[Lms24]

Updates the changelog for 10.78.0 (originally wanted to 10.77.2 but turns out, one PR was a feature disguised as a fix 😅)

[cursor]

This PR is too large for Bugbot to review. It changes 42,883 lines and 3,167,750 characters. Split the change into smaller pull requests to get a review.

[semgrep-code-getsentry]

Semgrep found 1 ssc-7c41e9a2-3b5d-4f86-9e0a-d12f6b8c4a57 finding:

• yarn.lock
  • L29870 - Triage

🟠 High severity issue identified in your code:

Risk: Affected versions of launch-editor, vite, and vite-plus are vulnerable to Improper Neutralization of Special Elements used in a Command ('Command Injection'). launch-editor (bundled by vite and vite-plus for the dev server's /__open-in-editor endpoint) checks fs.existsSync(fileName) before passing the supplied file to the editor command, but the path is resolved (e.g. by launch-editor-middleware) before the :line:column suffix is stripped. On Windows, a crafted path ending in \..:1:1 is reduced to <nonexistent>\.., which fs.existsSync() accepts as the existing parent directory, so the existence check is bypassed without placing any file on disk. Combined with the % escaping issue (GHSA-698v-4r3x-3vcv), an attacker who controls the file argument passed to the default-exported launchEditor function (directly or via launch-editor-middleware) can achieve OS command injection.

Manual Review Advice: A vulnerability from this advisory is reachable if you run the vite or vite-plus dev server (or another tool that mounts launch-editor-middleware) on Windows

Fix: Upgrade this library to at least version 6.4.4 at sentry-javascript/yarn.lock:29870.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105035, GHSA-587h-7wmj-h5pm, CVE-2026-112942