Skip to content

build(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates - #385

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vscode-extension/dev-dependencies-2d67e2b4ef
Open

build(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates#385
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vscode-extension/dev-dependencies-2d67e2b4ef

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 10 updates in the /vscode-extension directory:

Package From To
@github/copilot-sdk 0.2.0 1.0.14
@typescript-eslint/eslint-plugin 8.57.1 8.70.0
@typescript-eslint/parser 8.57.1 8.70.0
@types/node 25.5.0 26.6.2
@types/vscode 1.110.0 1.138.0
@vscode/vsce 3.9.2 4.0.0
esbuild 0.28.1 0.28.2
eslint 10.0.3 10.11.0
globals 17.4.0 17.12.0
typescript 5.9.3 7.0.2

Updates @github/copilot-sdk from 0.2.0 to 1.0.14

Release notes

Sourced from @​github/copilot-sdk's releases.

v1.0.14

Feature: typed message provenance for user, system, and agent sources

Messages sent through the SDK can now carry typed source provenance, distinguishing human user input, internal system injections, and identified agent- senders, so recipients can reliably tell agent input from human authorization. (#2573)

await session.send("Looks good to me.", { source: "agent-reviewer" });
await session.send("Looks good to me.", source=AgentMessageSource("reviewer"))

Feature: Auto model routing Fast tier

Sessions using auto model routing can now select the fast tier alongside the existing efficiency, balance, and intelligence tiers, giving integrators a latency-focused routing preset across all six SDKs. (#2669)

await session.setAutoTier("fast");

Feature: force-refresh managed settings cache

The new managedSettings.clearCache RPC method wipes the persistent server-policy cache and drops the runtime's in-memory retained policy, giving hosts a primitive for a "force refresh account policy" action. (#2438)

await client.rpc.managedSettings.clearCache();
await client.Rpc.ManagedSettings.ClearCacheAsync();

Feature: Rust SDK model allowlists

SessionConfig and ResumeSessionConfig in the Rust SDK now accept an optional allowed_models list, letting hosts restrict which model IDs a session may use without duplicating runtime validation. (#2512)

let config = SessionConfig::default().with_allowed_models(["gpt-4o", "claude-3.7-sonnet"]);

Other changes

  • feature: [Core] add factory pause checkpoints for the Node.js Agent Factories API, letting a paused run resume without losing invocation limits or execution identity (#2537)
  • feature: forward the optional host OAuth client metadata URL across all six SDKs on session create and resume (#2258)
  • feature: [TypeScript] add max_output_tokens to the model capabilities override, previously unreachable without an unsafe cast (#2569)
  • bugfix: [.NET] include Copilot CLI runtime assets in PackAsTool packages so dotnet pack --no-build produces a working tool (#2557)
  • bugfix: apply the runtime's connection_close callback-quiescence contract consistently across all six in-process C ABI adapters, preventing races with freed callback state during disposal (#2610, #2622)
  • bugfix: [Rust] fix codegen for CLI 1.0.84 schemas, correctly mapping the CatalogTrustEligibility unknown value and re-exporting shared session-event types (#2631)
  • bugfix: [C#] fix codegen for runtime schema unions, unblocking single-variant anyOf/oneOf handling (#2656)

... (truncated)

Changelog

Sourced from @​github/copilot-sdk's changelog.

v1.0.14 (2026-09-16)

Feature: typed message provenance for user, system, and agent sources

Messages sent through the SDK can now carry typed source provenance, distinguishing human user input, internal system injections, and identified agent- senders, so recipients can reliably tell agent input from human authorization. (#2573)

await session.send("Looks good to me.", { source: "agent-reviewer" });
await session.send("Looks good to me.", source=AgentMessageSource("reviewer"))

Feature: Auto model routing Fast tier

Sessions using auto model routing can now select the fast tier alongside the existing efficiency, balance, and intelligence tiers, giving integrators a latency-focused routing preset across all six SDKs. (#2669)

await session.setAutoTier("fast");

