diff --git a/.github/workflows/basic.yml b/.github/workflows/basic.yml
deleted file mode 100644
index a1a5c5ad477f..000000000000
--- a/.github/workflows/basic.yml
+++ /dev/null
@@ -1,179 +0,0 @@
-name: Basic checks
-
-on: workflow_dispatch
-
-# on:
-#   push:
-#     branches:
-#       - main
-#   pull_request:
-#     branches:
-#       - main
-
-jobs:
-  main:
-    if: github.ref != 'refs/heads/main'
-    name: Compilation, Unit and Integration Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - uses: actions/checkout@v4
-
-      # TODO: rename azure-pipelines/linux/xvfb.init to github-actions
-      - name: Setup Build Environment
-        run: |
-          sudo cp build/azure-pipelines/linux/xvfb.init /etc/init.d/xvfb
-          sudo chmod +x /etc/init.d/xvfb
-          sudo update-rc.d xvfb defaults
-          sudo service xvfb start
-
-      - uses: actions/setup-node@v5
-        with:
-          node-version-file: .nvmrc
-
-      - name: Compute node modules cache key
-        id: nodeModulesCacheKey
-        run: echo "value=$(node build/azure-pipelines/common/computeNodeModulesCacheKey.js)" >> $GITHUB_OUTPUT
-      - name: Cache node modules
-        id: cacheNodeModules
-        uses: actions/cache@v4
-        with:
-          path: "**/node_modules"
-          key: ${{ runner.os }}-cacheNodeModulesLinux-${{ steps.nodeModulesCacheKey.outputs.value }}
-      - name: Get npm cache directory path
-        id: npmCacheDirPath
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
-      - name: Cache npm directory
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        uses: actions/cache@v4
-        with:
-          path: ${{ steps.npmCacheDirPath.outputs.dir }}
-          key: ${{ runner.os }}-npmCacheDir-${{ steps.nodeModulesCacheKey.outputs.value }}
-          restore-keys: ${{ runner.os }}-npmCacheDir-
-      - name: Execute npm
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        env:
-          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-          ELECTRON_SKIP_BINARY_DOWNLOAD: 1
-        run: npm ci
-
-      - name: Compile and Download
-        run: npm exec -- npm-run-all -lp compile "electron x64"
-
-      - name: Run Unit Tests
-        id: electron-unit-tests
-        run: DISPLAY=:10 ./scripts/test.sh
-
-      - name: Run Integration Tests (Electron)
-        id: electron-integration-tests
-        run: DISPLAY=:10 ./scripts/test-integration.sh
-
-  hygiene:
-    if: github.ref != 'refs/heads/main'
-    name: Hygiene and Layering
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v5
-        with:
-          node-version-file: .nvmrc
-
-      - name: Compute node modules cache key
-        id: nodeModulesCacheKey
-        run: echo "value=$(node build/azure-pipelines/common/computeNodeModulesCacheKey.js)" >> $GITHUB_OUTPUT
-      - name: Cache node modules
-        id: cacheNodeModules
-        uses: actions/cache@v4
-        with:
-          path: "**/node_modules"
-          key: ${{ runner.os }}-cacheNodeModulesLinux-${{ steps.nodeModulesCacheKey.outputs.value }}
-      - name: Get npm cache directory path
-        id: npmCacheDirPath
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
-      - name: Cache npm directory
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        uses: actions/cache@v4
-        with:
-          path: ${{ steps.npmCacheDirPath.outputs.dir }}
-          key: ${{ runner.os }}-npmCacheDir-${{ steps.nodeModulesCacheKey.outputs.value }}
-          restore-keys: ${{ runner.os }}-npmCacheDir-
-      - name: Execute npm
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        env:
-          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-          ELECTRON_SKIP_BINARY_DOWNLOAD: 1
-        run: npm ci
-
-      - name: Run Hygiene Checks
-        run: npm run gulp hygiene
-
-      - name: Run Valid Layers Checks
-        run: npm run valid-layers-check
-
-      - name: Run Property Init Order Checks
-        run: npm run property-init-order-check
-
-      - name: Compile /build/
-        run: npm run compile
-        working-directory: build
-
-      - name: Check clean git state
-        run: ./.github/workflows/check-clean-git-state.sh
-
-      - name: Run eslint
-        run: npm run eslint
-
-      - name: Run vscode-dts Compile Checks
-        run: npm run vscode-dts-compile-check
-
-      - name: Run Trusted Types Checks
-        run: npm run tsec-compile-check
-
-  warm-cache:
-    name: Warm up node modules cache
-    if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v5
-        with:
-          node-version-file: .nvmrc
-
-      - name: Compute node modules cache key
-        id: nodeModulesCacheKey
-        run: echo "value=$(node build/azure-pipelines/common/computeNodeModulesCacheKey.js)" >> $GITHUB_OUTPUT
-      - name: Cache node modules
-        id: cacheNodeModules
-        uses: actions/cache@v4
-        with:
-          path: "**/node_modules"
-          key: ${{ runner.os }}-cacheNodeModulesLinux-${{ steps.nodeModulesCacheKey.outputs.value }}
-      - name: Get npm cache directory path
-        id: npmCacheDirPath
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
-      - name: Cache npm directory
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        uses: actions/cache@v4
-        with:
-          path: ${{ steps.npmCacheDirPath.outputs.dir }}
-          key: ${{ runner.os }}-npmCacheDir-${{ steps.nodeModulesCacheKey.outputs.value }}
-          restore-keys: ${{ runner.os }}-npmCacheDir-
-      - name: Execute npm
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        env:
-          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-          ELECTRON_SKIP_BINARY_DOWNLOAD: 1
-        run: npm ci
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index 6a860f588616..000000000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,319 +0,0 @@
-name: CI
-
-on: workflow_dispatch
-
-# on:
-#   push:
-#     branches:
-#       - main
-#       - release/*
-#   pull_request:
-#     branches:
-#       - main
-#       - release/*
-
-jobs:
-  windows:
-    name: Windows
-    runs-on: windows-2022
-    timeout-minutes: 60
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v5
-        with:
-          node-version-file: .nvmrc
-
-      - uses: actions/setup-python@v6
-        with:
-          python-version: "3.x"
-
-      - name: Compute node modules cache key
-        id: nodeModulesCacheKey
-        run: echo "value=$(node build/azure-pipelines/common/computeNodeModulesCacheKey.js)" >> $GITHUB_OUTPUT
-      - name: Cache node_modules archive
-        id: cacheNodeModules
-        uses: actions/cache@v4
-        with:
