Skip to content

fix: Harden VS Code extension command execution#12800

Merged
anthonyshew merged 4 commits into
mainfrom
shew/turbo-5473-vscode-safe-task-run
May 14, 2026
Merged

fix: Harden VS Code extension command execution#12800
anthonyshew merged 4 commits into
mainfrom
shew/turbo-5473-vscode-safe-task-run

Conversation

@anthonyshew

@anthonyshew anthonyshew commented May 14, 2026

Copy link
Copy Markdown
Contributor
  • Stops the VS Code extension from interpolating daemon commands and task names through shell strings.
  • Disables the extension in untrusted workspaces and keeps executable-related settings machine-scoped.

@anthonyshew anthonyshew requested a review from a team as a code owner May 14, 2026 17:59
@anthonyshew anthonyshew requested review from tknickman and removed request for a team May 14, 2026 17:59
@vercel

vercel Bot commented May 14, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
examples-basic-web Ready Ready Preview, Comment, Open in v0 May 14, 2026 6:18pm
examples-designsystem-docs Ready Ready Preview, Comment, Open in v0 May 14, 2026 6:18pm
examples-gatsby-web Ready Ready Preview, Comment, Open in v0 May 14, 2026 6:18pm
examples-kitchensink-blog Ready Ready Preview, Comment, Open in v0 May 14, 2026 6:18pm
examples-nonmonorepo Ready Ready Preview, Comment, Open in v0 May 14, 2026 6:18pm
examples-svelte-web Ready Ready Preview, Comment, Open in v0 May 14, 2026 6:18pm
examples-tailwind-web Ready Ready Preview, Comment, Open in v0 May 14, 2026 6:18pm
examples-vite-web Ready Ready Preview, Comment, Open in v0 May 14, 2026 6:18pm
turbo-site Ready Ready Preview, Comment, Open in v0 May 14, 2026 6:18pm

@vercel vercel Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Additional Suggestion:

The turbo.codemod VS Code command uses terminal.sendText() with unsanitized string interpolation, allowing shell injection through the args parameter.

Fix on Vercel

@anthonyshew anthonyshew force-pushed the shew/turbo-5473-vscode-safe-task-run branch from b3ef80f to 7a9f95d Compare May 14, 2026 18:06
@anthonyshew anthonyshew enabled auto-merge (squash) May 14, 2026 18:20
@anthonyshew anthonyshew merged commit 91c90cb into main May 14, 2026
45 checks passed
@anthonyshew anthonyshew deleted the shew/turbo-5473-vscode-safe-task-run branch May 14, 2026 18:24
anthonyshew added a commit that referenced this pull request May 14, 2026
## Summary

- Recreates the release PR that the failed v2.9.13 workflow never
opened.
- Advances `version.txt` to `2.9.14-canary.0` so the next release does
not retry `2.9.13`.
- Keeps package and Turborepo skill metadata aligned with the attempted
`2.9.13` release state.

## Context

The v2.9.13 release failed during npm publishing after a partial native
package publish. This PR only moves repository state forward; it does
not create a `v2.9.13` tag or complete the npm publish.

## Changes Since v2.9.12

- release(turborepo): 2.9.12 (#12774) (`c1f923a`)
- fix: Restore docs mobile menu (#12782) (`859c629`)
- ci: Use `pull_request` for PR title linting (#12787) (`4cf9fab`)
- ci: Scope GitHub Actions caches by branch (#12788) (`5fcb960`)
- test: Validate lockfiles without dependency downloads (#12789)
(`71f8c90`)
- Removed unneeded import form hash creation script in docs (#12799)
(`1779ad7`)
- fix: Validate auth callback state (#12802) (`84f4508`)
- fix: Harden VS Code extension command execution (#12800) (`91c90cb`)
- fix: Avoid project-local Yarn during detection (#12801) (`e8e629d`)
anthonyshew pushed a commit that referenced this pull request May 15, 2026
## Release v2.9.14

> [!CAUTION]
> Versioned docs aliasing FAILED. [View
logs](https://github.com/vercel/turborepo/actions/runs/25882155729)

### Changes

- release(turborepo): 2.9.12 (#12774) (`c1f923a`)
- fix: Restore docs mobile menu (#12782) (`859c629`)
- ci: Use `pull_request` for PR title linting (#12787) (`4cf9fab`)
- ci: Scope GitHub Actions caches by branch (#12788) (`5fcb960`)
- test: Validate lockfiles without dependency downloads (#12789)
(`71f8c90`)
- Removed unneeded import form hash creation script in docs (#12799)
(`1779ad7`)
- fix: Validate auth callback state (#12802) (`84f4508`)
- fix: Harden VS Code extension command execution (#12800) (`91c90cb`)
- fix: Avoid project-local Yarn during detection (#12801) (`e8e629d`)
- chore: Release 2.9.13 (#12803) (`fb8c9ae`)

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant