diff --git a/package-lock.json b/package-lock.json
index 9258bd05..2e651c5f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1670,15 +1670,15 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.7",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
-      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "version": "5.0.8",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/braces": {
diff --git a/test/test-integration.mjs b/test/test-integration.mjs
index 2d8e4fd3..80b7d586 100644
--- a/test/test-integration.mjs
+++ b/test/test-integration.mjs
@@ -31,13 +31,25 @@ describe('integration tests', { timeout: 12 * 60 * 1000 }, () => {
 	}
 
 	async function checkAudit(cwd) {
+		// Known vulnerabilities with no fix available that are ignored temporarily
+		const ignoredAdvisories = [
+			'https://github.com/advisories/GHSA-73rr-hh4g-fpgx', // diff vulnerability
+			'https://github.com/advisories/GHSA-mh99-v99m-4gvg', // brace-expansion vulnerability in @vscode/test-cli → mocha
+		];
 
 		const resAudit = await doSpawn(npmCommand, ['audit'], { cwd: cwd, shell: true });
 		if (resAudit.exitCode !== 0) {
-			if (resAudit.stdout.indexOf('https://github.com/advisories/GHSA-73rr-hh4g-fpgx') === -1) { // diff vulnerability
+			const isAuditReport = resAudit.stdout.includes('# npm audit report');
+			if (!isAuditReport) {
+				assert.fail(`npm audit failed: stdout ${resAudit.stdout} stderr ${resAudit.stderr}`);
+			}
+			const advisoryPattern = /https:\/\/github\.com\/advisories\/GHSA-[a-z0-9-]+/g;
+			const foundAdvisories = [...new Set(resAudit.stdout.match(advisoryPattern) || [])];
+			const unknownAdvisories = foundAdvisories.filter(url => !ignoredAdvisories.includes(url));
+			if (unknownAdvisories.length > 0) {
 				assert.fail(`npm audit failed: stdout ${resAudit.stdout} stderr ${resAudit.stderr}`);
 			} else {
-				console.warn('npm audit vulnerability for `diff` ignored for now, waiting for a dependency update');
+				console.warn(`npm audit vulnerabilities ignored for now, waiting for a dependency update: ${foundAdvisories.join(', ')}`);
 			}
 		}
 	}