Skip to content

chore(deps)!: upgrade to Node 24 LTS & VS Code ^1.140.0, bump dev dependencies - #605

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/dependencies-fc9ef02dd5
Open

dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/dependencies-fc9ef02dd5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 22, 2026 •

Copy link
Copy Markdown
Contributor

Maintainer updates

Following review feedback ("upgrade node to latest LTS and vs code to latest"), on top of Dependabot's bumps:

  • Node.js 24 (current LTS): CI (main, publish, dryrun-publish, upload-artifact action), mise.toml, client engines, and docs/RELEASING.md.
  • VS Code ^1.140.0: engines.vscode (root + client) now matches the latest @types/vscode (1.140.0). It was ^1.75.0, already below vscode-languageclient@10's ^1.91.0 requirement.
  • Lint fix: kept @eslint/js on v9 to match eslint 9 (ESLint 10 is intentionally held back in dependabot.yaml), and added @eslint/js to the same dependabot ignore/exclude rules so they stay in lockstep.
  • vsce 4 / ovsx 1.3: synced the pinned verify-pat versions in publish.yaml and added a Node 24 setup step (vsce 4 requires Node >= 22).
  • mocha 12: it's now an ESM package ("type": "module"), so webpack bundled the UMD mocha/mocha.js as ESM. In the web extension host it then overwrote the test runner's module.exports, so the tests failed. Added a webpack rule to parse it as CommonJS.

Marked breaking (!) because of the VS Code minimum. With bump-minor-pre-major, release-please will cut 0.3.0, so we stay pre-1.0.

Verified locally on Node 24.22.1: npm ci, npm run lint, npm run compile, vsce package, plus test-node and test-web-headless (6/6 passing each) against VS Code 1.143.1.


Bumps the dependencies group with 9 updates in the / directory:

Package From To
@eslint/js 9.39.5 10.0.1
@types/node 25.9.6 26.6.5
@vscode/vsce 3.9.2 4.0.0
globals 15.15.0 17.13.0
mocha 11.8.0 12.0.3
ovsx 1.1.1 1.3.0
prettier 3.9.6 3.9.10
typescript-eslint 8.68.0 8.71.2
webpack 5.110.1 5.112.0

Updates @eslint/js from 9.39.5 to 10.0.1

Release notes

Sourced from @​eslint/js's releases.

v10.0.1

Bug Fixes

  • c87d5bd fix: update eslint (#20531) (renovate[bot])
  • d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)
  • 04c2147 fix: update error message for unused suppressions (#20496) (fnx)
  • 38b089c fix: update dependency @​eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

  • 5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)
  • 6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)
  • b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

  • e5c281f chore: updates for v9.39.3 release (Jenkins)
  • 8c3832a chore: update @​typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)
  • 8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)
  • 37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)
  • da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)
  • 84fb885 chore: package.json update for @​eslint/js release (Jenkins)
  • 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

  • f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)
  • a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)
  • c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)
  • fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)
  • 3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)
  • 501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])
  • ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)
  • 96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)
  • c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)
  • 208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)
  • a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)
  • a89059d feat!: Program range span entire source text (#20133) (Pixel998)
  • 39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)
  • f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)
  • aa3fb2b fix!: tighten func-names schema (#20119) (Pixel998)
  • f6c0ed0 feat!: report eslint-env comments as errors (#20128) (Francesco Trotta)
  • 4bf739f fix!: remove deprecated LintMessage#nodeType and TestCaseError#type (#20096) (Pixel998)
  • 523c076 feat!: drop support for jiti < 2.2.0 (#20016) (michael faith)
  • 454a292 feat!: update eslint:recommended configuration (#20210) (Pixel998)
  • 4f880ee feat!: remove v10_* and inactive unstable_* flags (#20225) (sethamus)
  • f18115c feat!: no-shadow-restricted-names report globalThis by default (#20027) (sethamus)
  • c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160) (Milos Djermanovic)

