chore(deps): Bump eslint-plugin-sonarjs from 4.0.3 to 4.1.0 in the dev-dependencies group across 1 directory

[dependabot]

Bumps the dev-dependencies group with 1 update in the / directory: eslint-plugin-sonarjs.

Updates eslint-plugin-sonarjs from 4.0.3 to 4.1.0

Commits

• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[nullvariant-mimi]

🐰 Mimi's Validation Report ✅

All checks are looking good! Great job! 🎉

⏳ Some checks are still running. I will keep watching!

---

バリデーターを通してくださいね

This report was carefully prepared by nullvariant-mimi[bot]

[nullvariant-luna]

👧 Luna's Exploration Report 📦

No new dependencies added. Just version bumps! Nothing to explore here... 😴

---

Botに418返そうよ！

This report was curiously compiled by nullvariant-luna[bot]

[nullvariant-blaze]

🐗 Blaze's Release Review 📦

No version bump. Just dependency changes... boring. Wake me up when it's deploy time! 😤

---

よっしゃ！デプロイしまくるぞ！

This review was ENTHUSIASTICALLY filed by nullvariant-blaze[bot]

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint-plugin-sonarjs@​4.0.3 ⏵ 4.1.0

View full report

[nullvariant-ciel]

🕊️ Ciel's Mediation ☀️

*~~ gliding on a gentle breeze ~~ How serene!*

3 zoo members have reviewed this PR.

Zoo Member	Status
🐰 Mimi	Commented
👧 Luna	Commented
🐗 Blaze	Commented

☀️ The zoo is in harmony. Everything looks peaceful from up here.

---

まあまあ、ほどほどに。

This mediation was peacefully delivered by nullvariant-ciel[bot]

[github-actions]

VEX Assessment: not_affected

This dependency update modifies devDependencies only.

• Status: not_affected
• Justification: vulnerable_code_not_in_execute_path
• Impact: Zero production dependencies. No third-party code is included in the published VSIX.

Any CVEs in updated devDependencies do not affect end users. The VEX document will be automatically updated by the weekly VEX Auto-Update workflow.

🤖 Automated VEX assessment

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/eslint-plugin-sonarjs	^4.1.0	Unknown	Unknown
npm/eslint-plugin-sonarjs	4.1.0	🟢 5.3	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Security-Policy 🟢 10 security policy file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow ⚠️ 0 dangerous workflow patterns detected Token-Permissions 🟢 3 detected GitHub workflow tokens with excessive permissions License 🟢 9 license file detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging 🟢 10 packaging workflow detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/semver	7.8.5	🟢 6.5	Details Check Score Reason Code-Review 🟢 7 Found 14/18 approved changesets -- score normalized to 7 Maintained 🟢 10 17 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found SAST 🟢 9 SAST tool detected but not run on all commits

Scanned Files

• extensions/git-id-switcher/package.json
• package-lock.json

[dependabot]

Looks like eslint-plugin-sonarjs is updatable in another way, so this is no longer needed.