Update NPM packages#5498
Merged
Merged
Conversation
Routine dependency refresh. Bumped patch/minor versions across the board and a few majors: - `uuid` 13 → 14 (only used as `v4` in `ExternalApi.ts`, no API changes) - `sinon` 21 → 22 (`@types/sinon` not yet published for 22, staying on 21) - `@types/vscode` ~1.110.0 → ~1.115.0 to align with `engines.vscode` ^1.114.0 (1.114 isn't published; 1.115 is the closest matching patch series). I held off bumping `engines.vscode` itself this round. - Various minor/patch bumps: `@vscode/extension-telemetry`, `semver`, `@vscode/vsce`, `@types/node`, `@ungap/structured-clone`, `eslint`, `prettier`, `typescript`, `typescript-eslint`. Skipped `@types/node` 25 (we're pinned to 22 to match Electron 39 / Node 22 in VS Code 1.114) and `untildify` 6 (ESM-only, we're CJS). The `serialize-javascript` and `diff` overrides are still required — mocha pulls in vulnerable transitive versions otherwise. I verified both: removing either re-introduces the advisories. `npm audit` is clean. Resolves the two open Dependabot alerts: - #86: `uuid` missing buffer bounds check in `v3`/`v5`/`v6` (fixed by the bump to `uuid` 14, which also pulls a patched 13.x transitively). - #87: `fast-uri` path traversal / host confusion (now on 3.1.2 via `@vscode/vsce` 3.9.1 → `@secretlint/node` → `ajv`). Verified `npm run compile`, `npm run lint`, `npm run format`, and `npm audit` all pass. Drafted by Copilot (Claude Opus 4.7). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Routine npm dependency refresh, bumping patch/minor versions broadly and a few majors (uuid 13→14, sinon 21→22, @types/vscode 1.110→1.115). Resolves two Dependabot alerts (uuid, fast-uri).
Changes:
- Bump
uuidto ^14.0.0,sinonto ^22.0.0,@types/vscodeto ~1.115.0. - Various minor/patch bumps to telemetry, semver, vsce, eslint, prettier, typescript, typescript-eslint, etc.
- Regenerated
package-lock.jsonto match.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Dependency version bumps for direct deps and dev/optional tooling. |
| package-lock.json | Lockfile regenerated to reflect the new resolved versions. |
SeeminglyScience
approved these changes
May 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Routine dependency refresh.
Highlights
uuid13 → 14 (only used asv4inExternalApi.ts, no API changes)sinon21 → 22 (@types/sinonnot yet published for 22, staying on 21)@types/vscode~1.110.0→~1.115.0to align withengines.vscode^1.114.0(1.114 isn't published; 1.115 is the closest matching patch series). Held off bumpingengines.vscodeitself this round.@vscode/extension-telemetry,semver,@vscode/vsce,@types/node,@ungap/structured-clone,eslint,prettier,typescript,typescript-eslint.Skipped
@types/node25 — pinned to 22 to match Electron 39 / Node 22 in VS Code 1.114.untildify6 — ESM-only, we're CJS.Overrides
The
serialize-javascriptanddiffoverrides are still required —mochapulls in vulnerable transitive versions otherwise. Verified both: removing either re-introduces the advisories.Security
Resolves both open Dependabot alerts:
uuidmissing buffer bounds check inv3/v5/v6(fixed by the bump touuid14, which also pulls a patched 13.x transitively).fast-uripath traversal / host confusion (now on 3.1.2 via@vscode/vsce3.9.1 →@secretlint/node→ajv).Verification
npm run compile✅npm run lint✅npm run format✅npm audit✅ (0 vulnerabilities)