Features

  • bff9091 feat: handle Array.fromAsync in array-callback-return (#20457) (Francesco Trotta)
  • 290c594 feat: add self to no-implied-eval rule (#20468) (sethamus)
  • 43677de feat: fix handling of function and class expression names in no-shadow (#20432) (Milos Djermanovic)

... (truncated)

Commits
  • 84fb885 chore: package.json update for @​eslint/js release
  • 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467)
  • f3fbc2f chore: set @eslint/js version to 10.0.0 to skip releasing it (#20466)
  • b4b3127 chore: package.json update for @​eslint/js release
  • 0b14059 chore: package.json update for @​eslint/js release
  • fa31a60 feat!: add name to configs (#20015)
  • 1e2cad5 chore: package.json update for @​eslint/js release
  • 454a292 feat!: update eslint:recommended configuration (#20210)
  • c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160)
  • See full diff in compare view

Updates @types/node from 25.9.6 to 26.6.5

Commits

Updates @vscode/vsce from 3.9.2 to 4.0.0

Commits
  • 9f25124 Merge pull request #1329 from microsoft/benibenj/migrate-legacy-pat-storage
  • 7d84e92 Offer prompted migration of legacy PAT credentials
  • 75cae44 Merge pull request #1325 from jakebailey/remove-leven
  • ae9f2b7 Merge pull request #1324 from jakebailey/remove-form-data
  • fa08d59 Capture both output streams in the CLI tests
  • 3fb79d8 Fix multipart stream lifecycle issues
  • bee68cf Extract command suggestion helper and test it
  • b40452e Merge pull request #1326 from microsoft/benibenj/agents/validate-package-lock...
  • d2cd4d4 Keep PR CI workflow unchanged
  • fa0fdf7 Fix MSAL declaration build failure
  • Additional commits viewable in compare view

Updates globals from 15.15.0 to 17.13.0

Release notes

Sourced from globals's releases.

v17.13.0

  • Update globals (2026-10-01) (#354) b007369

sindresorhus/globals@v17.12.0...v17.13.0

v17.12.0

  • Update globals (2026-09-01) (#353) 50a2119
  • Add __webpack_layer__ global (#351) 779a11a

sindresorhus/globals@v17.11.0...v17.12.0

v17.11.0

  • Add react-native globals (#337) 61eafbf

sindresorhus/globals@v17.10.0...v17.11.0

v17.10.0

  • Add GM_cookie to Greasemonkey globals (#349) f468407

sindresorhus/globals@v17.9.0...v17.10.0

v17.9.0

  • Update globals (2026-08-01) (#348) 5a958ed

sindresorhus/globals@v17.8.0...v17.9.0

v17.8.0

  • Update globals (2026-07-01) (#347) 7394811

sindresorhus/globals@v17.7.0...v17.8.0

v17.7.0

  • Update globals (2026-06-22) (#345) 33b75f9

sindresorhus/globals@v17.6.0...v17.7.0

... (truncated)

Commits

Updates mocha from 11.8.0 to 12.0.3

Release notes

Sourced from mocha's releases.

v12.0.3

12.0.3 (2026-10-01)

🩹 Fixes

  • keep watching when the last test file is removed (#6355) (921c161)
  • show require() error on unsupported directory import (#6354) (a68344f)
  • support --X one-char aliases (#6391) (1227939)

📚 Documentation

🧹 Chores

v12.0.2

12.0.2 (2026-09-17)

🩹 Fixes

  • fail nested tests on beforeEach failure (#6292) (a75b43b)
  • give CLI reporter-option precedence over config file (#6331) (571110f)
  • propagate spec file path on parallel worker death (#6268) (55a544a)
  • use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
  • watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

🧹 Chores

  • add "stale branch" workflow (#6315) (ad17f9f)
  • add dependency conflict detection workflow (#6246) (ef0ae32)
  • add folder for reproducing issues (#6330) (6728030)
  • add stale triage reminder for unreviewed issues (#6314) (ee35133)
  • auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
  • convert file-unloader to ESM (#6294) (dc73f4c)
  • deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
  • deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)

... (truncated)

Changelog

Sourced from mocha's changelog.

12.0.3 (2026-10-01)

🩹 Fixes

  • keep watching when the last test file is removed (#6355) (921c161)
  • show require() error on unsupported directory import (#6354) (a68344f)
  • support --X one-char aliases (#6391) (1227939)

📚 Documentation

🧹 Chores

12.0.2 (2026-09-17)

🩹 Fixes

  • fail nested tests on beforeEach failure (#6292) (a75b43b)
  • give CLI reporter-option precedence over config file (#6331) (571110f)
  • propagate spec file path on parallel worker death (#6268) (55a544a)
  • use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
  • watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

🧹 Chores

  • add "stale branch" workflow (#6315) (ad17f9f)
  • add dependency conflict detection workflow (#6246) (ef0ae32)
  • add folder for reproducing issues (#6330) (6728030)
  • add stale triage reminder for unreviewed issues (#6314) (ee35133)
  • auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
  • convert file-unloader to ESM (#6294) (dc73f4c)
  • deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
  • deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)
  • deps: update dependency knip to v6.35.0 (#6324) (a2416af)
  • deps: update octoguide/bot action to v0.23.0 (#6304) (bbe5a27)

... (truncated)

Commits
  • 51a0cc5 chore(main): release 12.0.3 (#6353)
  • 1227939 fix: support --X one-char aliases (#6391)
  • bb2e69a docs: refresh help output, fix stale links (#6357)
  • 921c161 fix: keep watching when the last test file is removed (#6355)
  • 3382fdd test: add --import=tsx integration test (#6356)
  • a68344f fix: show require() error on unsupported directory import (#6354)
  • d59467a test: touch a new file without stamping it afterwards (#6349)
  • 70db1c7 chore(main): release 12.0.2 (#6300)
  • 571110f fix: give CLI reporter-option precedence over config file (#6331)
  • a652ff5 fix: use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342)
  • Additional commits viewable in compare view

Updates ovsx from 1.1.1 to 1.3.0

Release notes

Sourced from ovsx's releases.

CLI v1.3.0

Added

  • Add --follow-symlinks to publish, forwarding vsce's option of the same name so that the file walk recurses into symlinked directories instead of packing each symlink as a file. Needed for a node_modules assembled out of symlinks, as pnpm's is (#368)
  • Add search command to search the registry for extensions, mirroring the web UI's search: --category, --target, --sort-by and --sort-order narrow the query, --size and --offset page through the results, and --json prints the registry's raw response (#2154)
  • Add list command to print the extensions a namespace holds, sorted by name so the output stays stable across registries, with --json for the raw namespace metadata (#2154)
  • Add show command to print an extension's metadata, mirroring vsce show: identity, publisher, rating, notices and a version history listing each version's target platforms (#2149). namespace.extension@version reports a single version, --target scopes the report to one target platform, --all-versions lists every published version instead of the most recent few, and --json prints the registry's raw metadata
  • Add unpublish command to delete an extension or some of its versions, mirroring vsce unpublish (#1958); requires a registry running version 1.2.0 or later, which unpublish checks for before deleting
  • publish checks the packaged extension's size against the limit reported by the registry's /api/version endpoint before uploading, instead of failing only after the upload completes (#1953)
  • Add verify command to check a downloaded .vsix package's signature against the registry's public key, mirroring vsce verify-signature (#993)
  • Add verify-signature command, verifying an already-extracted package/manifest/signature file trio entirely offline (no registry involved), matching vsce verify-signature's own command shape (#993)

Fixed

  • Error messages naming a URL no longer include its query string, which for createNamespace, verifyPat, publish and delete carried the personal access token straight to stderr and into CI logs (#2186)

  • A connection lost after a JSON response has started no longer leaves the command waiting on a body that is not coming: the response's own error is now what settles the request, so it fails with the reset rather than hanging (#2186)