-          path: ".build/node_modules_cache"
-          key: "${{ runner.os }}-cacheNodeModulesArchive-${{ steps.nodeModulesCacheKey.outputs.value }}"
-      - name: Extract node_modules archive
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit == 'true' }}
-        run: 7z.exe x .build/node_modules_cache/cache.7z -aos
-      - name: Get npm cache directory path
-        id: npmCacheDirPath
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
-      - name: Cache npm directory
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        uses: actions/cache@v4
-        with:
-          path: ${{ steps.npmCacheDirPath.outputs.dir }}
-          key: ${{ runner.os }}-npmCacheDir-${{ steps.nodeModulesCacheKey.outputs.value }}
-          restore-keys: ${{ runner.os }}-npmCacheDir-
-      - name: Execute npm
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        env:
-          npm_config_foreground_scripts: "true"
-          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-          ELECTRON_SKIP_BINARY_DOWNLOAD: 1
-        run: npm ci
-      - name: Create node_modules archive
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        run: |
-          mkdir -Force .build
-          node build/azure-pipelines/common/listNodeModules.js .build/node_modules_list.txt
-          mkdir -Force .build/node_modules_cache
-          7z.exe a .build/node_modules_cache/cache.7z -mx3 `@.build/node_modules_list.txt
-
-      - name: Compile and Download
-        run: npm exec -- npm-run-all -lp compile "electron x64" playwright-install download-builtin-extensions
-
-      - name: Compile Integration Tests
-        run: npm run compile
-        working-directory: test/integration/browser
-
-      - name: Run Unit Tests (Electron)
-        run: .\scripts\test.bat
-
-      - name: Run Unit Tests (node.js)
-        run: npm run test-node
-
-      - name: Run Unit Tests (Browser, Chromium)
-        run: npm run test-browser-no-install -- --browser chromium
-
-      - name: Run Integration Tests (Electron)
-        run: .\scripts\test-integration.bat
-
-      - name: Run Integration Tests (Browser, Firefox)
-        timeout-minutes: 20
-        run: .\scripts\test-web-integration.bat --browser firefox
-
-      - name: Run Integration Tests (Remote)
-        timeout-minutes: 20
-        run: .\scripts\test-remote-integration.bat
-
-  linux:
-    name: Linux
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - uses: actions/checkout@v4
-
-      # TODO: rename azure-pipelines/linux/xvfb.init to github-actions
-      - name: Setup Build Environment
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libxkbfile-dev pkg-config libkrb5-dev libxss1 dbus xvfb libgtk-3-0 libgbm1
-          sudo cp build/azure-pipelines/linux/xvfb.init /etc/init.d/xvfb
-          sudo chmod +x /etc/init.d/xvfb
-          sudo update-rc.d xvfb defaults
-          sudo service xvfb start
-
-      - uses: actions/setup-node@v5
-        with:
-          node-version-file: .nvmrc
-
-      - name: Compute node modules cache key
-        id: nodeModulesCacheKey
-        run: echo "value=$(node build/azure-pipelines/common/computeNodeModulesCacheKey.js)" >> $GITHUB_OUTPUT
-      - name: Cache node modules
-        id: cacheNodeModules
-        uses: actions/cache@v4
-        with:
-          path: "**/node_modules"
-          key: ${{ runner.os }}-cacheNodeModulesLinux-${{ steps.nodeModulesCacheKey.outputs.value }}
-      - name: Get npm cache directory path
-        id: npmCacheDirPath
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
-      - name: Cache npm directory
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        uses: actions/cache@v4
-        with:
-          path: ${{ steps.npmCacheDirPath.outputs.dir }}
-          key: ${{ runner.os }}-npmCacheDir-${{ steps.nodeModulesCacheKey.outputs.value }}
-          restore-keys: ${{ runner.os }}-npmCacheDir-
-      - name: Execute npm
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        env:
-          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-          ELECTRON_SKIP_BINARY_DOWNLOAD: 1
-        run: npm ci
-
-      - name: Compile and Download
-        run: npm exec -- npm-run-all -lp compile "electron x64" playwright-install download-builtin-extensions
-
-      - name: Compile Integration Tests
-        run: npm run compile
-        working-directory: test/integration/browser
-
-      - name: Run Unit Tests (Electron)
-        id: electron-unit-tests
-        run: DISPLAY=:10 ./scripts/test.sh
-
-      - name: Run Unit Tests (node.js)
-        id: nodejs-unit-tests
-        run: npm run test-node
-
-      - name: Run Unit Tests (Browser, Chromium)
-        id: browser-unit-tests
-        run: DISPLAY=:10 npm run test-browser-no-install -- --browser chromium
-
-      - name: Run Integration Tests (Electron)
-        id: electron-integration-tests
-        run: DISPLAY=:10 ./scripts/test-integration.sh
-
-      - name: Run Integration Tests (Browser, Chromium)
-        id: browser-integration-tests
-        run: DISPLAY=:10 ./scripts/test-web-integration.sh --browser chromium
-
-      - name: Run Integration Tests (Remote)
-        id: electron-remote-integration-tests
-        timeout-minutes: 15
-        run: DISPLAY=:10 ./scripts/test-remote-integration.sh
-
-  darwin:
-    name: macOS
-    runs-on: macos-latest
-    timeout-minutes: 40
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v5
-        with:
-          node-version-file: .nvmrc
-
-      - name: Compute node modules cache key
-        id: nodeModulesCacheKey
-        run: echo "value=$(node build/azure-pipelines/common/computeNodeModulesCacheKey.js)" >> $GITHUB_OUTPUT
-      - name: Cache node modules
-        id: cacheNodeModules
-        uses: actions/cache@v4
-        with:
-          path: "**/node_modules"
-          key: ${{ runner.os }}-cacheNodeModulesMacOS-${{ steps.nodeModulesCacheKey.outputs.value }}
-      - name: Get npm cache directory path
-        id: npmCacheDirPath
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
-      - name: Cache npm directory
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        uses: actions/cache@v4
-        with:
-          path: ${{ steps.npmCacheDirPath.outputs.dir }}
-          key: ${{ runner.os }}-npmCacheDir-${{ steps.nodeModulesCacheKey.outputs.value }}
-          restore-keys: ${{ runner.os }}-npmCacheDir-
-      - name: Execute npm
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        env:
-          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-          ELECTRON_SKIP_BINARY_DOWNLOAD: 1
-        run: npm ci
-
-      - name: Compile and Download
