fix(deps): override morgan to 1.11.0 to resolve GHSA-4vj7-5mj6-jm8m

[tkislan]

Summary

The audit-all CI job (npx better-npm-audit audit) is failing on a single non-excepted advisory: morgan@1.10.1 — GHSA-4vj7-5mj6-jm8m / CVE-2026-5078 (moderate, CVSS 5.3): log forging via unneutralized control characters in the :remote-user token.

This PR resolves it by pinning morgan to the patched 1.11.0 via a targeted npm override, matching the repo's established convention for transitive security fixes.

The other 30 advisories reported by npm audit are all already covered by documented, unexpired exceptions in .nsprc (elliptic, @tootallnate/once, uuid, @opentelemetry/core, js-yaml). morgan was the only new, non-excepted finding — and the only thing turning CI red.

Root cause

morgan is a dev/test-only transitive dependency — never part of the shipped extension bundle (which is why audit-prod was green while audit-all was red):

@vscode/test-web@0.0.71 (devDependency) → koa-morgan@1.0.1 → morgan@1.10.1

Fix

  "overrides": {
      ...
      "form-data@>=4.0.0 <4.0.6": "4.0.6",
+     "morgan@<1.11.0": "1.11.0"
  }

Why an override rather than an .nsprc exception — consistent with how this repo distinguishes the two:

• 1.11.0 is the patched release (OSV: introduced 1.2.0, fixed 1.11.0) and the latest published version.
• It's a semver-compatible minor bump that sits inside koa-morgan's own declared range (morgan: ^1.6.1), so it resolves cleanly with no forced major.
• .nsprc exceptions in this repo are reserved for breaking-major / no-fix-available cases — which does not apply here.

Behavioral safety (per online research + tarball diff of 1.10.1 vs 1.11.0):

• The 1.10.1 → 1.11.0 change is tiny and additive: a private escapeLogField() helper applied to the :remote-user token, plus a new additive :pid token. All predefined formats (combined, common, dev, short, tiny) are textually unchanged.
• @vscode/test-web invokes morgan with the dev format, which never references :remote-user — so this repo's test-server log output is byte-for-byte identical after the bump. The new escaping only alters output when a Basic-auth username contains control characters (exactly the vulnerability being fixed).
• The only other lockfile change is a dev-only nested on-finished dedupe (2.3.0 → 2.4.1).
• morgan@1.11.0 is clean of any other known advisory (OSV + Snyk).

Verification

Check	Before	After
npx better-npm-audit audit (audit-all)	❌ exit 1	✅ exit 0 (🤝 All good!)
npx better-npm-audit audit --production (audit-prod)	✅ exit 0	✅ exit 0
npx prettier --check package.json	—	✅ clean
Lockfile drift (npm install idempotent)	—	✅ no drift

Scope

Only package.json (one-line override) and package-lock.json (morgan 1.10.1 → 1.11.0 + nested on-finished dedupe) are touched. No source changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CPTs6CHNncauUuTGkwpNtH

Summary by CodeRabbit

• Chores
  • Updated dependency resolution to ensure a consistent version of a logging component.

[coderabbitai]

📝 Walkthrough

Walkthrough

The package.json dependency overrides now pin morgan versions below 1.11.0 to 1.11.0. The existing form-data override remains unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• deepnote/vscode-deepnote#396: Updates dependency pins in the same package.json overrides section.

Suggested reviewers: dinohamzic, mfranczel

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Updates Docs	✅ Passed	PASS: This PR only pins a transitive dependency in package manifests; it adds no user-facing feature, so no docs update is applicable.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: pinning morgan to 1.11.0 via an override to address the security advisory.

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0%. Comparing base (735e5f5) to head (daf5737).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@     Coverage Diff     @@
##   main   #438   +/-   ##
===========================
===========================

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.