  • Requests now give up after 30 seconds without progress instead of hanging indefinitely when a server accepts a connection and then says nothing. OVSX_TIMEOUT overrides the duration in milliseconds and OVSX_TIMEOUT=0 disables it; it measures inactivity, so a large extension downloading slowly is unaffected, and it covers the trusted-publishing ID token request as well as the registry's own (#2186)

  • Fix downloads that could be read before they were written. download resolved when the response ended rather than when the file was closed, and a write stream opens and flushes asynchronously, so a caller reading the path immediately afterwards could find the file empty or absent - which verify did, intermittently failing to read the public key it had just fetched. A failed download no longer touches the target path: the body is written beside it and renamed into place only once it has arrived whole, so a 404 or a dropped connection leaves what was there alone. A connection dropped mid-download now rejects rather than leaving the caller waiting forever (#2185)

Changed

  • createNamespace, verifyPat, publish and delete now send the personal access token primarily via an Authorization: Bearer header (or, when OVSX_USERNAME/OVSX_PASSWORD are set, an X-OpenVSX-Token header, since Authorization is then already in use for Basic auth to a fronting proxy), moving away from a token query parameter that gets recorded in server and reverse-proxy access logs. The CLI checks the registry's reported version (/api/version) and only still sends the token as a query parameter, alongside the header, when talking to a registry older than 1.3.0, i.e. one that predates header support - including one whose version can't be determined at all, which is treated as too old rather than assumed to be caught up; on 1.3.0 and later the header is all it sends (#1344)
  • publish --trusted-publishing retries the token exchange when the registry answers that it could not verify the ID token (502, 503, 504), rather than failing the build on a blip reaching the identity provider. A refusal is never retried
  • publish --trusted-publishing requests a new token and retries once when the registry refuses the one it was publishing with. The issued token is short-lived and shared by every target platform of a release, so publishing a wide fan-out of large packages could outlive it and fail partway through. Targets that are refused together share one new token, and a token supplied with --pat is never retried
  • Bump minimum supported Node.js version to 22, matching the webui component

Dependencies

  • Bump fast-uri from 3.1.5 to 3.1.7
  • Bump qs from 6.15.2 to 6.16.0
  • Bump @​humanfs/node from 0.16.6 to 0.16.8
  • Bump js-yaml from 4.3.1 to 4.3.2
  • Bump nanoid from 3.3.16 to 3.3.18

