From a846f61a24a978df8e23c3b2966a3927ec3e2c60 Mon Sep 17 00:00:00 2001 From: ChethanUK Date: Tue, 21 Jul 2026 16:24:03 +0200 Subject: [PATCH] chore(deps): let dependabot cover the VS Code extension dependabot.yml declares gomod and github-actions only. The repo has 9 npm manifests, and extensions/vscode/package.json:110-116 is currently carrying five hand-written CVE resolutions pins - undici, form-data, js-yaml, minimatch - i.e. someone is patching CVEs by hand in a package dependabot never looks at. Scope is deliberately just /extensions/vscode: its yarn.lock is tracked (Yarn Classic v1, which the npm ecosystem supports). /pages is excluded because its lockfile is gitignored (.gitignore:13) - a maintainer policy call, not mine. / and the six npm/*/ stubs have no real dependencies. @types/vscode is ignored because package.json pins it to ^1.74.0 to match engines.vscode ^1.74.0; bumping the types alone would type-check against APIs absent from the declared minimum VS Code. Grouped to minor/patch so the breaking majors already pending (eslint 8->9, @typescript-eslint 6->8, @types/node 18->24, vsce ->3) arrive individually rather than as one unreviewable PR. --- .github/dependabot.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 27b97590..f71cdb01 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,3 +17,21 @@ updates: actions: patterns: - "*" + + - package-ecosystem: npm + directory: /extensions/vscode + schedule: + interval: weekly + open-pull-requests-limit: 5 + ignore: + # yarn.lock already resolves @types/vscode far above the declared + # engines.vscode floor (^1.74.0). Realign the two deliberately rather + # than let a bot churn a version no CI job builds or type-checks. + - dependency-name: "@types/vscode" + groups: + vscode-dependencies: + patterns: + - "*" + update-types: + - minor + - patch