Skip to content

chore(deps-dev): bump the dependencies group with 6 updates#539

Merged
curfew-marathon merged 2 commits into
mainfrom
dependabot/npm_and_yarn/dependencies-14a721da58
Jun 5, 2026
Merged

chore(deps-dev): bump the dependencies group with 6 updates#539
curfew-marathon merged 2 commits into
mainfrom
dependabot/npm_and_yarn/dependencies-14a721da58

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 6 updates:

Package From To
@typescript-eslint/eslint-plugin 8.60.0 8.60.1
@typescript-eslint/parser 8.60.0 8.60.1
@vscode/vsce 3.9.1 3.9.2
ovsx 0.10.12 1.0.0
ts-loader 9.5.7 9.6.0
webpack-cli 7.0.2 7.0.3

Updates @typescript-eslint/eslint-plugin from 8.60.0 to 8.60.1

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.60.1

8.60.1 (2026-06-01)

🩹 Fixes

  • eslint-plugin: respect ECMAScript line terminators in ts-comment rules (#12352)
  • eslint-plugin: [no-shadow] correct rule to match ESLint v10 handling (#12182)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.60.1 (2026-06-01)

🩹 Fixes

  • eslint-plugin: [no-shadow] correct rule to match ESLint v10 handling (#12182)
  • eslint-plugin: respect ECMAScript line terminators in ts-comment rules (#12352)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits
  • 4f84a69 chore(release): publish 8.60.1
  • 598af56 docs(eslint-plugin): clarify no-redeclare type-value collision not covered by...
  • 1849b53 chore: typecheck using tsgo (#12139)
  • 5341d59 chore: fix lint issues (#12369)
  • f525814 fix(eslint-plugin): [no-shadow] correct rule to match ESLint v10 handling (#1...
  • 2df540c chore(eslint-plugin): defer type checks to improve rules performance (#12296)
  • 1ab4284 fix(eslint-plugin): respect ECMAScript line terminators in ts-comment rules (...
  • 2f49df5 docs: update references to @stylistic/eslint-plugin rules in documentation ...
  • See full diff in compare view

Updates @typescript-eslint/parser from 8.60.0 to 8.60.1

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.60.1

8.60.1 (2026-06-01)

🩹 Fixes

  • eslint-plugin: respect ECMAScript line terminators in ts-comment rules (#12352)
  • eslint-plugin: [no-shadow] correct rule to match ESLint v10 handling (#12182)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.60.1 (2026-06-01)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates @vscode/vsce from 3.9.1 to 3.9.2

Release notes

Sourced from @​vscode/vsce's releases.

v3.9.2

Changes:

  • #1283: fix: skip APIScan
  • #1282: chore: bump CI to Node 22 and fix build
  • #1279: Bump the uuid test fixture version to 100.0.0
  • #1278: Bump tmp from 0.2.4 to 0.2.6
  • #1277: Bump qs from 6.14.2 to 6.15.2
  • #1276: Bump uuid and @​azure/msal-node
  • #1274: Run npm audit fix
  • #1272: Bump fast-uri from 3.0.6 to 3.1.2
  • #1267: Bump minimatch from 10.2.2 to 10.2.3
  • #1247: Update minimatch dependency to v10

This list of changes was auto generated.

v3.9.2-4

Changes:

  • #1283: fix: skip APIScan
  • #1282: chore: bump CI to Node 22 and fix build
  • #1279: Bump the uuid test fixture version to 100.0.0
  • #1278: Bump tmp from 0.2.4 to 0.2.6
  • #1277: Bump qs from 6.14.2 to 6.15.2
  • #1276: Bump uuid and @​azure/msal-node

This list of changes was auto generated.

v3.9.2-3

Changes:

  • #1274: Run npm audit fix

This list of changes was auto generated.

v3.9.2-2

Changes:

  • #1272: Bump fast-uri from 3.0.6 to 3.1.2

This list of changes was auto generated.

... (truncated)

Commits

Updates ovsx from 0.10.12 to 1.0.0

Release notes

Sourced from ovsx's releases.