Frontend Library v1.3.0

Added

  • Add a /publish page and turn the navbar's Publish button into a drop target: a file drag anywhere in the app turns the button into a drop area, and every .vsix package dropped on it — or on the publish page's own drop area — is queued and uploaded straight away, with no confirmation dialog. The page shows the queue as a line of extension cards — a skeleton while a package uploads, the real card once the registry accepts it, labelled with whatever the registry did with it — and keeps polling anything left under review or still missing its icon
  • Export PublishButton, which carries the publish link, its p shortcut and the app's .vsix drop target in one component, so a deployment with its own menu content keeps drag-and-drop publishing
  • Add a "Data Consistency" page to the admin dashboard (#1622): a live overview of every registered consistency check's finding count, with actions to refresh it and to fix findings one at a time or all at once
  • Show a "Namespace not verified" state on an extension card when it can't be activated because its namespace already exists in a referenced external gallery and hasn't been verified, in both the "My Extensions" and namespace member extension lists. The card keeps its colour and takes a warning-toned frame and icon, since this is the publisher's to fix rather than an extension that is simply switched off
  • Show a warning notice with a claim action wherever an unverified namespace is holding something back — the extension settings page when the extension has a namespace ownership conflict, and the namespace settings page for any unverified namespace — making clear the namespace must be claimed (verified) first. The action is the deployment's configured elements.claimNamespace, falling back to the namespace access documentation when none is configured. The admin dashboard's extension and namespace views show the same explanation without the claim action, since claiming is the publisher's action to take, not an admin's on someone else's behalf
  • Add a "Search Index" page to the admin dashboard: which engine answers searches, how many extensions the index holds against how many it is built from, and a button to rebuild it where there is an index to rebuild. The two counts sit side by side because an index that has quietly lost entries answers searches perfectly well, just with nothing in them, which is indistinguishable from an empty registry unless both numbers are visible at once
  • Mark a version that was published through a trusted publishing workflow with an icon next to "Published by" on the extension detail page, linking to the deployment's trusted publishing documentation. The default deployment points that link at the Trusted Publishing wiki page
  • Add a Pill component — the clickable glass pill the category pills are built on, now usable on its own — and extract the MonoSlash, glassSurface and compactControl page primitives out of the search field, the pills and the search header
  • Add userLoading to MainContext, so custom pages can tell "not logged in" from "still resolving the user"
  • Add a userMenuContent slot to PageSettings.elements: extra entries for the logged-in account menu, rendered above the admin entry. The slot receives a MenuEntry component to build entries with, so each entry is styled by the menu it appears in — the desktop and mobile menus style theirs differently, and a consumer cannot match both on its own
  • Add an adminPages slot to PageSettings.elements: extra admin dashboard pages, each declaring a name, icon, optional description and optional category, and each appearing in the side panel, as a card on the dashboard overview and as a route. Contributions are additive — a category name matching a built-in group appends to it, and a page whose path would shadow a built-in one is ignored
  • Widen the published API for consumers building their own pages: the request layer (sendRequest, sendNonRetriableRequest, ErrorResponse, controllerFromSignal), MainContext, AppProviders, NotFound, createDefaultTheme with the MONO_FONT/NAVBAR_HEIGHT tokens, the createRoute/createAbsoluteURL/addQuery/formatCompactNumber/toRelativeTime utils, the useDebouncedCallback and useGridCursor hooks, the navbar-chrome, search-focus and page-search-bar hooks, the category icon helpers, ExtensionDetailRoutes, and the itemIcon/MenuItemText building blocks for userMenuContent entries

... (truncated)

Changelog

Sourced from ovsx's changelog.

[1.3.0] - 2026-10-16

Changed

  • publish checks a package against the size limit that applies to its own namespace, which a size override can raise above the registry default, and refuses an oversized upload before sending it. Against a registry older than 1.3.0, which cannot report that limit, it warns against the default and publishes anyway; if a registry that should be able to report it does not answer, it says the check did not happen rather than passing silently (#2129)

Fixed

  • --version reads the version from package.json at runtime instead of a generated src/version.ts, so it can no longer report a stale version (#2295)
  • publish now deletes the .vsix it packages into the temp directory once publishing finishes or fails, instead of leaving one behind per package and target (#2286)
  • Drop the X-OpenVSX-Token header, which carries the personal access token when --username/--password are set, on a redirect to another origin, as is done for Authorization (#2309)
  • A request with a body that is redirected with 301/302/303 now fails with an error naming the redirect target, instead of being resent as a GET without its body (#2309)
  • Trusted publishing's OIDC ID token request now uses the registry client's request handling: it follows redirects (dropping the runner token on a redirect to another origin) and reports the token service's error message instead of only its status (#2322)
  • An HTML page in a successful response (any <!doctype html> casing, or a text/html Content-Type) now fails with an error naming the status, instead of printing the raw HTML or a JSON SyntaxError (#2326)
  • An error response whose JSON body starts with whitespace now reports the server's message instead of only its status (#2326)

Dependencies

  • Bump commander from 6.2.1 to 14.0.3; a command given more arguments than it takes now fails instead of ignoring the extras (#2294)
  • Bump @​vscode/vsce from 3.7.1 to 4.0.0 (#2288)
  • Bump vitest from 4.1.11 to 5.0.3, adding vite as a direct dev dependency - vitest 5 no longer bundles it, only requires it as a peer (#2291)
  • Remove leven; the command-suggestion distance check now uses a vendored Levenshtein implementation, the same way @vscode/vsce itself replaced its own leven dependency in 4.0.0 (#2290)
  • Remove tmp; temporary file names are now generated with crypto.randomUUID (#2284)
  • Remove follow-redirects; requests use node:http/node:https and the registry client follows redirects itself (#2309)
  • Bump ip-address from 10.4.0 to 10.7.2 (#2264)
  • Bump brace-expansion to 1.1.21, 2.1.7, 5.0.12
  • Bump markdown-it from 14.2.0 to 14.3.2 (#2281)