-        run: npm exec -- npm-run-all -lp compile "electron x64" playwright-install download-builtin-extensions
-
-      - name: Compile Integration Tests
-        run: npm run compile
-        working-directory: test/integration/browser
-
-      # This is required for SecretStorage unittests
-      - name: Create temporary keychain
-        run: |
-          security create-keychain -p pwd $RUNNER_TEMP/buildagent.keychain
-          security default-keychain -s $RUNNER_TEMP/buildagent.keychain
-          security unlock-keychain -p pwd $RUNNER_TEMP/buildagent.keychain
-
-      - name: Run Unit Tests (Electron)
-        run: DISPLAY=:10 ./scripts/test.sh
-
-      - name: Run Unit Tests (node.js)
-        run: npm run test-node
-
-      - name: Run Unit Tests (Browser, Chromium)
-        run: DISPLAY=:10 npm run test-browser-no-install -- --browser chromium
-
-      - name: Run Integration Tests (Electron)
-        run: DISPLAY=:10 ./scripts/test-integration.sh
-
-      - name: Run Integration Tests (Browser, Webkit)
-        run: DISPLAY=:10 ./scripts/test-web-integration.sh --browser webkit
-
-      - name: Run Integration Tests (Remote)
-        timeout-minutes: 15
-        run: DISPLAY=:10 ./scripts/test-remote-integration.sh
-
-  hygiene:
-    name: Hygiene and Layering
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v5
-        with:
-          node-version-file: .nvmrc
-
-      - name: Compute node modules cache key
-        id: nodeModulesCacheKey
-        run: echo "value=$(node build/azure-pipelines/common/computeNodeModulesCacheKey.js)" >> $GITHUB_OUTPUT
-      - name: Cache node modules
-        id: cacheNodeModules
-        uses: actions/cache@v4
-        with:
-          path: "**/node_modules"
-          key: ${{ runner.os }}-cacheNodeModulesLinux-${{ steps.nodeModulesCacheKey.outputs.value }}
-      - name: Get npm cache directory path
-        id: npmCacheDirPath
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
-      - name: Cache npm directory
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        uses: actions/cache@v4
-        with:
-          path: ${{ steps.npmCacheDirPath.outputs.dir }}
-          key: ${{ runner.os }}-npmCacheDir-${{ steps.nodeModulesCacheKey.outputs.value }}
-          restore-keys: ${{ runner.os }}-npmCacheDir-
-      - name: Execute npm
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        env:
-          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-          ELECTRON_SKIP_BINARY_DOWNLOAD: 1
-        run: npm ci
-
-      - name: Download Playwright
-        run: npm run playwright-install
-
-      - name: Run Hygiene Checks
-        run: npm run gulp hygiene
-
-      - name: Run Valid Layers Checks
-        run: npm run valid-layers-check
-
-      - name: Run Property Init Order Checks
-        run: npm run property-init-order-check
-
-      - name: Compile /build/
-        run: npm run compile
-        working-directory: build
-
-      - name: Check clean git state
-        run: ./.github/workflows/check-clean-git-state.sh
-
-      - name: Run eslint
-        run: npm run eslint
-
-      - name: Run vscode-dts Compile Checks
-        run: npm run vscode-dts-compile-check
-
-      - name: Run Trusted Types Checks
-        run: npm run tsec-compile-check
diff --git a/.github/workflows/monaco-editor.yml b/.github/workflows/monaco-editor.yml
deleted file mode 100644
index 842e327735f5..000000000000
--- a/.github/workflows/monaco-editor.yml
+++ /dev/null
@@ -1,97 +0,0 @@
-name: Monaco Editor checks
-
-on:
-  push:
-    branches:
-      - main
-      - release/*
-  pull_request:
-    branches:
-      - main
-      - release/*
-
-jobs:
-  main:
-    name: Monaco Editor checks
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v5
-        with:
-          node-version-file: .nvmrc
-
-      - name: Compute node modules cache key
-        id: nodeModulesCacheKey
-        run: echo "value=$(node build/azure-pipelines/common/computeNodeModulesCacheKey.js)" >> $GITHUB_OUTPUT
-      - name: Cache node modules
-        id: cacheNodeModules
-        uses: actions/cache@v4
-        with:
-          path: "**/node_modules"
-          key: ${{ runner.os }}-cacheNodeModules20-${{ steps.nodeModulesCacheKey.outputs.value }}
-          restore-keys: ${{ runner.os }}-cacheNodeModules20-
-      - name: Get npm cache directory path
-        id: npmCacheDirPath
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
-      - name: Cache npm directory
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        uses: actions/cache@v4
-        with:
-          path: ${{ steps.npmCacheDirPath.outputs.dir }}
-          key: ${{ runner.os }}-npmCacheDir-${{ steps.nodeModulesCacheKey.outputs.value }}
-          restore-keys: ${{ runner.os }}-npmCacheDir-
-      - name: Install system dependencies
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        run: |
-          sudo apt update
-          sudo apt install -y libxkbfile-dev pkg-config libkrb5-dev libxss1
-      - name: Execute npm
-        if: ${{ steps.cacheNodeModules.outputs.cache-hit != 'true' }}
-        env:
-          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-          ELECTRON_SKIP_BINARY_DOWNLOAD: 1
-        run: |
-          npm ci
-
-      - name: Download Playwright
-        run: npm run playwright-install
-
-      - name: Run Monaco Editor Checks
-        run: npm run monaco-compile-check
-
-      - name: Editor Distro & ESM
-        run: npm run gulp editor-esm
-
-      - name: Editor ESM sources check
-        working-directory: ./test/monaco
-        run: npm run esm-check
-
-      - name: Typings validation prep
-        run: |
-          mkdir typings-test
-
-      - name: Typings validation
-        working-directory: ./typings-test
-        run: |
-          npm init -yp
-          ../node_modules/.bin/tsc --init
-          echo "import '../out-monaco-editor-core';" > a.ts
-          ../node_modules/.bin/tsc --noEmit
-
-      - name: Package Editor with Webpack
-        working-directory: ./test/monaco
-        run: npm run bundle-webpack
-
-      - name: Compile Editor Tests
-        working-directory: ./test/monaco
-        run: npm run compile
-
-      - name: Run Editor Tests
-        timeout-minutes: 5
-        working-directory: ./test/monaco
-        run: npm run test
diff --git a/.github/workflows/telemetry.yml b/.github/workflows/telemetry.yml
index 8b28897b16fe..8863d52e8194 100644
--- a/.github/workflows/telemetry.yml
+++ b/.github/workflows/telemetry.yml
@@ -4,6 +4,8 @@ on:
 jobs:
   check-metdata:
     name: 'Check metadata'
+    permissions:
+      contents: read
     runs-on: 'ubuntu-latest'
 
     steps:
diff --git a/build/azure-pipelines/publish-types/update-types.ts b/build/azure-pipelines/publish-types/update-types.ts
index 0f99b07cf9a3..3bb02b7adabd 100644
--- a/build/azure-pipelines/publish-types/update-types.ts
+++ b/build/azure-pipelines/publish-types/update-types.ts
@@ -16,7 +16,7 @@ try {
 
 	const dtsUri = `https://raw.githubusercontent.com/microsoft/vscode/${tag}/src/vscode-dts/vscode.d.ts`;
 	const outPath = path.resolve(process.cwd(), 'DefinitelyTyped/types/vscode/index.d.ts');
-	cp.execSync(`curl ${dtsUri} --output ${outPath}`);
+	cp.execFileSync('curl', [dtsUri, '--output', outPath]);
 
 	updateDTSFile(outPath, tag);
 
diff --git a/build/package-lock.json b/build/package-lock.json
index 940ab861a34d..93fdaa4335e7 100644
--- a/build/package-lock.json
+++ b/build/package-lock.json
@@ -4117,9 +4117,9 @@
       }
     },
     "node_modules/tar-fs": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.3.tgz",
-      "integrity": "sha512-090nwYJDmlhwFwEW3QQl+vaNnxsO2yVsd45eTKRBzSzu+hlb1w2K9inVq5b0ngXuLVqQ4ApvsUHHnu/zQNkWAg==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
+      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
diff --git a/extensions/git/src/gitEditor.ts b/extensions/git/src/gitEditor.ts
index 6291e5152a72..38001136956e 100644
--- a/extensions/git/src/gitEditor.ts
+++ b/extensions/git/src/gitEditor.ts
@@ -67,7 +67,7 @@ export class GitEditor implements IIPCHandler, ITerminalEnvironmentProvider {
 }
 
 export class GitEditorDocumentLinkProvider implements DocumentLinkProvider {
-	private readonly _regex = /^#\s+(modified|new file|deleted|renamed|copied|type change):\s+(?<file1>.*?)(?:\s+->\s+(?<file2>.*))*$/gm;
+
 
 	constructor(private readonly _model: Model) { }
 
diff --git a/extensions/json/build/update-grammars.js b/extensions/json/build/update-grammars.js
index 2b7f76f8f909..13356a2c4c4e 100644
--- a/extensions/json/build/update-grammars.js
+++ b/extensions/json/build/update-grammars.js
@@ -9,7 +9,7 @@ var updateGrammar = require('vscode-grammar-updater');
 function adaptJSON(grammar, name, replacementScope, replaceeScope = 'json') {
 	grammar.name = name;
 	grammar.scopeName = `source${replacementScope}`;
-	const regex = new RegExp(`\.${replaceeScope}`, 'g');
+	const regex = new RegExp(`\\.${replaceeScope}`, 'g');
 	var fixScopeNames = function (rule) {
 		if (typeof rule.name === 'string') {
 			rule.name = rule.name.replace(regex, replacementScope);
diff --git a/extensions/markdown-language-features/preview-src/index.ts b/extensions/markdown-language-features/preview-src/index.ts
index 7e5aee5e277e..8153953b606b 100644
--- a/extensions/markdown-language-features/preview-src/index.ts
+++ b/extensions/markdown-language-features/preview-src/index.ts
@@ -10,6 +10,7 @@ import { getEditorLineNumberForPageOffset, scrollToRevealSourceLine, getLineElem
 import { SettingsManager, getData, getRawData } from './settings';
 import throttle = require('lodash.throttle');
 import morphdom from 'morphdom';
+import DOMPurify from 'dompurify';
 import type { ToWebviewMessage } from '../types/previewMessaging';
 import { isOfScheme, Schemes } from '../src/util/schemes';
 
@@ -206,7 +207,8 @@ window.addEventListener('message', async event => {
 			const root = document.querySelector('.markdown-body')!;
 
 			const parser = new DOMParser();
-			const newContent = parser.parseFromString(data.content, 'text/html'); // CodeQL [SM03712] This renderers content from the workspace into the Markdown preview. Webviews (and the markdown preview) have many other security measures in place to make this safe
+			const sanitizedContent = DOMPurify.sanitize(data.content);
+			const newContent = parser.parseFromString(sanitizedContent, 'text/html'); // CodeQL [SM03712] This renderers content from the workspace into the Markdown preview. Webviews (and the markdown preview) have many other security measures in place to make this safe
 
 			// Strip out meta http-equiv tags
 			for (const metaElement of Array.from(newContent.querySelectorAll('meta'))) {
diff --git a/extensions/markdown-language-features/src/languageFeatures/copyFiles/shared.ts b/extensions/markdown-language-features/src/languageFeatures/copyFiles/shared.ts
index 273fa56a6bb5..17f7ad1b8050 100644
--- a/extensions/markdown-language-features/src/languageFeatures/copyFiles/shared.ts
+++ b/extensions/markdown-language-features/src/languageFeatures/copyFiles/shared.ts
@@ -302,7 +302,7 @@ function escapeMarkdownLinkPath(mdPath: string): string {
 }
 
 function escapeBrackets(value: string): string {
-	value = value.replace(/[\[\]]/g, '\\$&'); // CodeQL [SM02383] The Markdown is fully sanitized after being rendered.
+	value = value.replace(/\\/g, '\\\\').replace(/[\[\]]/g, '\\$&'); // CodeQL [SM02383] The Markdown is fully sanitized after being rendered.
 	return value;
 }
 
diff --git a/extensions/media-preview/media/imagePreview.js b/extensions/media-preview/media/imagePreview.js
index ab8ad542a2d9..282e2a82cb94 100644
--- a/extensions/media-preview/media/imagePreview.js
+++ b/extensions/media-preview/media/imagePreview.js
@@ -311,7 +311,45 @@
 		document.body.classList.remove('loading');
 	});
 
-	image.src = settings.src;
+	/**
+	 * Validate and ensure only safe image sources can be used.
+	 * @param {string} src
+	 * @return {boolean}
+	 */
+	function isSafeImageSrc(src) {
+		try {
+			if (typeof src !== 'string' || src.length > 2048) {
+				return false;
+			}
+			// Allow http, https, file, and data URIs for images only
+			const allowedSchemes = ['http:', 'https:', 'file:'];
+			const urlMatch = src.match(/^([a-zA-Z0-9+.-]+):/);
+			if (!urlMatch) {
+				return false;
+			}
+			const scheme = urlMatch[1].toLowerCase() + ':';
+			if (allowedSchemes.includes(scheme)) {
+				return true;
+			}
+			if (scheme === 'data:') {
+				// Allow only image media types in data URLs
+				// Disallow SVG images for data URIs to mitigate XSS
+				return /^data:image\/(png|jpe?g|gif|bmp|webp);base64,/.test(src);
+			}
+			return false;
+		} catch {
+			return false;
+		}
+	}
+
+	if (isSafeImageSrc(settings.src)) {
+		image.src = settings.src;
+	} else {
+		console.error('Unsafe image src detected:', settings.src);
+		image.src = '';
+		document.body.classList.add('error');
+		document.body.classList.remove('loading');
+	}
 
 	document.querySelector('.open-file-link')?.addEventListener('click', (e) => {
 		e.preventDefault();
diff --git a/extensions/media-preview/media/videoPreview.js b/extensions/media-preview/media/videoPreview.js
index eeed26972a31..8ff6ddcb8d52 100644
--- a/extensions/media-preview/media/videoPreview.js
+++ b/extensions/media-preview/media/videoPreview.js
@@ -5,6 +5,18 @@
 // @ts-check
 "use strict";
 
+// Returns true if src is a safe URL for video.src
+function isSafeVideoSrc(src) {
+	try {
+		const allowedProtocols = ['http:', 'https:', 'blob:', 'filesystem:', ''];
+		// If relative URL, use document.baseURI as base
+		const url = new URL(src, document.baseURI);
+		return allowedProtocols.includes(url.protocol);
+	} catch {
+		return false;
+	}
+}
+
 (function () {
 	// @ts-ignore
 	const vscode = acquireVsCodeApi();
@@ -28,7 +40,7 @@
 
 	// Elements
 	const video = document.createElement('video');
-	if (settings.src !== null) {
+	if (settings.src !== null && isSafeVideoSrc(settings.src)) {
 		video.src = settings.src;
 	}
 	video.playsInline = true;
diff --git a/extensions/simple-browser/preview-src/index.ts b/extensions/simple-browser/preview-src/index.ts
index 3d804aa60fa4..106146f86579 100644
--- a/extensions/simple-browser/preview-src/index.ts
+++ b/extensions/simple-browser/preview-src/index.ts
@@ -90,18 +90,23 @@ onceDocumentLoaded(() => {
 	toggleFocusLockIndicatorEnabled(settings.focusLockIndicatorEnabled);
 
 	function navigateTo(rawUrl: string): void {
+		let safeUrl: string | null = null;
 		try {
 			const url = new URL(rawUrl);
-
-			// Try to bust the cache for the iframe
-			// There does not appear to be any way to reliably do this except modifying the url
-			url.searchParams.append('vscodeBrowserReqId', Date.now().toString());
-
-			iframe.src = url.toString();
+			if (url.protocol === 'http:' || url.protocol === 'https:') {
+				// Try to bust the cache for the iframe
+				url.searchParams.append('vscodeBrowserReqId', Date.now().toString());
+				safeUrl = url.toString();
+			}
 		} catch {
-			iframe.src = rawUrl;
+			// On parse error, do not attempt to match with regex; keep safeUrl as null.
+		}
+		if (safeUrl) {
+			iframe.src = safeUrl;
+		} else {
+			// Optionally, display an error or set to about:blank
+			iframe.src = 'about:blank';
 		}
-
 		vscode.setState({ url: rawUrl });
 	}
 });
diff --git a/extensions/typescript-language-features/src/languageFeatures/jsDocCompletions.ts b/extensions/typescript-language-features/src/languageFeatures/jsDocCompletions.ts
index f2c1b49c67f2..7bf3eb47da71 100644
--- a/extensions/typescript-language-features/src/languageFeatures/jsDocCompletions.ts
+++ b/extensions/typescript-language-features/src/languageFeatures/jsDocCompletions.ts
@@ -103,7 +103,7 @@ class JsDocCompletionProvider implements vscode.CompletionItemProvider {
 export function templateToSnippet(template: string): vscode.SnippetString {
 	// TODO: use append placeholder
 	let snippetIndex = 1;
-	template = template.replace(/\$/g, '\\$'); // CodeQL [SM02383] This is only used for text which is put into the editor. It is not for rendered html
+	template = template.replace(/\\/g, '\\\\').replace(/\$/g, '\\$'); // Escape backslash and dollar for VSCode snippets
 	template = template.replace(/^[ \t]*(?=(\/|[ ]\*))/gm, '');
 	template = template.replace(/^(\/\*\*\s*\*[ ]*)$/m, (x) => x + `\$0`);
 	template = template.replace(/\* @param([ ]\{\S+\})?\s+(\S+)[ \t]*$/gm, (_param, type, post) => {
diff --git a/extensions/typescript-language-features/src/languageFeatures/util/textRendering.ts b/extensions/typescript-language-features/src/languageFeatures/util/textRendering.ts
index f44ac0c4f407..b0acc74db201 100644
--- a/extensions/typescript-language-features/src/languageFeatures/util/textRendering.ts
+++ b/extensions/typescript-language-features/src/languageFeatures/util/textRendering.ts
@@ -210,7 +210,8 @@ function convertLinkTags(
 }
 
 function escapeMarkdownSyntaxTokensForCode(text: string): string {
-	return text.replace(/`/g, '\\$&'); // CodeQL [SM02383] This is only meant to escape backticks. The Markdown is fully sanitized after being rendered.
+	// First escape backslashes, then backticks
+	return text.replace(/\\/g, '\\\\').replace(/`/g, '\\$&'); // CodeQL [SM02383] This now escapes backticks and backslashes.
 }
 