Feature: force-refresh managed settings cache

The new managedSettings.clearCache RPC method wipes the persistent server-policy cache and drops the runtime's in-memory retained policy, giving hosts a primitive for a "force refresh account policy" action. (#2438)

await client.rpc.managedSettings.clearCache();
await client.Rpc.ManagedSettings.ClearCacheAsync();

Feature: Rust SDK model allowlists

SessionConfig and ResumeSessionConfig in the Rust SDK now accept an optional allowed_models list, letting hosts restrict which model IDs a session may use without duplicating runtime validation. (#2512)

let config = SessionConfig::default().with_allowed_models(["gpt-4o", "claude-3.7-sonnet"]);

Other changes

  • feature: [Core] add factory pause checkpoints for the Node.js Agent Factories API, letting a paused run resume without losing invocation limits or execution identity (#2537)
  • feature: forward the optional host OAuth client metadata URL across all six SDKs on session create and resume (#2258)
  • feature: [TypeScript] add max_output_tokens to the model capabilities override, previously unreachable without an unsafe cast (#2569)
  • bugfix: [.NET] include Copilot CLI runtime assets in PackAsTool packages so dotnet pack --no-build produces a working tool (#2557)
  • bugfix: apply the runtime's connection_close callback-quiescence contract consistently across all six in-process C ABI adapters, preventing races with freed callback state during disposal (#2610, #2622)
  • bugfix: [Rust] fix codegen for CLI 1.0.84 schemas, correctly mapping the CatalogTrustEligibility unknown value and re-exporting shared session-event types (#2631)

... (truncated)

Commits

Updates @typescript-eslint/eslint-plugin from 8.57.1 to 8.70.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

  • eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
  • website: generate per-page social preview cards (#12734)

🩹 Fixes

  • use stable release of pnpm 12 (#12808)
  • update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
  • eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
  • eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
  • eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
  • project-service: avoid discarded tsserver logs (#12748)
  • typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

8.69.0 (2026-08-31)

🚀 Features

  • eslint-plugin: [no-misused-promises] add flagUnions option for checkConditionals (#12603)

🩹 Fixes

  • eslint-plugin: [no-mixed-enums] use scope analysis instead of type checking for merged namespaces (#12731)
  • eslint-plugin: [unified-signatures] compare type parameters by constraint instead of name (#12741)
  • eslint-plugin: [no-meaningless-void-operator] report void on non-call expressions (#12727)
  • website: respect allowJs playground config (#12744)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.70.0 (2026-09-07)

🚀 Features

  • eslint-plugin: [no-generated-empty-object-type] add rule (#12730)

🩹 Fixes

  • eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
  • eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
  • eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.69.0 (2026-08-31)

🚀 Features

  • eslint-plugin: [no-misused-promises] add flagUnions option for checkConditionals (#12603)

🩹 Fixes

  • eslint-plugin: [no-meaningless-void-operator] report void on non-call expressions (#12727)
  • eslint-plugin: [unified-signatures] compare type parameters by constraint instead of name (#12741)
  • eslint-plugin: [no-mixed-enums] use scope analysis instead of type checking for merged namespaces (#12731)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.68.0 (2026-08-24)

🚀 Features

  • eslint-plugin: [strict-void-return] add fix suggestions (#12086)

... (truncated)

Commits
  • 7ee7608 chore(release): publish 8.70.0
  • f66bdca test(eslint-plugin): [member-ordering] use RuleTester directly in `optional...
  • 4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
  • f8e1e4e fix(eslint-plugin): [no-unnecessary-condition] no false positive on RHS of a ...
  • 889cece fix(eslint-plugin): [member-ordering] don't report fields that read fields de...
  • 1a5a8b1 feat(eslint-plugin): [no-generated-empty-object-type] add rule (#12730)
  • 9a6e546 chore(release): publish 8.69.0
  • 513638e fix(eslint-plugin): [no-meaningless-void-operator] report void on non-call ex...
  • 1dba4c5 chore(eslint-plugin): fix eslint-plugin/require-test-error-positions report...
  • a2fccae fix(eslint-plugin): [unified-signatures] compare type parameters by constrain...
  • Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.57.1 to 8.70.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

  • eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
  • website: generate per-page social preview cards (#12734)

🩹 Fixes

  • use stable release of pnpm 12 (#12808)
  • update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
  • eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
  • eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
  • eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
  • project-service: avoid discarded tsserver logs (#12748)
  • typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

8.69.0 (2026-08-31)

🚀 Features

  • eslint-plugin: [no-misused-promises] add flagUnions option for checkConditionals (#12603)

🩹 Fixes

  • eslint-plugin: [no-mixed-enums] use scope analysis instead of type checking for merged namespaces (#12731)
  • eslint-plugin: [unified-signatures] compare type parameters by constraint instead of name (#12741)
  • eslint-plugin: [no-meaningless-void-operator] report void on non-call expressions (#12727)
  • website: respect allowJs playground config (#12744)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.70.0 (2026-09-07)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.69.0 (2026-08-31)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.68.0 (2026-08-24)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.67.0 (2026-08-10)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.66.0 (2026-08-03)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)

❤️ Thank You

... (truncated)

Commits
  • 7ee7608 chore(release): publish 8.70.0
  • 9a6e546 chore(release): publish 8.69.0
  • 8f4e00a chore(release): publish 8.68.0
  • 55f6d5d chore: enable source maps (#12677)
  • 20a261f chore(release): publish 8.67.0
  • 3b155bb chore: use typescript 7 for typechecking (#12601)
  • e51b11b chore(release): publish 8.66.0
  • 63ba81b chore(release): publish 8.65.0
  • eaf4576 feat: add warning when TS 7 is detected (#12529)
  • d8f1044 feat(parser): add onUnsupportedTypeScriptVersion option to error on unsupport...
  • Additional commits viewable in compare view

Updates @types/node from 25.5.0 to 26.6.2

Commits

Updates @types/vscode from 1.110.0 to 1.138.0

Commits

Updates @vscode/vsce from 3.9.2 to 4.0.0

Release notes

Sourced from @​vscode/vsce's releases.

v4.0.0

Changes:

  • #1329: Offer prompted migration of legacy PAT credentials
  • #1325: Remove leven dependency
  • #1324: Replace form-data with Node streams
  • #1326: Fix MSAL declaration build failure
  • #1323: Relock deps and mirror to package.json
  • #1314: Replace chalk with Node styling
  • #1312: Remove parse-semver dependency
  • #1313: Reduce secretlint dependency tree
  • #1315: chore(deps): bump the github-actions group with 2 updates
  • #1306: Pin GitHub Actions to full-length commit SHAs
  • #1309: Replace glob with tinyglobby
  • #1308: Raise Node.js baseline to 22
  • #1305: Update and replace many dependencies
  • #1298: chore(deps): bump js-yaml from 4.2.0 to 4.3.1
  • #1297: Hide OIDC option from publish help
  • #1296: Remove redundant secretlint dependency
  • #1295: chore(deps): bump fast-uri from 3.1.4 to 3.1.5
  • #1294: chore(deps): bump brace-expansion
  • #1293: chore(deps): bump fast-uri from 3.1.2 to 3.1.4
  • #1292: chore(deps): bump linkify-it from 5.0.1 to 5.0.2
  • #1291: auth: support OIDC trusted publishing
  • #1289: chore(deps): bump js-yaml and @​textlint/linter-formatter
  • #1288: chore(deps): bump form-data from 4.0.4 to 4.0.6
  • #1287: chore(deps): bump markdown-it from 14.1.1 to 14.2.0
  • #1284: chore(deps): bump tmp from 0.2.6 to 0.2.7

This list of changes was auto generated.

v3.9.3-12

Changes:

  • #1329: Offer prompted migration of legacy PAT credentials
  • #1325: Remove leven dependency
  • #1324: Replace form-data with Node streams
  • #1326: Fix MSAL declaration build failure
  • #1323: Relock deps and mirror to package.json
  • #1314: Replace chalk with Node styling
  • #1312: Remove parse-semver dependency

This list of changes was auto generated.

