plugin-ext: update 'decompress'

[vince-fugnitto]

Description

The decompress dependency (part of plugin-ext) has a known security vulnerability which has been reported by the security-audit.

The issue is that decompress is not well-maintained (3 years since the last release) and it is unlikely that the flaw will be resolved. We should instead opt for a license compatible alternative which is maintained.

---

Update

decompress has been updated and no longer has a security advisory so there is no need to find an alternative, we can instead update the dependency to decompress >= 4.2.1

• Prevent directory traversal kevva/decompress#73 (comment)

[vince-fugnitto]

A suitable alternative might be adm-zip. @benoitf for the decompression (unzipping), are we to support different archive types? (ex: targz, zip,...). We will need to find an alternative that meets our requirements.

[benoitf]

I think we're decompressing with zip for .theiaand .vsix but from npm registry, it's tarball/tgz

[vince-fugnitto]

I think we're decompressing with zip for .theiaand .vsix but from npm registry, it's tarball/tgz

Thank you, we should find a suitable alternative that handles them all.

[akosyakov]

@vince-fugnitto @marcdumais-work @spoenemann maybe it is time to publish next versions as preview extensions into our registry and drop npm support

[marcdumais-work]

maybe it is time to publish next versions as preview extensions into our registry and drop npm support

Does this refer to the fact that we initially published the VS Code builtins on npm? Are there other VS Code extensions published on npm that we know about? Anyway, will not npm/yarn take care of unzipping the archive downloaded from npm? Can we drop tar decompressing support for plugins and only support zip?

Note: .vsix look to be in zip format:

$ file rust-lang.rust-0.6.1.vsix
rust-lang.rust-0.6.1.vsix: Zip archive data, at least v2.0 to extract

[akosyakov]

Does this refer to the fact that we initially published the VS Code builtins on npm? Are there other VS Code extensions published on npm that we know about?

Yes, it is only about built-ins.

Anyway, will not npm/yarn take care of unzipping the archive downloaded from npm? Can we drop tar decompressing support for plugins and only support zip?

We don't use npm/yarn to download anything.

@spoenemann Is there a way to publish a new version to Open VSX Registry but not like latest? What we need is to have for exactly the same unique id to versions one latest for tested version and one next to nightly build.

[spoenemann]

package.json has a preview field, should we use that to mark next versions?

[akosyakov]

@spoenemann It sounds fine. I'm more concerned whether current registry api can provide a stable URI for latest and next versions? i.e. something like open-vsx.org/api/ms-vscode/bat for latest open-vsx.org/api/ms-vscode/bat?preview for next?