Navigate from .proto to implementation

Security

• Upgraded fast-uri override to ^4.1.4 (from ^3.1.5) to remediate four high-severity advisories where crafted URIs bypass host allowlist/SSRF checks (transitive via webpack → schema-utils → ajv):
  • GHSA-5jgf-p345-68v8 (high) — host confusion via skipped IDN canonicalization on scheme-relative references
  • GHSA-f65p-4m7j-42xc (high) — SSRF via malformed IPv6 normalization
  • GHSA-fph4-wmhf-6fwf (high) — SSRF via repeated hostname percent-decoding
  • GHSA-jqff-g426-hqxp (high) — host confusion via percent-encoded scheme normalization
• Added browserslist override ^4.28.7 (dev-only transitive via webpack) to remediate two high-severity advisories:
  • GHSA-c83g-rgw3-j3cx (high) — unbounded memory growth via distinct query results leading to OOM
  • GHSA-73wf-gq9-2v4g (high) — uncaught crash via prototype write through untrusted browserslist-stats.json

Security

• Upgraded fast-uri override to 3.1.5 (from 3.1.2) to remediate two high-severity host-confusion advisories letting crafted URIs bypass host allowlist/SSRF checks by parsing differently than Node's WHATWG URL parser (transitive via webpack → schema-utils → ajv):
  • GHSA-v2hh-gcrm-f6hx (CVE-2026-16221, high) — literal backslash not treated as an authority delimiter
  • GHSA-7p8r-x3mc-p8w7 (CVE-2026-18446, high) — backslash/forward-slash equivalence mismatch
• Upgraded brace-expansion override to 2.1.4 (from 2.0.2, dev-only transitive via eslint/mocha/c8) to remediate three DoS advisories:
  • GHSA-3jxr-9vmj-r5cp (high) — exponential-time expansion of consecutive non-expanding {} groups
  • GHSA-mh99-v99m-4gvg (high) — unbounded expansion length causing an out-of-memory crash
  • GHSA-rgw5-rvv9-x895 (high) — unbounded intermediate arrays bypassing the prior mitigation
• Upgraded js-yaml override to 4.3.1 (from 4.3.0, dev-only transitive via eslint) to remediate GHSA-5p4m-2wfm-xmqj (CVE-2026-59870, high) — quadratic CPU consumption in !!omap resolution

Security

• Upgraded protobufjs to 7.6.5 to remediate denial of service through unbounded Any expansion during JSON conversion (Dependabot alert #54)
• Pinned js-yaml to 4.3.0 to remediate a quadratic-complexity DoS in merge key handling (GHSA-h67p-54hq-rp68, dev-only transitive dependency)

Security

• Upgraded protobufjs to 7.5.8 (bringing transitive @protobufjs/utf8 to 1.1.1) to remediate 7 Dependabot advisories:
  • GHSA-685m-2w69-288q (high) — DoS via unbounded protobuf recursion
  • GHSA-66ff-xgx4-vchm (high) — Code injection through bytes field defaults in generated toObject
  • GHSA-75px-5xx7-5xc7 (high) — Code-generation gadget after prototype pollution
  • GHSA-jvwf-75h9-cwgg (high) — Process-wide DoS through unsafe option paths
  • GHSA-2pr8-phx7-x9h3 (medium) — DoS from crafted field names
  • GHSA-fx83-v9x8-x52w (medium) — Prototype injection in generated message constructors
  • GHSA-q6x5-8v7m-xcrf (medium) — Overlong UTF-8 decoding

Security

• Added fast-uri override to ^3.1.2 to remediate path traversal via percent-encoded dot segments (GHSA-69h6-vmm5-x7h2, transitive via webpack → schema-utils → ajv)

Security

• Upgraded protobufjs to 7.5.5 to remediate critical arbitrary code execution vulnerability (CVE-2026-41242, CVSS 9.4)

Added

• Added homepage field in package.json pointing to the extension's landing page

Security

• Upgraded serialize-javascript to ^7.0.5
• Upgraded picomatch to ^2.3.2
• Upgraded brace-expansion to ^2.0.2

Fixed

• Updated dev and test dependencies to address upstream security advisories affecting @typescript-eslint/*, minimatch, ajv, and the VS Code test toolchain

Added

• Python service implementation support (*Service.py)
• protoNavigation.implementationRootDirectory setting for custom search paths
• ProtoNavigation: Set Implementation Root Directory command

Added

• Go to Implementation (Cmd/Ctrl+F12) jumping to C# service methods
• Auto-activation on .proto files
• Smart search in Services/ directory with caching
• Detailed logging in Output panel