... (truncated)

Commits
  • 9f25124 Merge pull request #1329 from microsoft/benibenj/migrate-legacy-pat-storage
  • 7d84e92 Offer prompted migration of legacy PAT credentials
  • 75cae44 Merge pull request #1325 from jakebailey/remove-leven
  • ae9f2b7 Merge pull request #1324 from jakebailey/remove-form-data
  • fa08d59 Capture both output streams in the CLI tests
  • 3fb79d8 Fix multipart stream lifecycle issues
  • bee68cf Extract command suggestion helper and test it
  • b40452e Merge pull request #1326 from microsoft/benibenj/agents/validate-package-lock...
  • d2cd4d4 Keep PR CI workflow unchanged
  • fa0fdf7 Fix MSAL declaration build failure
  • Additional commits viewable in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

Updates eslint from 10.0.3 to 10.11.0

Release notes

Sourced from eslint's releases.

v10.11.0

Features

  • d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
  • 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
  • d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

  • 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
  • b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
  • 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

  • 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
  • 6c789ff docs: Update README (GitHub Actions Bot)
  • 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

Chores

  • 520dd77 perf: Implement fast paths in critical areas (#21210) (Nicholas C. Zakas)
  • 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330) (Francesco Trotta)
  • 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331) (renovate[bot])
  • 24310e3 chore: update ecosystem plugins (#21324) (ESLint Bot)
  • 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318) (dependabot[bot])
  • ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#21221) (Nicholas C. Zakas)
  • c832660 chore: Upgrade Stylelint to the latest version in docs (#21245) (Jung Hyeon Jun)
  • f9f88fc chore: update ecosystem plugins (#21308) (ESLint Bot)
  • fc81076 ci: add more types integration tests (#20395) (Nitin Kumar)

v10.10.0

Features

  • 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
  • c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
  • 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

  • bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
  • 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
  • 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
  • 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
  • 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
  • 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

  • 2417cad docs: Update README (GitHub Actions Bot)
  • 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
  • 8724829 docs: update compat table links (#21263) (fnx)
  • 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

  • b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
  • 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))

... (truncated)

Commits
  • 3c0b7c6 10.11.0
  • 321f0a7 Build: changelog update for 10.11.0
  • 520dd77 perf: Implement fast paths in critical areas (#21210)
  • 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312)
  • 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330)
  • 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331)
  • 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311)
  • 24310e3 chore: update ecosystem plugins (#21324)
  • d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21...
  • 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318)
  • Additional commits viewable in compare view

Updates globals from 17.4.0 to 17.12.0

Release notes

Sourced from globals's releases.

v17.12.0

  • Update globals (2026-09-01) (#353) 50a2119
  • Add __webpack_layer__ global (#351) 779a11a

sindresorhus/globals@v17.11.0...v17.12.0

v17.11.0

  • Add react-native globals (#337) 61eafbf

sindresorhus/globals@v17.10.0...v17.11.0

v17.10.0

  • Add GM_cookie to Greasemonkey globals (#349) f468407

sindresorhus/globals@v17.9.0...v17.10.0

v17.9.0

  • Update globals (2026-08-01) (#348) 5a958ed

sindresorhus/globals@v17.8.0...v17.9.0

v17.8.0

  • Update globals (2026-07-01) (#347) 7394811

sindresorhus/globals@v17.7.0...v17.8.0

v17.7.0

  • Update globals (2026-06-22) (#345) 33b75f9

sindresorhus/globals@v17.6.0...v17.7.0

v17.6.0

  • Update globals (2026-05-01) (#343) 00a4dd9

sindresorhus/globals@v17.5.0...v17.6.0

... (truncated)

Commits

Copilot AI lite review requested due to automatic review settings September 23, 2026 05:55
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 23, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 23, 2026
Copilot AI reviewed Sep 23, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

TypeScript 7.0.2 is outside the supported peer range, and the parser range is not aligned with the plugin update.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 High severity · 1 Medium severity

Open (2)
What changed in this PR

Updates VS Code extension development dependencies for SDK, TypeScript, ESLint, bundling, typings, and packaging.

