[corwinm]

Summary

• Update @semantic-release/github 12.0.8 → 12.0.10, independently of security remediation fix: patch vulnerable tooling transitive dependencies #90.
• Includes upstream 12.0.9 fixes for release-asset upload content-length handling and use of the plugin's installed undici. This repository uploads VSIX assets, so those fixes apply to its actual release configuration.
• Includes the upstream-required @octokit/plugin-paginate-rest 14.0.0 → 15.0.0 plus its @octokit/types 17 / OpenAPI types 28 dependencies. All other resolutions are preserved: the package-manager's broader refresh was narrowed and revalidated with a frozen install.

Compatibility review

• Node engine requirement is unchanged: ^22.14.0 || >=24.10.0, compatible with the existing Node 22.x release workflow and local 22.23.4.
• Paginator v15 release notes remove legacy Projects endpoints. This repository's plugin configuration does not use them; the plugin's pagination consumer lists pull-request commits. A real installed paginator smoke followed two loopback fixture pages successfully.
• 12.0.9 and 12.0.10 release notes reviewed.
• Independent repository-aware codex review --base origin/main approved clean head e723ae93860ee864130f47a4412204f291da164d with no actionable regressions.

Verification

All passed locally with Node 22.23.4 / pnpm 10.23.0:

• pnpm install --frozen-lockfile
• pnpm run check-types, pnpm run lint, pnpm run package, pnpm run verify:release
• pnpm test: 26 passing, real macOS VS Code extension host
• pnpm exec vsce package --no-dependencies --out /Users/corwin/.hermes/cache/scratch/oil-code-github-patch.vsix: nonempty disposable VSIX produced
• pnpm why @semantic-release/github @octokit/plugin-paginate-rest --depth 3
• Installed plugin/Octokit/undici local HTTP fixture smoke: created fixture draft, uploaded the exact 130124-byte VSIX with valid content-length framing, then finalized the fixture release; paginator followed two pages. Only loopback HTTP was used, with no publishing credentials or live GitHub/marketplace publication.
• git diff --check

pnpm audit --json retains the same 33 baseline findings (3 critical, 13 high, 12 moderate, 5 low); this optional publishing patch is deliberately not the security fix. #90 resolves every one of those findings and should be reviewed first. Both PRs target main independently; no stacked branch is required.

VS Code emitted upstream proposal/account/deprecation warnings; tests completed successfully.

Remote CI and combined compatibility

• All three CI checks passed on exact head e723ae93860ee864130f47a4412204f291da164d: macOS, Ubuntu, and Windows (run).
• Applying fix: patch vulnerable tooling transitive dependencies #90's security patch on top of this branch in a disposable worktree succeeded without conflicts. Combined frozen install, audit (zero findings), type/lint/production build, release metadata, consumer smokes, paginator smoke, and exact-VSIX fixture upload all passed. The temporary worktree is removed after verification.
• No merge was performed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-23T16:47:30.484308Z We couldn’t complete this review. Comment @codex review to try again.	e723ae9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: cb9b7b1d-ade2-4d40-a86d-a76762a0e815

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}