vscode NPM package is causing a diff security issue

[queeniema]

Issue Type: Bug

GitHub reported a security vulnerability related to the diff NPM package in my VS Code extension's package-lock.json.

In my VS Code extension's package.json, I've added a dependency for vscode:

"devDependencies": {
  ...
 "vscode": "^1.1.34",
  ...
}

When I run npm ls diff to see what packages are using diff, I see this:

And I see this reflected in my package-lock.json:

"vscode": {
  "version": "1.1.34",
  "resolved": "https://registry.npmjs.org/vscode/-/vscode-1.1.34.tgz",
  "integrity": "sha512-GuT3tCT2N5Qp26VG4C+iGmWMgg/MuqtY5G5TSOT3U/X6pgjM9LFulJEeqpyf6gdzpI4VyU3ZN/lWPo54UFPuQg==",
  "dev": true,
  "requires": {
    "glob": "^7.1.2",
    "mocha": "^4.0.1",
    "request": "^2.88.0",
    "semver": "^5.4.1",
    "source-map-support": "^0.5.0",
    "url-parse": "^1.4.4",
    "vscode-test": "^0.4.1"
  },
  "dependencies": {
    ...
    "diff": {
      "version": "3.3.1",
      "resolved": "https://registry.npmjs.org/diff/-/diff-3.3.1.tgz",
      "integrity": "sha512-MKPHZDMB0o6yHyDryUOScqZibp914ksXwAMYMTHj6KO8UeKsRYNJD3oNCKjTqZon+V488P7N/HzXF8t7ZR95ww==",
      "dev": true
    },
    ...
  }
}

VS Code version: Code 1.35.1 (c7d83e5, 2019-06-12T14:29:22.216Z)
OS version: Darwin x64 18.6.0

System Info

Item	Value
CPUs	Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz (8 x 2500)
GPU Status	2d_canvas: enabled checker_imaging: disabled_off flash_3d: enabled flash_stage3d: enabled flash_stage3d_baseline: enabled gpu_compositing: enabled multiple_raster_threads: enabled_on native_gpu_memory_buffers: enabled rasterization: enabled surface_synchronization: enabled_on video_decode: enabled webgl: enabled webgl2: enabled
Load (avg)	3, 3, 3
Memory (System)	16.00GB (0.11GB free)
Process Argv
Screen Reader	no
VM	0%

Extensions (15)

Extension	Author (truncated)	Version
vscode-css-formatter	aes	1.0.1
npm-intellisense	chr	1.3.0
path-intellisense	chr	1.4.2
bracket-pair-colorizer	Coe	1.0.61
vscode-eslint	dba	1.9.0
gitlens	eam	9.8.2
vscode-npm-script	eg2	0.3.7
auto-rename-tag	for	0.1.0
beautify	Hoo	1.5.0
ibm-streams	IBM	0.5.0
vscode-duplicate	mrm	1.2.1
java	red	0.46.0
change-case	wma	1.0.0
JavaScriptSnippets	xab	1.7.2
ReactSnippets	xab	2.3.0

[octref]

Seems @vscode NPM org is taken by someone :(
https://www.npmjs.com/org/vscode

I'm now forking mocha to update diff to fix security alert

Wondering what I should do

• 1️⃣ Publish it under @octref/mocha
• 2️⃣ Make vscode depends on octref/mocha on GitHub
• 3️⃣ We should create a NPM org for these kind of packages

@bpasero What do you think?

[Tyriar]

@octref can't we just update to mocha 5 or 6 in the vscode module?

[bpasero]

@octref will talk to you in chat

[octref]

Ah, I thought Mocha 5/6 would have breaking changes so we can't really upgrade easily.
Turns out Mocha 5 only had one breaking change: Drop IE9/10 support. It shouldn't affect us.
Meanwhile if someone really needs Mocha 4. He can use vscode-test and manually depends on it.

Will upgrade to Mocha 5.

[bpasero]

Thanks