You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Upgrade NodeJS dependencies & upgrade for LTS (#328)
* Upgrade NodeJS dependencies
* chore(deps): support Node 24 LTS + 26 and finalize dependency alignment
Runtime / engines:
- Pin .node-version to v24.18.0 (Node 24 "Krypton" Active LTS).
- Set engines.node to "^24.15.0 || >=26.0.0" in root, server, and extension
manifests: support both LTS lines while excluding non-LTS Node 25, which
ini@7 (via markdownlint-cli -> run-con) rejects and which broke `npm ci`
under engine-strict.
Type definitions:
- Align @types/node to ^24.13.3 (server, extension) and add a root
"overrides" entry so the whole tree resolves a single Node 24 types version
(transitive deps otherwise pulled @types/node@26 to the root).
- Remove now-redundant @types/js-yaml and @types/adm-zip: js-yaml@5 and
adm-zip@0.6 ship their own type declarations.
Go client:
- Upgrade module dependencies (mcp-go 0.57.0, x/sys 0.47.0, x/text 0.40.0,
x/term 0.45.0, cast 1.10.0, pflag 1.0.10, httpretty 0.2.0, go-isatty 0.0.24,
go-colorful 1.4.0, jsonschema-go 0.4.3, safeexec 1.0.1) and run `go mod tidy`.
CI:
- Matrix the "build and test" workflows (build-server, build-and-test-extension,
and the build-and-test-client integration/CODEQL_PATH jobs) over the pinned
.node-version and the latest Node 26.x. "Use Node" workflows (copilot-setup,
lint-and-format, query-unit-tests, releases) stay on node-version-file.
Build artifacts:
- Regenerate the committed server/dist bundle so it reflects the upgraded
bundled deps (fast-uri 3.1.4 URI-authority hardening), keeping the CI
"no uncommitted changes" gate green. Bundle is byte-deterministic.
* fix: split setup-node into conditional steps to avoid empty node-version
actions/setup-node prioritizes node-version over node-version-file.
When the matrix value is '.node-version', the previous expression set
node-version to an empty string, which could cause the action to ignore
node-version-file entirely. Split into two steps with if: guards so
node-version is never set to an empty value.
Fixes all instances across build-server.yml, build-and-test-extension.yml,
and build-and-test-client.yml (integration-tests and codeql-path-tests jobs).
Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>
* Update CHANGELOG.md & remove allowScripts block
* Upgrade js-yaml server dev dependency to 5.2.2
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Copy file name to clipboardExpand all lines: CHANGELOG.md
+15Lines changed: 15 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,6 +14,21 @@ release cadence.
14
14
15
15
_Changes on `main` since the latest tagged release that have not yet been included in a stable release._
16
16
17
+
### Changed
18
+
19
+
#### Infrastructure & CI/CD
20
+
21
+
-**Realigned the supported Node.js versions with the Node.js LTS release line.** The `engines.node` constraint in the root, `server`, and `extensions/vscode``package.json` files moved from `>=25.6.0` to `^24.15.0 || >=26.0.0`, and `.node-version` moved from `v25.6.0` to `v24.18.0`. Node.js 25 is no longer supported: it is a non-LTS ("Current") line, and transitive dependencies such as `ini` have already dropped support for it. ([#328](https://github.com/advanced-security/codeql-development-mcp-server/pull/328))
22
+
-**Added Node.js matrix testing to the build workflows.**`build-server.yml`, `build-and-test-client.yml`, and `build-and-test-extension.yml` now run against both Node 24 (via `.node-version`) and Node 26, with the Node version surfaced in job names and `$GITHUB_STEP_SUMMARY` output. Each matrix entry uses two `if:`-guarded `actions/setup-node` steps so `node-version` is never passed as an empty string (which would otherwise take precedence over `node-version-file` and silently select the runner's default Node). ([#328](https://github.com/advanced-security/codeql-development-mcp-server/pull/328))
23
+
-**Pinned `@types/node` repo-wide via a root `overrides` entry** (`^24.13.3`) so every workspace type-checks against a single Node typings version that matches the supported Node 24 LTS baseline. ([#328](https://github.com/advanced-security/codeql-development-mcp-server/pull/328))
24
+
25
+
### Dependencies
26
+
27
+
- Upgraded server runtime dependencies: `adm-zip` 0.5.17 → 0.6.0 and `js-yaml` 4.1.1 → 5.2.2 (5.2.2 carries a fix for a high-severity advisory affecting 5.2.1). Both packages now ship their own type declarations, so the `@types/adm-zip` and `@types/js-yaml` devDependencies were removed. ([#328](https://github.com/advanced-security/codeql-development-mcp-server/pull/328))
0 commit comments