CLI v1.0.0

Dependencies

  • Bump fast-uri from 3.1.0 to 3.1.2 (#1829)
  • Bump brace-expansion from 5.0.5 to 5.0.6 (#1846)
  • Bump qs from 6.15.0 to 6.15.2 (#1869)
  • Bump tmp from 0.2.4 to 0.2.6 (#1877)

Frontend Library v1.0.0

Added

  • Add a settings page in the admin dashboard and support putting the registry in read-only mode (#1835)

v1.0.0

This release of Open VSX consists of:

Deploying the server application is documented in the Wiki.

What's Changed

🏕 Features

👒 Dependencies

Full Changelog: eclipse-openvsx/openvsx@v0.34.6...v1.0.0

v0.34.6

This release of Open VSX consists of:

... (truncated)

Changelog

Sourced from ovsx's changelog.

[v1.0.0] (28/05/2026)

Dependencies

  • Bump fast-uri from 3.1.0 to 3.1.2 (#1829)
  • Bump brace-expansion from 5.0.5 to 5.0.6 (#1846)
  • Bump qs from 6.15.0 to 6.15.2 (#1869)
  • Bump tmp from 0.2.4 to 0.2.6 (#1877)
Commits
  • 89fbda8 chore: bump to cli 1.0.0 release
  • f79fae2 chore: prepare for cli 0.10.13 release
  • 4352118 build(deps): bump tmp from 0.2.4 to 0.2.6 in /cli (#1877)
  • 0cd46ad build(deps): bump qs from 6.15.0 to 6.15.2 in /cli (#1869)
  • aa41a72 build(deps): bump brace-expansion from 5.0.5 to 5.0.6 in /cli (#1846)
  • ea274f3 build(deps): bump fast-uri from 3.1.0 to 3.1.2 in /cli (#1829)
  • See full diff in compare view

Updates ts-loader from 9.5.7 to 9.6.0

Release notes

Sourced from ts-loader's releases.

v9.6.0

Changelog

Sourced from ts-loader's changelog.

9.6.0

Commits

Updates webpack-cli from 7.0.2 to 7.0.3

Release notes

Sourced from webpack-cli's releases.

[email protected]

Patch Changes

  • Improved CLI startup performance and reduced memory usage. (by @​alexander-akait in #4765)

  • Reduced CLI startup CPU and memory usage by caching schema-derived argument metadata, registering only the options present in the arguments, and reading config directories once during default-config discovery. (by @​alexander-akait in #4760)

  • Replace the fastest-levenshtein dependency with a small in-tree implementation used for command/option "did you mean" suggestions. (by @​alexander-akait in #4762)

Changelog

Sourced from webpack-cli's changelog.

7.0.3

Patch Changes

  • Improved CLI startup performance and reduced memory usage. (by @​alexander-akait in #4765)

  • Reduced CLI startup CPU and memory usage by caching schema-derived argument metadata, registering only the options present in the arguments, and reading config directories once during default-config discovery. (by @​alexander-akait in #4760)

  • Replace the fastest-levenshtein dependency with a small in-tree implementation used for command/option "did you mean" suggestions. (by @​alexander-akait in #4762)

Commits
  • 5fb92f3 chore(release): new release (#4711)
  • 00347ed perf(webpack-cli): allocate Levenshtein buffer lazily (#4765)
  • 1b40b72 chore: update ejs (#4764)
  • 2bbb639 refactor(webpack-cli): replace fastest-levenshtein with in-tree implementatio...
  • a467d6e chore(deps): bump the dependencies group across 1 directory with 10 updates (...
  • 183d0e6 perf(webpack-cli): cache schema arguments and use map lookups for options (#4...
  • 5b33f70 chore(deps-dev): bump sass-loader from 16.0.8 to 17.0.0 (#4756)
  • 59f362a chore(deps): bump qs and express (#4758)
  • eaffa0b chore(deps): bump codecov/codecov-action in the dependencies group (#4757)
  • b3498b6 chore(deps): bump the dependencies group with 3 updates (#4754)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.60.0` | `8.60.1` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.60.0` | `8.60.1` |
| [@vscode/vsce](https://github.com/Microsoft/vsce) | `3.9.1` | `3.9.2` |
| [ovsx](https://github.com/eclipse-openvsx/openvsx/tree/HEAD/cli) | `0.10.12` | `1.0.0` |
| [ts-loader](https://github.com/TypeStrong/ts-loader) | `9.5.7` | `9.6.0` |
| [webpack-cli](https://github.com/webpack/webpack-cli) | `7.0.2` | `7.0.3` |


