Automatic Sync: Merge changes from stable/ballerina to main

.github/actions/build/action.yml

@@ -201,6 +201,7 @@ runs:
         node common/scripts/install-run-rush.js build --verbose
       env:
         isPreRelease: ${{ inputs.isPreRelease == 'true' }}
+        GITHUB_TOKEN: ${{ inputs.token }}
         BALLERINA_LS_TAG: ${{ inputs.enableLSCache == 'true' && steps.resolve-ballerina-ls-version.outputs.version || (inputs.ballerinaLsTag != '' && inputs.ballerinaLsTag || (inputs.isPreRelease == 'true' && 'prerelease' || 'latest')) }}
         BALLERINA_AUTH_ORG: ${{ inputs.BALLERINA_AUTH_ORG }}
         BALLERINA_AUTH_CLIENT_ID: ${{ inputs.BALLERINA_AUTH_CLIENT_ID }}

.trivyignore

@@ -1,5 +1,15 @@
 # Trivy ignore file for known low-risk vulnerabilities
 # Format: CVE-ID or vulnerability ID
+#
+# Only add an entry when there is no usable fix. Everything that has one must
+# instead be bumped via the `globalOverrides` block in
+# common/config/rush/pnpm-config.json and the matching pin in
+# common/config/rush/.pnpmfile.cjs.
+#
+# A fix that exists but is unusable for the affected version (e.g. the only
+# fixed release is an incompatible major) counts as "no fix" for the purposes
+# of this file, but say so explicitly in the comment and note what would let
+# the entry be removed.
 
 # No fix released by the author
 # https://github.com/wso2/vscode-extensions/issues/550
@@ -17,3 +27,27 @@ CVE-2026-26996
 # file-type v19+ is ESM-only which is incompatible with the CommonJS VS Code extension build.
 # Upgrading requires significant refactoring. Risk is low as this package handles binary file detection.
 CVE-2026-31808
+
+# brace-expansion — DoS via unbounded expansion length causing an OOM crash.
+# The advisory covers every release <= 5.0.7 and the fix exists only in 5.0.8;
+# upstream has not backported it, so no release on the 1.x or 2.x line is out
+# of range. 5.x is not a drop-in replacement for those lines either — it
+# dropped the CommonJS default export that minimatch 3.x/5.x call — so forcing
+# them to 5.0.8 would break them at runtime. The 5.x line IS bumped to 5.0.8
+# via globalOverrides; this entry only covers the 1.x/2.x transitives reached
+# through minimatch 3.1.5 and 5.1.8. Remove it once upstream backports the fix,
+# or once nothing depends on minimatch below v9.
+CVE-2026-14257
+
+# immutable@3.8.3 — List 32-bit trie overflow (CVE-2026-59879) and
+# hash-collision algorithmic complexity in Map/Set (CVE-2026-59880), both DoS.
+# The first patched release is 4.3.9 and there is no 3.x fix. immutable 3 -> 4
+# is a breaking major (Iterable was renamed to Collection, among other API
+# changes) and swagger-ui-react 5.x — a shipped webview dependency of
+# mi-visualizer, ballerina-visualizer and wso2-platform-webviews — still
+# declares `immutable: ^3.x.x`, as do its react-immutable-proptypes,
+# react-immutable-pure-component and redux-immutable helpers. Forcing 4.3.9
+# would break Swagger UI at runtime, so the 3.x pin stays. Remove these entries
+# once swagger-ui-react supports immutable 4.
+CVE-2026-59879
+CVE-2026-59880

common/autoinstallers/rush-plugins/package.json

@@ -7,8 +7,8 @@
       "fast-xml-parser": "5.7.0",
       "fast-xml-builder": "1.1.7",
       "minimatch": "3.1.5",
-      "brace-expansion": "1.1.13",
-      "undici": "6.24.0"
+      "brace-expansion": "1.1.16",
+      "undici": "6.27.0"
     }
   },
   "dependencies": {