[v1.2.0] - 2026-09-10

Added

  • Add --follow-symlinks to publish, forwarding vsce's option of the same name so that the file walk recurses into symlinked directories instead of packing each symlink as a file. Needed for a node_modules assembled out of symlinks, as pnpm's is (#368)
  • Add search command to search the registry for extensions, mirroring the web UI's search: --category, --target, --sort-by and --sort-order narrow the query, --size and --offset page through the results, and --json prints the registry's raw response (#2154)
  • Add list command to print the extensions a namespace holds, sorted by name so the output stays stable across registries, with --json for the raw namespace metadata (#2154)
  • Add show command to print an extension's metadata, mirroring vsce show: identity, publisher, rating, notices and a version history listing each version's target platforms (#2149). namespace.extension@version reports a single version, --target scopes the report to one target platform, --all-versions lists every published version instead of the most recent few, and --json prints the registry's raw metadata
  • Add unpublish command to delete an extension or some of its versions, mirroring vsce unpublish (#1958); requires a registry running version 1.2.0 or later, which unpublish checks for before deleting
  • publish checks the packaged extension's size against the limit reported by the registry's /api/version endpoint before uploading, instead of failing only after the upload completes (#1953)
  • Add verify command to check a downloaded .vsix package's signature against the registry's public key, mirroring vsce verify-signature (#993)
  • Add verify-signature command, verifying an already-extracted package/manifest/signature file trio entirely offline (no registry involved), matching vsce verify-signature's own command shape (#993)

Fixed

  • Error messages naming a URL no longer include its query string, which for createNamespace, verifyPat, publish and delete carried the personal access token straight to stderr and into CI logs (#2186)

  • A connection lost after a JSON response has started no longer leaves the command waiting on a body that is not coming: the response's own error is now what settles the request, so it fails with the reset rather than hanging (#2186)

  • Requests now give up after 30 seconds without progress instead of hanging indefinitely when a server accepts a connection and then says nothing. OVSX_TIMEOUT overrides the duration in milliseconds and OVSX_TIMEOUT=0 disables it; it measures inactivity, so a large extension downloading slowly is unaffected, and it covers the trusted-publishing ID token request as well as the registry's own (#2186)

  • Fix downloads that could be read before they were written. download resolved when the response ended rather than when the file was closed, and a write stream opens and flushes asynchronously, so a caller reading the path immediately afterwards could find the file empty or absent - which verify did, intermittently failing to read the public key it had just fetched. A failed download no longer touches the target path: the body is written beside it and renamed into place only once it has arrived whole, so a 404 or a dropped connection leaves what was there alone. A connection dropped mid-download now rejects rather than leaving the caller waiting forever (#2185)

Changed

... (truncated)

Commits
  • e0b958f chore: prepare for cli 1.3.0 release
  • 106e81b docs: tidy the 1.3.0 release notes (#2344)
  • 5d26c73 docs: use Keep a Changelog headings in all change logs (#2343)
  • 5f2de6f fix(cli): handle HTML and whitespace-prefixed JSON responses (#2326)
  • fc539ff fix(cli): share registry request handling with OIDC (#2322)
  • 418cf1a chore(cli): use stream/consumers buffer() in readZip (#2319)
  • 729edb9 chore(cli): replace util fs callback wrappers with fs.promises (#2310)
  • bf689ad chore(cli): replace follow-redirects with node:http (#2309)
  • f8b2c5c chore(deps): bump commander from 6.2.1 to 14.0.3 in cli (#2294)
  • a81414a fix(cli): read the version from package.json at runtime (#2295)
  • Additional commits viewable in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates prettier from 3.9.6 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

  • Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

3.9.9

  • Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

🔗 Changelog

3.9.8

  • Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

3.9.7

  • Support Angular 22.2
  • Fix regressions in v3.9

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

3.9.9

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 22, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner September 22, 2026 19:43
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 22, 2026
@socket-security

socket-security Bot commented Sep 22, 2026 •

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedovsx@​1.1.1 ⏵ 1.3.098100100 +1195 -170
Updatedtypescript-eslint@​8.68.0 ⏵ 8.71.2100 +110074 +198100
Updatedwebpack@​5.110.1 ⏵ 5.112.081 -1210093 +199100
Updated@​types/​node@​25.9.6 ⏵ 26.6.5100 +110081 +195 -1100
Updatedglobals@​15.15.0 ⏵ 17.13.010010086 +194100
Updatedmocha@​11.8.0 ⏵ 12.0.3971009595 +1100
Updated@​vscode/​vsce@​3.9.2 ⏵ 4.0.096100100 +598 +1100
Updatedprettier@​3.9.6 ⏵ 3.9.109810097 +197100

View full report

@socket-security

socket-security Bot commented Sep 22, 2026 •

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
Low priority
License policy violation: npm @vscode/vsce-sign under ms-xamarin-uitest3.2.0

License: ms-xamarin-uitest3.2.0 - The applicable license policy does not permit this license (5) (package/LICENSE.txt)

From: package-lock.json → npm/@vscode/vsce@4.0.0 → npm/@vscode/vsce-sign@2.1.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vscode/vsce-sign@2.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
License policy violation: npm ovsx under EPL-2.0

License: EPL-2.0 - The applicable license policy does not permit this license (5) (npm metadata)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/create-namespace.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/create-namespace.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/create-namespace.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-pat.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-pat.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/verify-pat.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/get.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/get.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/main.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/main.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/util.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/util.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/get.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/main.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/util.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/check-license.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/create-namespace-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/create-namespace-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/create-namespace-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/login-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/logout.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/login-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/login.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/logout.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/store.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/zip.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-pat-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-pat-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/verify-pat-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/get-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/get-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/publish-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/registry-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/registry-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/get-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/publish-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/registry-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/pat.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/index.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/pat.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/store.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/store.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/login.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-signature-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/verify-signature-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-signature.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/search.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/search-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/list.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/trusted-publishing-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-signature.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/search-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/table.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/table.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/show-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/show.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/table.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/list.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/trusted-publishing.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/show.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/zip.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/oidc.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/show-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/unpublish-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/list-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/unpublish-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/search-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/list.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/trusted-publishing.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/trusted-publishing.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/list-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/index.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/oidc.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/verify-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/unpublish-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/unpublish.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/show.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/trusted-publishing-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/index.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/search.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/trusted-publishing-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/show-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-signature-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/verify-signature.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/oidc.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/search.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/list-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/verify.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/unpublish.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/unpublish.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/check-license.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/publish.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/registry.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/http.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/registry.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/package.json)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/check-license.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/http.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/registry.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/http.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/publish.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/LICENSE)

From: package-lock.json → npm/ovsx@1.3.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ovsx@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn

View full report

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-fc9ef02dd5 branch 3 times, most recently from 64303ca to eca3e2a Compare September 29, 2026 19:44
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-fc9ef02dd5 branch from eca3e2a to 5eaad6b Compare October 6, 2026 19:44
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-fc9ef02dd5 branch 2 times, most recently from b3579df to 408d307 Compare October 20, 2026 19:44
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-fc9ef02dd5 branch from 408d307 to 4da95f2 Compare October 22, 2026 11:25
@rhamzeh

rhamzeh commented Oct 22, 2026

Copy link
Copy Markdown
Member

@dependabot recreate

…9 updates

Bumps the dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.5` | `10.0.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.6` | `26.6.5` |
| [@vscode/vsce](https://github.com/Microsoft/vsce) | `3.9.2` | `4.0.0` |
| [globals](https://github.com/sindresorhus/globals) | `15.15.0` | `17.13.0` |
| [mocha](https://github.com/mochajs/mocha) | `11.8.0` | `12.0.3` |
| [ovsx](https://github.com/eclipse-openvsx/openvsx/tree/HEAD/cli) | `1.1.1` | `1.3.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.10` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.68.0` | `8.71.2` |
| [webpack](https://github.com/webpack/webpack) | `5.110.1` | `5.112.0` |



