Repository navigation
chore(deps): bump ovsx to 1.3.0 - #295
Merged
Merged
Conversation
ovsx 1.2.0 depended on follow-redirects 1.16.0 and nested @vscode/vsce 3.9.2, which pinned markdown-it 14.3.2. ovsx 1.3.0 depends on @vscode/vsce 4 and drops follow-redirects. Clears Dependabot alerts 25, 26, and 27 (GHSA-gfr2-rv44-r23c, GHSA-8r9p-f939-6h3c, GHSA-q3jh-wrc6-jgq8). npx ovsx publish <file.vsix> still publishes a prebuilt package. OVSX_PAT is still read from the environment. Node floor stays >=22. npm audit --audit-level=high is clean. npm run check: 481 passed, line coverage 92.91%, vsce package ok. Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bump the
ovsxdevDependency from 1.2.0 to 1.3.0. That is the Open VSX publish CLI used by Package and Upload (npx ovsx publish patchloom.vsix).Why
Dependabot alerts 25, 26, and 27 are high findings in the development tree:
follow-redirects1.16.0 (GHSA-8r9p-f939-6h3c, GHSA-q3jh-wrc6-jgq8), a direct dependency of ovsx 1.2.0. Patched in 1.16.1.markdown-it14.3.2 (GHSA-gfr2-rv44-r23c), pulled by the nested@vscode/vsce3.9.2 that ovsx 1.2.0 still installed. Patched in 14.3.3.npm audit --audit-level=highwas already red on main for those two packages. ovsx 1.3.0 depends on@vscode/vsce^4 and no longer depends onfollow-redirects, so both packages leave the tree. The existingsecretlintoverride stays. Nothing in this lock installs that package anymore, and the pin still blocks the unpatchedbracestree if a later dependency bringssecretlint10 back.ovsx publish patchloom.vsixis still the positional package path.OVSX_PATis still read from the environment. The CLI requires Node >= 22, which this repo already declares.Verification
npm audit --audit-level=high: 0 vulnerabilitiesfollow-redirects,markdown-it, andbracesare absent frompackage-lock.jsonnpx ovsx publish --helpstill accepts[extension.vsix]npm run check: 481 passed, line coverage 92.91%,vsce packageokChecklist
git commit -snpm run checkand it passes