Bundled Terraform binary contains vulnerable Go dependencies (golang.org/x/crypto, golang.org/x/net, grpc, go-getter, pgx)

[kramachandir-exelixis]

Environment

Databricks VS Code Extension: 2.15.0
Platform: Linux x64

Issue

Our security scanning identified multiple vulnerabilities in the Terraform binary bundled with the Databricks VS Code extension.

The Terraform binary included in:

/opt/code-server/extensions/databricks.databricks-2.15.0-linux-x64/bin/dependencies/terraform

contains outdated Go dependencies with known CVEs.

Evidence

Terraform version:

$ terraform version
Terraform v1.5.5

Embedded dependency validation:

$ go version -m /opt/code-server/extensions/databricks.databricks-2.15.0-linux-x64/bin/dependencies/terraform | grep "golang.org/x/crypto"

dep golang.org/x/crypto v0.1.0

Affected dependencies

1. golang.org/x/crypto
   Current: 0.1.0
   Fixed: 0.52.0

2. github.com/jackc/pgx/v5
   Current: 5.7.5
   Fixed: 5.9.2

3. github.com/hashicorp/go-getter
   Current: 1.7.0
   Fixed: 1.8.6

4. golang.org/x/net
   Current: 0.7.0
   Fixed: 0.55.0

5. google.golang.org/grpc
   Current: 1.53.0
   Fixed: 1.82.1

Expected Behavior

The extension should bundle a Terraform binary built using dependency versions that remediate the known CVEs.

Request

Could Databricks provide:

1. An updated extension containing a patched Terraform binary.
2. The target release/version where these dependencies will be upgraded.

Impact

This is currently generating multiple Medium, High, and Critical vulnerability findings in enterprise security scans and prevents vulnerability remediation on our platform.