Updates `@typescript-eslint/eslint-plugin` from 8.60.0 to 8.60.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.60.1/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.60.0 to 8.60.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.60.1/packages/parser)

Updates `@vscode/vsce` from 3.9.1 to 3.9.2
- [Release notes](https://github.com/Microsoft/vsce/releases)
- [Commits](microsoft/vscode-vsce@v3.9.1...v3.9.2)

Updates `ovsx` from 0.10.12 to 1.0.0
- [Release notes](https://github.com/eclipse-openvsx/openvsx/releases)
- [Changelog](https://github.com/eclipse-openvsx/openvsx/blob/main/cli/CHANGELOG.md)
- [Commits](https://github.com/eclipse-openvsx/openvsx/commits/v1.0.0/cli)

Updates `ts-loader` from 9.5.7 to 9.6.0
- [Release notes](https://github.com/TypeStrong/ts-loader/releases)
- [Changelog](https://github.com/TypeStrong/ts-loader/blob/main/CHANGELOG.md)
- [Commits](TypeStrong/ts-loader@v9.5.7...v9.6.0)

Updates `webpack-cli` from 7.0.2 to 7.0.3
- [Release notes](https://github.com/webpack/webpack-cli/releases)
- [Changelog](https://github.com/webpack/webpack-cli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webpack/webpack-cli/compare/[email protected]@7.0.3)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.60.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.60.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@vscode/vsce"
  dependency-version: 3.9.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: ovsx
  dependency-version: 1.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: ts-loader
  dependency-version: 9.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: webpack-cli
  dependency-version: 7.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 4, 2026
Copilot AI review requested due to automatic review settings June 4, 2026 00:44
@dependabot
dependabot Bot requested a review from a team as a code owner June 4, 2026 00:44
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 4, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@socket-security

socket-security Bot commented Jun 4, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedovsx@​0.10.12 ⏵ 1.0.09810090 +196 +270
Updated@​typescript-eslint/​parser@​8.60.0 ⏵ 8.60.11001007198100
Updated@​typescript-eslint/​eslint-plugin@​8.60.0 ⏵ 8.60.19910080 +198100
Updatedwebpack-cli@​7.0.2 ⏵ 7.0.398 +110010091100
Updatedts-loader@​9.5.7 ⏵ 9.6.09910010091 +2100
Updated@​vscode/​vsce@​3.9.1 ⏵ 3.9.296 +110096 +1100 +1100

View full report

@socket-security

socket-security Bot commented Jun 4, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
License policy violation: npm ovsx under EPL-2.0

License: EPL-2.0 - The applicable license policy does not permit this license (5) (npm metadata)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/check-license.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/check-license.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/create-namespace.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/create-namespace.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/create-namespace.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-pat.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-pat.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/verify-pat.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/get.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/get.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/main.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/main.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/util.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/util.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/get.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/main.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/util.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/check-license.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/create-namespace-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/create-namespace-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/create-namespace-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/registry.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/login-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/logout.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/store.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/zip.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/login-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/login.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/logout.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/store.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/zip.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-pat-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-pat-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/verify-pat-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/publish.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/index.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/registry.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/get-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/get-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/publish-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/registry-options.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/registry-options.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/get-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/publish-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/registry-options.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/pat.d.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/pat.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/index.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/index.js)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/registry.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/publish.ts)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/package.json)

License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/LICENSE)

From: package-lock.jsonnpm/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@curfew-marathon
curfew-marathon added this pull request to the merge queue Jun 5, 2026
Merged via the queue into main with commit 76f52bf Jun 5, 2026
13 of 16 checks passed
@curfew-marathon
curfew-marathon deleted the dependabot/npm_and_yarn/dependencies-14a721da58 branch June 5, 2026 14:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants