Security enhancements

.github/workflows/build.yml

@@ -8,21 +8,24 @@ on:
 jobs:
   ci:
     runs-on: ${{ matrix.os }}
-    env:
-      #just hardcode this. It's not a mission-critical token, and we can always change it
-      COVERALLS_REPO_TOKEN: "Ysqq6q68DgojDzv3gvl5Yv029HXZYwGxq"
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - uses: actions/checkout@master
       - uses: actions/setup-node@master
         with:
-          node-version: "18.18.2"
+          node-version: "18.20.4"
       - run: npm ci
       - run: npm run build
       - run: npm run lint
       - run: npm run test
-      # disable coverage for now (because coveralls is down right now)
-      #- run: npm run publish-coverage
       - run: npm run create-package
+      - name: Upload coverage to Coveralls
+        if: matrix.os == 'ubuntu-latest'
+        uses: coverallsapp/github-action@v2
+        env:
+          #just hardcode this. It's not a mission-critical token, and we can always change it
+          COVERALLS_REPO_TOKEN: "Ysqq6q68DgojDzv3gvl5Yv029HXZYwGxq"
+        with:
+          path-to-lcov: ./coverage/lcov.info

.github/workflows/create-vsix.yml

@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@master
       - uses: actions/setup-node@master
         with:
-          node-version: "18.18.2"
+          node-version: "18.20.4"
       - run: npm ci
       - run: npx ts-node scripts/create-vsix.ts ${{ github.event.inputs.branch }}
       - uses: actions/upload-artifact@v4

.github/workflows/docs.yml

@@ -10,7 +10,7 @@ jobs:
       - uses: actions/checkout@master
       - uses: actions/setup-node@master
         with:
-          node-version: "18.18.2"
+          node-version: "18.20.4"
       - run: npm install
       - run: npm run build-docs
       - name: Deploy

.github/workflows/make-release-artifacts.yml

@@ -24,7 +24,7 @@ jobs:
     uses: rokucommunity/workflows/.github/workflows/make-release-artifacts.yml@master
     with:
       branch: ${{ github.event.inputs.tag || github.event.pull_request.head.ref }}
-      node-version: "18.18.2"
+      node-version: "18.20.4"
       artifact-paths: "*.vsix"
       force: ${{ github.event.inputs.force == 'true' }}
     secrets: inherit

.github/workflows/security-audit.yml

@@ -0,0 +1,20 @@
+name: Security Audit
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+  schedule:
+    #nightly at 06:00 UTC (1am EST / 2am EDT)
+    - cron: '0 6 * * *'
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - uses: actions/setup-node@master
+        with:
+          node-version: "18.20.4"
+      - run: npm ci
+      - run: npm run audit

README.md

@@ -1,9 +1,10 @@
 # BrightScript Language extension for VSCode
 
 [![build status](https://img.shields.io/github/actions/workflow/status/rokucommunity/vscode-brightscript-language/build.yml?logo=github&branch=master)](https://github.com/rokucommunity/vscode-brightscript-language/actions/workflows/build.yml)
+[![security](https://img.shields.io/github/actions/workflow/status/rokucommunity/vscode-brightscript-language/security-audit.yml?branch=master&label=security&logo=data:image/svg%2Bxml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxNiAxNiI+PHJlY3QgeD0iMyIgeT0iOCIgd2lkdGg9IjEwIiBoZWlnaHQ9IjciIHJ4PSIxIiBmaWxsPSJ3aGl0ZSIvPjxwYXRoIGQ9Ik01IDhWNWEzIDMgMCAwIDEgNiAwdjMiIGZpbGw9Im5vbmUiIHN0cm9rZT0id2hpdGUiIHN0cm9rZS13aWR0aD0iMiIvPjwvc3ZnPg==)](https://github.com/rokucommunity/vscode-brightscript-language/actions/workflows/security-audit.yml)
 [![coverage status](https://img.shields.io/coveralls/github/rokucommunity/vscode-brightscript-language?logo=coveralls)](https://coveralls.io/github/rokucommunity/vscode-brightscript-language?branch=master)
 [![Visual Studio Marketplace](https://vsmarketplacebadges.dev/installs-short/RokuCommunity.brightscript.png?logo=visual-studio-code)](https://marketplace.visualstudio.com/items?itemName=RokuCommunity.brightscript)
-[![Visual Studio Marketplace Version](https://img.shields.io/visual-studio-marketplace/v/RokuCommunity.brightscript.svg?logo=visual-studio-code&label=VSCode)](https://marketplace.visualstudio.com/items?itemName=RokuCommunity.brightscript)
+[![Visual Studio Marketplace Version](https://vsmarketplacebadges.dev/version/RokuCommunity.brightscript.png?logo=visual-studio-code&label=VSCode)](https://marketplace.visualstudio.com/items?itemName=RokuCommunity.brightscript)
 [![OpenVSX](https://img.shields.io/open-vsx/v/RokuCommunity/brightscript.svg?label=OpenVSX)](https://open-vsx.org/extension/RokuCommunity/brightscript)
 [![license](https://img.shields.io/github/license/rokucommunity/vscode-brightscript-language.svg)](LICENSE)
 [![Slack](https://img.shields.io/badge/Slack-RokuCommunity-4A154B?logo=slack)](https://join.slack.com/t/rokudevelopers/shared_invite/zt-4vw7rg6v-NH46oY7hTktpRIBM_zGvwA)
@@ -60,6 +61,10 @@ For a full list of features and settings, please see our [documentation website]
 
 The majority of this extension's language feature support depends on the [BrighterScript](https://github.com/RokuCommunity/brighterscript) project, which contributes the language server. The debugging functionality comes from the [roku-debug](https://github.com/RokuCommunity/roku-debug) project. If you would like to contribute please see our [contributing guide](https://rokucommunity.github.io/vscode-brightscript-language/contributing.html)
 
+## Accepted security advisories
+
+Dependencies flagged by `npm audit` that we have reviewed and chosen not to upgrade are tracked in [audit-ci.jsonc](https://github.com/RokuCommunity/vscode-brightscript-language/blob/master/audit-ci.jsonc). Each entry includes the advisory ID, the date it was added, and the reason it does not apply to this project.
+
 ## Changelog
 
 Click [here](https://github.com/RokuCommunity/vscode-brightscript-language/blob/master/CHANGELOG.md) to see the changelog.

audit-ci.jsonc

@@ -0,0 +1,15 @@
+{
+    // Fail on moderate severity and above. See README "Accepted security advisories" for
+    // why each allowlisted entry is safe to defer.
+    "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
+    "moderate": true,
+    "allowlist": [
+        {
+            "GHSA-2p57-rm9w-gvfp": {
+                // Added: 2026-05-19
+                "active": true,
+                "notes": "`ip` (via `node-ssdp`): no fixed version published. `ip` is only used by `node-ssdp` for local-network Roku discovery; no untrusted input flows into `ip.isPublic()` in any path we control."
+            }
+        }
+    ]
+}