 export function tagsToMarkdown(
diff --git a/package-lock.json b/package-lock.json
index 88661ae94230..f8fd5526daa9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -140,7 +140,7 @@
         "os-browserify": "^0.3.0",
         "p-all": "^1.0.0",
         "path-browserify": "^1.0.1",
-        "postcss": "^8.4.40",
+        "postcss": "^8.5.3",
         "postcss-nesting": "^12.0.2",
         "pump": "^1.0.1",
         "rcedit": "^1.1.0",
@@ -160,7 +160,7 @@
         "webpack": "^5.94.0",
         "webpack-cli": "^5.1.4",
         "webpack-stream": "^7.0.0",
-        "xml2js": "^0.6.1",
+        "xml2js": "^0.6.2",
         "yaserver": "^0.4.0"
       },
       "optionalDependencies": {
@@ -12348,9 +12348,9 @@
       "integrity": "sha1-elfrVQpng/kRUzH89GY9XI4AelA= sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg=="
     },
     "node_modules/picocolors": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.0.tgz",
-      "integrity": "sha512-TQ92mBOW0l3LeMeyLV6mzy/kWr8lkd/hp3mTg7wYK7zJhuBStmGMBG0BdeDZS/dZx1IukaX6Bk11zcln25o1Aw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
       "dev": true,
       "license": "ISC"
     },
@@ -12545,9 +12545,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.4.40",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.40.tgz",
-      "integrity": "sha512-YF2kKIUzAofPMpfH6hOi2cGnv/HrUlfucspc7pDyvv7kGdqXrfj8SCl/t8owkEgKEuu8ZcRjSOxFxVLqwChZ2Q==",
+      "version": "8.5.3",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.3.tgz",
+      "integrity": "sha512-dle9A3yYxlBSrt8Fu+IpjGT8SY8hN0mlaA6GY8t0P5PjIOZemULz/E2Bnm/2dcUOena75OTNkHI76uZBNUUq3A==",
       "dev": true,
       "funding": [
         {
@@ -12565,9 +12565,9 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.7",
-        "picocolors": "^1.0.1",
-        "source-map-js": "^1.2.0"
+        "nanoid": "^3.3.8",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
       },
       "engines": {
         "node": "^10 || ^12 || >=14"
@@ -13245,9 +13245,9 @@
       }
     },
     "node_modules/prebuild-install/node_modules/tar-fs": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.3.tgz",
-      "integrity": "sha512-090nwYJDmlhwFwEW3QQl+vaNnxsO2yVsd45eTKRBzSzu+hlb1w2K9inVq5b0ngXuLVqQ4ApvsUHHnu/zQNkWAg==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
+      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
       "license": "MIT",
       "dependencies": {
         "chownr": "^1.1.1",
@@ -14327,10 +14327,11 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.0.tgz",
-      "integrity": "sha512-itJW8lvSA0TXEphiRoawsCksnlf8SyvmFzIhltqAHluXd88pkCd+cXJVHTDwdCr0IzwptSm035IHQktUu1QUMg==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
       "dev": true,
+      "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
       }
@@ -14994,9 +14995,9 @@
       }
     },
     "node_modules/tar-fs": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-3.1.0.tgz",
-      "integrity": "sha512-5Mty5y/sOF1YWj1J6GiBodjlDc05CUR8PKXrsnFAiSG0xA+GHeWLovaZPYUDXkH/1iKRf2+M5+OrRgzC7O9b7w==",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-3.1.1.tgz",
+      "integrity": "sha512-LZA0oaPOc2fVo82Txf3gw+AkEd38szODlptMYejQUhndHMLQ9M059uXR+AfS7DNo0NpINvSqDsvyaCrBVkptWg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16659,9 +16660,9 @@
       "dev": true
     },
     "node_modules/xml2js": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.6.1.tgz",
-      "integrity": "sha512-wksiZCYEDvrdwNhv1OIp0IALJdxWF9/ykG85DRkTLjqLIkcadRZxY05dwOX+zTM9aK+7rmtbNRnf3nC7MEqcvQ==",
+      "version": "0.6.2",
+      "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.6.2.tgz",
+      "integrity": "sha512-T4rieHaC1EXcES0Kxxj4JWgaUQHDk+qwHcYOCFHfiwKz7tOVPLq7Hjq9dM1WCMhylqMEfP7hMcOIChvotiZegA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/package.json b/package.json
index 960c0f093be6..98c27429a685 100644
--- a/package.json
+++ b/package.json
@@ -199,7 +199,7 @@
     "os-browserify": "^0.3.0",
     "p-all": "^1.0.0",
     "path-browserify": "^1.0.1",
-    "postcss": "^8.4.40",
+    "postcss": "^8.5.3",
     "postcss-nesting": "^12.0.2",
     "pump": "^1.0.1",
     "rcedit": "^1.1.0",
@@ -219,7 +219,7 @@
     "webpack": "^5.94.0",
     "webpack-cli": "^5.1.4",
     "webpack-stream": "^7.0.0",
-    "xml2js": "^0.6.1",
+    "xml2js": "^0.6.2",
     "yaserver": "^0.4.0"
   },
   "overrides": {
diff --git a/remote/package-lock.json b/remote/package-lock.json
index 96ec8d454ce0..7996a5deea8b 100644
--- a/remote/package-lock.json
+++ b/remote/package-lock.json
@@ -1351,9 +1351,9 @@
       }
     },
     "node_modules/tar-fs": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.3.tgz",
-      "integrity": "sha512-090nwYJDmlhwFwEW3QQl+vaNnxsO2yVsd45eTKRBzSzu+hlb1w2K9inVq5b0ngXuLVqQ4ApvsUHHnu/zQNkWAg==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
+      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
       "license": "MIT",
       "dependencies": {
         "chownr": "^1.1.1",
diff --git a/src/vs/base/common/htmlContent.ts b/src/vs/base/common/htmlContent.ts
index 070103b838d2..4fa81895fa27 100644
--- a/src/vs/base/common/htmlContent.ts
+++ b/src/vs/base/common/htmlContent.ts
@@ -70,6 +70,7 @@ export class MarkdownString implements IMarkdownString {
 
 	appendText(value: string, newlineStyle: MarkdownStringTextNewlineStyle = MarkdownStringTextNewlineStyle.Paragraph): MarkdownString {
 		this.value += escapeMarkdownSyntaxTokens(this.supportThemeIcons ? escapeIcons(value) : value) // CodeQL [SM02383] The Markdown is fully sanitized after being rendered.
+			.replace(/\\/g, '\\\\') // Escape backslash characters
 			.replace(/([ \t]+)/g, (_match, g1) => '&nbsp;'.repeat(g1.length)) // CodeQL [SM02383] The Markdown is fully sanitized after being rendered.
 			.replace(/\>/gm, '\\>') // CodeQL [SM02383] The Markdown is fully sanitized after being rendered.
 			.replace(/\n/g, newlineStyle === MarkdownStringTextNewlineStyle.Break ? '\\\n' : '\n\n'); // CodeQL [SM02383] The Markdown is fully sanitized after being rendered.
diff --git a/src/vs/base/common/marked/marked.js b/src/vs/base/common/marked/marked.js
index b7b6ecccd163..d3f5308839b1 100644
--- a/src/vs/base/common/marked/marked.js
+++ b/src/vs/base/common/marked/marked.js
@@ -1008,7 +1008,7 @@ const html = edit('^ {0,3}(?:' // optional indentation
     .replace('tag', _tag)
     .replace('attribute', / +[a-zA-Z:_][\w.:-]*(?: *= *"[^"\n]*"| *= *'[^'\n]*'| *= *[^\s"'=<>`]+)?/)
     .getRegex();
-const paragraph = edit(_paragraph)
+const paragraph = edit(_paragraph, 'i') // <-- add 'i' flag for case-insensitivity
     .replace('hr', hr)
     .replace('heading', ' {0,3}#{1,6}(?:\\s|$)')
     .replace('|lheading', '') // setext headings don't interrupt commonmark paragraphs
@@ -1045,7 +1045,7 @@ const blockNormal = {
  */
 const gfmTable = edit('^ *([^\\n ].*)\\n' // Header
     + ' {0,3}((?:\\| *)?:?-+:? *(?:\\| *:?-+:? *)*(?:\\| *)?)' // Align
-    + '(?:\\n((?:(?! *\\n|hr|heading|blockquote|code|fences|list|html).*(?:\\n|$))*)\\n*|$)') // Cells
+    + '(?:\\n((?:(?! *\\n|hr|heading|blockquote|code|fences|list|html).*(?:\\n|$))*)\\n*|$)', 'i') // Cells: add case-insensitive flag
     .replace('hr', hr)
     .replace('heading', ' {0,3}#{1,6}(?:\\s|$)')
     .replace('blockquote', ' {0,3}>')
@@ -1058,7 +1058,7 @@ const gfmTable = edit('^ *([^\\n ].*)\\n' // Header
 const blockGfm = {
     ...blockNormal,
     table: gfmTable,
-    paragraph: edit(_paragraph)
+    paragraph: edit(_paragraph, 'i') // add case-insensitive flag
         .replace('hr', hr)
         .replace('heading', ' {0,3}#{1,6}(?:\\s|$)')
         .replace('|lheading', '') // setext headings don't interrupt commonmark paragraphs
@@ -1143,7 +1143,7 @@ const autolink = edit(/^<(scheme:[^\s\x00-\x1f<>]*|email)>/)
     .replace('scheme', /[a-zA-Z][a-zA-Z0-9+.-]{1,31}/)
     .replace('email', /[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+(@)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)+(?![-_])/)
     .getRegex();
-const _inlineComment = edit(_comment).replace('(?:-->|$)', '-->').getRegex();
+const _inlineComment = edit(_comment).replace('(?:-->|$)', '(?:-->|--!>|$)').getRegex();
 const tag = edit('^comment'
     + '|^</[a-zA-Z][\\w:-]*\\s*>' // self-closing tag
     + '|^<[a-zA-Z][\\w-]*(?:attribute)*?\\s*/?>' // open tag
diff --git a/src/vs/base/common/marshalling.ts b/src/vs/base/common/marshalling.ts
index 82fcd1234d09..f32bbd68ff30 100644
--- a/src/vs/base/common/marshalling.ts
+++ b/src/vs/base/common/marshalling.ts
@@ -33,6 +33,10 @@ function replacer(key: string, value: any): any {
 	return value;
 }
 