Changes:

  • Upgrades ten development dependencies.
  • Refreshes TypeScript and linting tooling.
File Description
vscode-extension/​package.json Declares updated development dependency versions and ranges.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread vscode-extension/package.json
"globals": "^17.3.0",
"typescript": "^5.9.3"
"globals": "^17.12.0",
"typescript": "^7.0.2"
Comment thread vscode-extension/package.json
"@octokit/rest": "^22.0.1",
"@typescript-eslint/eslint-plugin": "^8.57.1",
"@typescript-eslint/eslint-plugin": "^8.70.0",
"@typescript-eslint/parser": "^8.56.0",
@dependabot
build(deps-dev): bump the dev-dependencies group across 1 directory w…
ac2b3b4 
…ith 10 updates

Bumps the dev-dependencies group with 10 updates in the /vscode-extension directory:

| Package | From | To |
| --- | --- | --- |
| [@github/copilot-sdk](https://github.com/github/copilot-sdk) | `0.2.0` | `1.0.14` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.57.1` | `8.70.0` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.57.1` | `8.70.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.5.0` | `26.6.2` |
| [@types/vscode](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/vscode) | `1.110.0` | `1.138.0` |
| [@vscode/vsce](https://github.com/Microsoft/vsce) | `3.9.2` | `4.0.0` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` |
| [eslint](https://github.com/eslint/eslint) | `10.0.3` | `10.11.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.4.0` | `17.12.0` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` |



Updates `@github/copilot-sdk` from 0.2.0 to 1.0.14
- [Release notes](https://github.com/github/copilot-sdk/releases)
- [Changelog](https://github.com/github/copilot-sdk/blob/main/CHANGELOG.md)
- [Commits](github/copilot-sdk@v0.2.0...v1.0.14)

Updates `@typescript-eslint/eslint-plugin` from 8.57.1 to 8.70.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.57.1 to 8.70.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/parser)

Updates `@types/node` from 25.5.0 to 26.6.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/vscode` from 1.110.0 to 1.138.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/vscode)

Updates `@vscode/vsce` from 3.9.2 to 4.0.0
- [Release notes](https://github.com/Microsoft/vsce/releases)
- [Commits](microsoft/vscode-vsce@v3.9.2...v4.0.0)

Updates `esbuild` from 0.28.1 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.1...v0.28.2)

Updates `eslint` from 10.0.3 to 10.11.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.0.3...v10.11.0)

Updates `globals` from 17.4.0 to 17.12.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.4.0...v17.12.0)

Updates `typescript` from 5.9.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v7.0.2)

---
updated-dependencies:
- dependency-name: "@github/copilot-sdk"
  dependency-version: 1.0.14
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: "@types/vscode"
  dependency-version: 1.138.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.70.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.70.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@vscode/vsce"
  dependency-version: 4.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: eslint
  dependency-version: 10.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: globals
  dependency-version: 17.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps-dev): bump the dev-dependencies group in /vscode-extension with 10 updates build(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates Sep 23, 2026
Copilot AI review requested due to automatic review settings September 23, 2026 21:01
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/vscode-extension/dev-dependencies-2d67e2b4ef branch from fcfcb5a to ac2b3b4 Compare September 23, 2026 21:01
Copilot AI reviewed Sep 23, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

TypeScript 7 is unsupported by the current ESLint tooling, and the Copilot SDK 1.x update is incompatible with the bundled core integration.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 3 High severity · 1 Medium severity

Open (4)

Comment thread vscode-extension/package.json
"devDependencies": {
"@eslint/js": "^10.0.1",
"@github/copilot-sdk": "0.2.0",
"@github/copilot-sdk": "1.0.14",
Comment thread vscode-extension/package.json
"globals": "^17.3.0",
"typescript": "^5.9.3"
"globals": "^17.12.0",
"typescript": "^7.0.2"

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@pierceboggan Pierce Boggan (pierceboggan) Awaiting requested review from pierceboggan pierceboggan is a code owner
@digitarald Harald Kirschner (digitarald) Awaiting requested review from digitarald digitarald is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant