[Snyk] Fix for 1 vulnerabilities

[sestinj]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• extensions/vscode/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	HTTP Response Splitting SNYK-JS-AXIOS-16298058	848

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

---

Summary by cubic

Fixes a critical HTTP response splitting vulnerability by upgrading axios in the VS Code extension. Also updates vectordb.

• Dependencies
  • Upgrade axios from ^1.13.1 to ^1.15.1 to address SNYK-JS-AXIOS-16298058.
  • Bump vectordb from 0.4.20 to 0.21.2.

^{Written for commit fa46cd1. Summary will update on new commits.}

[continue]

Docs Review

No documentation updates needed for this PR.

This is a Snyk security fix that bumps internal dependencies (axios and vectordb) in the VS Code extension's package.json. These version changes:

• Don't affect any user-facing APIs or configuration
• Don't change any documented behavior or features
• Are internal implementation details not referenced in the docs

Thanks for keeping dependencies secure! 🔒

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="extensions/vscode/package.json">

<violation number="1" location="extensions/vscode/package.json:736">
P1: Update the lockfile too; this package.json-only bump won’t change what `npm ci` installs.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[cubic-dev-ai]

P1: Update the lockfile too; this package.json-only bump won’t change what npm ci installs.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At extensions/vscode/package.json, line 736:

<comment>Update the lockfile too; this package.json-only bump won’t change what `npm ci` installs.</comment>

<file context>
@@ -733,7 +733,7 @@
     "@reduxjs/toolkit": "^1.9.3",
     "@vscode/ripgrep": "^1.15.9",
-    "axios": "^1.13.1",
+    "axios": "^1.15.1",
     "core": "file:../../core",
     "cors": "^2.8.5",
</file context>