From 97664d4f27ff941a26c75e862f7dbe249a5ca8e1 Mon Sep 17 00:00:00 2001
From: Andreas Schwab <andreas.schwab@softworx.at>
Date: Wed, 29 Jul 2026 21:59:55 +0200
Subject: [PATCH] Update json5 to 2.2.3 to fix CVE-2022-46175

json5 versions before 2.2.2 are vulnerable to prototype pollution via
the parse method (CVE-2022-46175). Update the dependency and refresh
the lockfile.
---
 vscode/package-lock.json | 22 ++++++++--------------
 vscode/package.json      |  4 ++--
 2 files changed, 10 insertions(+), 16 deletions(-)

diff --git a/vscode/package-lock.json b/vscode/package-lock.json
index 3f73a12..c701dae 100644
--- a/vscode/package-lock.json
+++ b/vscode/package-lock.json
@@ -10,7 +10,7 @@
       "license": "SEE LICENSE IN LICENSE",
       "devDependencies": {
         "fast-diff": "^1.2.0",
-        "json5": "^2.2.0",
+        "json5": "^2.2.3",
         "localtunnel": "^2.0.2",
         "serve": "^13.0.2"
       },
@@ -608,13 +608,10 @@
       "dev": true
     },
     "node_modules/json5": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.0.tgz",
-      "integrity": "sha512-f+8cldu7X/y7RAJurMEJmdoKXGB/X550w2Nr3tTbezL6RwEE/iMcm+tZnXeoZtKuOq6ft8+CqzEkrIgx1fPoQA==",
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
       "dev": true,
-      "dependencies": {
-        "minimist": "^1.2.5"
-      },
       "bin": {
         "json5": "lib/cli.js"
       },
@@ -1573,13 +1570,10 @@
       "dev": true
     },
     "json5": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.0.tgz",
-      "integrity": "sha512-f+8cldu7X/y7RAJurMEJmdoKXGB/X550w2Nr3tTbezL6RwEE/iMcm+tZnXeoZtKuOq6ft8+CqzEkrIgx1fPoQA==",
-      "dev": true,
-      "requires": {
-        "minimist": "^1.2.5"
-      }
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true
     },
     "localtunnel": {
       "version": "2.0.2",
diff --git a/vscode/package.json b/vscode/package.json
index 8c690e9..641908b 100644
--- a/vscode/package.json
+++ b/vscode/package.json
@@ -128,7 +128,7 @@
   },
   "devDependencies": {
     "fast-diff": "^1.2.0",
-    "json5": "^2.2.0",
+    "json5": "^2.2.3",
     "localtunnel": "^2.0.2",
     "serve": "^13.0.2"
   },
@@ -149,4 +149,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}