+// Utility function to escape RegExp special characters
+function escapeRegExp(string: string): string {
+	return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); // $& means the whole matched string
+}
 
 type Deserialize<T> = T extends UriComponents ? URI
 	: T extends VSBuffer ? VSBuffer
@@ -51,7 +55,7 @@ export function revive<T = any>(obj: any, depth = 0): Revived<T> {
 
 		switch ((<MarshalledObject>obj).$mid) {
 			case MarshalledId.Uri: return <any>URI.revive(obj);
-			case MarshalledId.Regexp: return <any>new RegExp(obj.source, obj.flags);
+			case MarshalledId.Regexp: return <any>new RegExp(escapeRegExp(obj.source), obj.flags);
 			case MarshalledId.Date: return <any>new Date(obj.source);
 		}
 
diff --git a/src/vs/base/common/objects.ts b/src/vs/base/common/objects.ts
index 94c2fb717d2b..20b08dbe69fb 100644
--- a/src/vs/base/common/objects.ts
+++ b/src/vs/base/common/objects.ts
@@ -93,6 +93,10 @@ export function mixin(destination: any, source: any, overwrite: boolean = true):
 
 	if (isObject(source)) {
 		Object.keys(source).forEach(key => {
+			if (key === '__proto__' || key === 'constructor') {
+				// Prevent prototype pollution
+				return;
+			}
 			if (key in destination) {
 				if (overwrite) {
 					if (isObject(destination[key]) && isObject(source[key])) {
diff --git a/src/vs/base/common/observableInternal/logging/debugger/utils.ts b/src/vs/base/common/observableInternal/logging/debugger/utils.ts
index 2648b82cffdd..10105b8f209f 100644
--- a/src/vs/base/common/observableInternal/logging/debugger/utils.ts
+++ b/src/vs/base/common/observableInternal/logging/debugger/utils.ts
@@ -96,6 +96,9 @@ export class Throttler implements IDisposable {
 
 export function deepAssign<T>(target: T, source: T): void {
 	for (const key in source) {
+		if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+			continue;
+		}
 		if (!!target[key] && typeof target[key] === 'object' && !!source[key] && typeof source[key] === 'object') {
 			deepAssign(target[key], source[key]);
 		} else {
@@ -106,6 +109,9 @@ export function deepAssign<T>(target: T, source: T): void {
 
 export function deepAssignDeleteNulls<T>(target: T, source: T): void {
 	for (const key in source) {
+
+			continue;
+		}
 		if (source[key] === null) {
 			delete target[key];
 		} else if (!!target[key] && typeof target[key] === 'object' && !!source[key] && typeof source[key] === 'object') {
diff --git a/src/vs/editor/common/config/editorOptions.ts b/src/vs/editor/common/config/editorOptions.ts
index 6388b3c386c8..d77ebf0f3bf4 100644
--- a/src/vs/editor/common/config/editorOptions.ts
+++ b/src/vs/editor/common/config/editorOptions.ts
@@ -1082,6 +1082,9 @@ function applyUpdate<T>(value: T | undefined, update: T): ApplyUpdateResult<T> {
 	let didChange = false;
 	for (const key in update) {
 		if ((update as T & object).hasOwnProperty(key)) {
+			if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+				continue;
+			}
 			const result = applyUpdate(value[key], update[key]);
 			if (result.didChange) {
 				value[key] = result.newValue;
diff --git a/src/vs/editor/contrib/smartSelect/test/browser/smartSelect.test.ts b/src/vs/editor/contrib/smartSelect/test/browser/smartSelect.test.ts
index 3e774fc932f4..ff60c2733b20 100644
--- a/src/vs/editor/contrib/smartSelect/test/browser/smartSelect.test.ts
+++ b/src/vs/editor/contrib/smartSelect/test/browser/smartSelect.test.ts
@@ -214,7 +214,7 @@ suite('SmartSelect', () => {
 
 	async function assertRanges(provider: SelectionRangeProvider, value: string, ...expected: IRange[]): Promise<void> {
 		const index = value.indexOf('|');
-		value = value.replace('|', ''); // CodeQL [SM02383] js/incomplete-sanitization this is purpose only the first | character
+		value = value.replace(/\|/g, ''); // Remove all '|' characters, not just the first
 
 		const model = modelService.createModel(value, new StaticLanguageSelector(languageId), URI.parse('fake:lang'));
 		const pos = model.getPositionAt(index);
diff --git a/src/vs/editor/test/common/modes/supports/indentationRules.ts b/src/vs/editor/test/common/modes/supports/indentationRules.ts
index 0967de48bff7..996d990d6696 100644
--- a/src/vs/editor/test/common/modes/supports/indentationRules.ts
+++ b/src/vs/editor/test/common/modes/supports/indentationRules.ts
@@ -27,7 +27,7 @@ export const goIndentationRules = {
 };
 
 export const htmlIndentationRules = {
-	decreaseIndentPattern: /^\s*(<\/(?!html)[-_\.A-Za-z0-9]+\b[^>]*>|-->|\})/,
+	decreaseIndentPattern: /^\s*(<\/(?!html)[-_\.A-Za-z0-9]+\b[^>]*>|--!?>|\})/,
 	increaseIndentPattern: /<(?!\?|(?:area|base|br|col|frame|hr|html|img|input|keygen|link|menuitem|meta|param|source|track|wbr)\b|[^>]*\/>)([-_\.A-Za-z0-9]+)(?=\s|>)\b[^>]*>(?!.*<\/\1>)|<!--(?!.*-->)|\{[^}"']*$/,
 };
 
diff --git a/src/vs/platform/languagePacks/node/languagePacks.ts b/src/vs/platform/languagePacks/node/languagePacks.ts
index 9527de9f2c3d..f666ed0ddb19 100644
--- a/src/vs/platform/languagePacks/node/languagePacks.ts
+++ b/src/vs/platform/languagePacks/node/languagePacks.ts
@@ -170,11 +170,11 @@ class LanguagePacksCache extends Disposable {
 
 	private updateHash(languagePack: ILanguagePack): void {
 		if (languagePack) {
-			const md5 = createHash('md5'); // CodeQL [SM04514] Used to create an hash for language pack extension version, which is not a security issue
+			const sha256 = createHash('sha256'); // Secure hash algorithm for language pack extension version
 			for (const extension of languagePack.extensions) {
-				md5.update(extension.extensionIdentifier.uuid || extension.extensionIdentifier.id).update(extension.version); // CodeQL [SM01510] The extension UUID is not sensitive info and is not manually created by a user
+				sha256.update(extension.extensionIdentifier.uuid || extension.extensionIdentifier.id).update(extension.version); // Using secure hash for identifier
 			}
-			languagePack.hash = md5.digest('hex');
+			languagePack.hash = sha256.digest('hex');
 		}
 	}
 
diff --git a/src/vs/workbench/api/node/extHostCLIServer.ts b/src/vs/workbench/api/node/extHostCLIServer.ts
index 01bc190d579f..0b040acb868a 100644
--- a/src/vs/workbench/api/node/extHostCLIServer.ts
+++ b/src/vs/workbench/api/node/extHostCLIServer.ts
@@ -112,8 +112,7 @@ export class CLIServerBase {
 				}
 				sendResponse(200, returnObj);
 			} catch (e) {
-				const message = e instanceof Error ? e.message : JSON.stringify(e);
-				sendResponse(500, message);
+				sendResponse(500, "An internal server error occurred.");
 				this.logService.error('Error while processing pipe request', e);
 			}
 		});
diff --git a/src/vs/workbench/contrib/debug/node/debugAdapter.ts b/src/vs/workbench/contrib/debug/node/debugAdapter.ts
index 4892338a1c1a..c6cdb3c6979e 100644
--- a/src/vs/workbench/contrib/debug/node/debugAdapter.ts
+++ b/src/vs/workbench/contrib/debug/node/debugAdapter.ts
@@ -240,7 +240,10 @@ export class ExecutableDebugAdapter extends StreamDebugAdapter {
 					spawnOptions.shell = true;
 					spawnCommand = `"${command}"`;
 					spawnArgs = args.map(a => {
-						a = a.replace(/"/g, '\\"'); // Escape existing double quotes with \
+						// Escape backslashes first
+						a = a.replace(/\\/g, '\\\\');
+						// Then escape double quotes
+						a = a.replace(/"/g, '\\"');
 						// Wrap in double quotes
 						return `"${a}"`;
 					});
diff --git a/src/vs/workbench/contrib/files/browser/fileActions.ts b/src/vs/workbench/contrib/files/browser/fileActions.ts
index 50f786ea2f7e..bc7f9549458a 100644
--- a/src/vs/workbench/contrib/files/browser/fileActions.ts
+++ b/src/vs/workbench/contrib/files/browser/fileActions.ts
@@ -756,7 +756,7 @@ export function validateFileName(pathService: IPathService, item: ExplorerItem,
 	// Check for invalid file name.
 	if (names.some(folderName => !pathService.hasValidBasename(item.resource, os, folderName))) {
 		// Escape * characters
-		const escapedName = name.replace(/\*/g, '\\*'); // CodeQL [SM02383] This only processes filenames which are enforced against having backslashes in them farther up in the stack.
+		const escapedName = name.replace(/\\/g, '\\\\').replace(/\*/g, '\\*'); // Escapes backslashes first, then asterisks.
 		return {
 			content: nls.localize('invalidFileNameError', "The name **{0}** is not valid as a file or folder name. Please choose a different name.", trimLongName(escapedName)),
 			severity: Severity.Error
diff --git a/src/vs/workbench/contrib/replNotebook/browser/replEditorInput.ts b/src/vs/workbench/contrib/replNotebook/browser/replEditorInput.ts
index 271af8eac541..eb0dc144a1a0 100644
--- a/src/vs/workbench/contrib/replNotebook/browser/replEditorInput.ts
+++ b/src/vs/workbench/contrib/replNotebook/browser/replEditorInput.ts
@@ -69,7 +69,7 @@ export class ReplEditorInput extends NotebookEditorInput implements ICompositeNo
 		}
 
 		if (resource.scheme === 'untitled') {
-			const match = new RegExp('Untitled-(\\d+)\.').exec(resource.path);
+			const match = new RegExp('Untitled-(\\d+)\\.').exec(resource.path);
 			if (match?.length === 2) {
 				return `REPL - ${match[1]}`;
 			}
diff --git a/src/vs/workbench/contrib/terminal/browser/terminalProfileQuickpick.ts b/src/vs/workbench/contrib/terminal/browser/terminalProfileQuickpick.ts
index eff79840baf6..78f4ea23fede 100644
--- a/src/vs/workbench/contrib/terminal/browser/terminalProfileQuickpick.ts
+++ b/src/vs/workbench/contrib/terminal/browser/terminalProfileQuickpick.ts
@@ -275,7 +275,7 @@ export class TerminalProfileQuickpick {
 			}
 			const argsString = profile.args.map(e => {
 				if (e.includes(' ')) {
-					return `"${e.replace(/"/g, '\\"')}"`; // CodeQL [SM02383] js/incomplete-sanitization This is only used as a label on the UI so this isn't a problem
+					return `"${e.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`; // First escape backslashes, then quotes for correct display
 				}
 				return e;
 			}).join(' ');