }), which breaks CommonJS
+# dependents such as minimatch@3 that call `require('brace-expansion')(...)` directly.
+CVE-2026-14257

common/autoinstallers/rush-plugins/package.json

@@ -7,7 +7,7 @@
       "fast-xml-builder": "1.1.7",
       "fast-xml-parser": "5.7.0",
       "minimatch": "3.1.5",
-      "brace-expansion": "1.1.16",
+      "brace-expansion": "1.1.17",
       "undici": "7.28.0"
     }
   },

common/autoinstallers/rush-plugins/pnpm-lock.yaml

@@ -121,13 +121,13 @@ module.exports = {
           const currentVersion = deps['brace-expansion'];
           let newVersion;
           if (currentVersion.startsWith('^1') || currentVersion.startsWith('1')) {
-            newVersion = '1.1.16';
+            newVersion = '1.1.17';
           } else if (currentVersion.startsWith('^2') || currentVersion.startsWith('2')) {
-            newVersion = '2.1.2';
+            newVersion = '2.1.3';
           } else if (currentVersion.startsWith('^3') || currentVersion.startsWith('3')) {
-            newVersion = '3.0.2';
+            newVersion = '3.0.5';
           } else if (currentVersion.startsWith('^5') || currentVersion.startsWith('5')) {
-            newVersion = '5.0.7';
+            newVersion = '5.0.8'; // security fix: CVE-2026-45149 (DoS numeric range)
           } else {
             context.log(`Unexpected brace-expansion version: ${currentVersion}`);
             newVersion = currentVersion;