$ ls ~/.vscode-server/extensions/jbenden.c-cpp-flylint-1.15.0
C-Cpp-FlyLint_icon.png cc-test-reporter CHANGELOG.md client codeclimate.ubuntu-latest-node16.json coverage LICENSES LICENSE.txt package.json README.md server specs typings.d.ts
and likely because CI/CD downloads and installs it with curl but does not delete. That binary is showing up with a ton of old Go package vulnerabilities in grype:
I do not think this is unto itself a security issue since cc-test-reporter isn't run by the extension, but I think for good hygiene it should not be part of the distributed binary.
I don't think this is intentional:
and likely because CI/CD downloads and installs it with curl but does not delete. That binary is showing up with a ton of old Go package vulnerabilities in
grype
:I do not think this is unto itself a security issue since cc-test-reporter isn't run by the extension, but I think for good hygiene it should not be part of the distributed binary.