Updates `@eslint/js` from 9.39.5 to 10.0.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js)

Updates `@types/node` from 25.9.6 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vscode/vsce` from 3.9.2 to 4.0.0
- [Commits](microsoft/vscode-vsce@v3.9.2...v4.0.0)

Updates `globals` from 15.15.0 to 17.13.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v15.15.0...v17.13.0)

Updates `mocha` from 11.8.0 to 12.0.3
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md)
- [Commits](mochajs/mocha@v11.8.0...v12.0.3)

Updates `ovsx` from 1.1.1 to 1.3.0
- [Release notes](https://github.com/eclipse-openvsx/openvsx/releases)
- [Changelog](https://github.com/eclipse-openvsx/openvsx/blob/main/cli/CHANGELOG.md)
- [Commits](https://github.com/eclipse-openvsx/openvsx/commits/v1.3.0/cli)

Updates `prettier` from 3.9.6 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.6...3.9.10)

Updates `typescript-eslint` from 8.68.0 to 8.71.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.2/packages/typescript-eslint)

Updates `webpack` from 5.110.1 to 5.112.0
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.110.1...v5.112.0)

---
updated-dependencies:
- dependency-name: "@eslint/js"
  dependency-version: 10.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@vscode/vsce"
  dependency-version: 4.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: globals
  dependency-version: 17.12.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: mocha
  dependency-version: 12.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: ovsx
  dependency-version: 1.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: prettier
  dependency-version: 3.9.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.70.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: webpack
  dependency-version: 5.111.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-fc9ef02dd5 branch from 4da95f2 to 702d897 Compare October 22, 2026 13:19
@Siddhant-K-code

Copy link
Copy Markdown
Member

VSCE & Node upgrade is critical here, Is it a hard requirement to bump a major version?

@SoulPancake

Copy link
Copy Markdown
Member

VSCE & Node upgrade is critical here, Is it a hard requirement to bump a major version?

No, we can do minor for breaking if any
It has to still remain pre 1.0.0 right now

@rhamzeh

rhamzeh commented Oct 22, 2026

Copy link
Copy Markdown
Member

Upgrade node to latest LTE and vs code to latest

- Use Node.js 24 (current LTS) in CI, publish workflows, mise and docs
- Require VS Code ^1.140.0 to match the @types/vscode in use
- Keep @eslint/js on v9 to match eslint 9, and ignore @eslint/js 10 in
  dependabot alongside eslint until the manual ESLint 10 upgrade
- Sync publish token verification with vsce 4.0.0 and ovsx 1.3.0
- Parse mocha's UMD bundle as CommonJS so web tests work with mocha 12

BREAKING CHANGE: the extension now requires VS Code 1.140.0 or later.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@Siddhant-K-code Siddhant-K-code changed the title chore(deps-dev): bump the dependencies group across 1 directory with 9 updates chore(deps)!: upgrade to Node 24 LTS & VS Code ^1.140.0, bump dev dependencies Oct 23, 2026
@Siddhant-K-code

Copy link
Copy Markdown
Member

@rhamzeh @SoulPancake - i've updated the PR!

@rhamzeh

rhamzeh commented Oct 24, 2026

Copy link
Copy Markdown
Member

@Siddhant-K-code @SoulPancake when we release, let's bump the minor version.

Also let's keep this in mind, if a lot of folks are affected we may get some issues and requests to support earlier versions. We can discuss and relax then.

In general, I have seen foks stick more with older versions of intellij than with older versions of vscode.

That said I have not looked to see what versions of vs codium are bundled into distros, vs codi specifically can be a bit behind.

But, again, we can relax when people ask for it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants