[dependabot]

Bumps the dependencies group with 4 updates in the / directory: actions/setup-python, dtolnay/rust-toolchain, github/codeql-action/init and github/codeql-action/analyze.
Bumps the dependencies group with 2 updates in the /.github/actions/build-vsix directory: actions/setup-python and dtolnay/rust-toolchain.
Bumps the dependencies group with 1 update in the /.github/actions/lint directory: actions/setup-python.
Bumps the dependencies group with 3 updates in the /.github/actions/smoke-tests directory: actions/setup-python, actions/setup-node and actions/download-artifact.

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
• Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
• Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350

New Contributors

• @​luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
• 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
• e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
• 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
• af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
• 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
• Additional commits viewable in compare view

Updates dtolnay/rust-toolchain from 7e38f4b43b4db5c8dd498af069a4f6196df1d067 to 683b588c487a69d01f6c6ddf40f036ff682cc2c8

Commits

• 683b588 Add 1.99.1 patch release
• e2a55d2 Merge pull request #187 from dtolnay/pwn
• 6af9a09 Unify flags[@] and downgrade[@]
• 83d0610 Safely handle action inputs
• See full diff in compare view

Updates github/codeql-action/init from 4.37.9 to 4.39.3

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.3

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

v4.39.2

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

v4.39.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.3 - 04 Nov 2026

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

... (truncated)

Commits

• 33d7b85 Merge pull request #4299 from github/update-v4.39.3-064910ba2
• 24393f8 Update changelog for v4.39.3
• 064910b Merge pull request #4297 from github/mbg/update-glob
• f532ac5 Update glob to 14.0.3
• 8cd4dfa Merge pull request #4280 from github/mbg/ci/validate-yaml
• cea289b Return different exit code when a language is not recognised
• 7287bb3 Remove exclude entry that's no longer needed
• 8eb7cdf Use normal .editorconfig pattern
• 160e547 Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml
• 913e1bb Merge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-uris
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.9 to 4.39.3

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.39.3

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

v4.39.2

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

v4.39.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.3 - 04 Nov 2026

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #4283

4.39.2 - 03 Nov 2026

• Update default CodeQL bundle version to 2.27.4. #4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #4243

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

... (truncated)

Commits

• 33d7b85 Merge pull request #4299 from github/update-v4.39.3-064910ba2
• 24393f8 Update changelog for v4.39.3
• 064910b Merge pull request #4297 from github/mbg/update-glob
• f532ac5 Update glob to 14.0.3
• 8cd4dfa Merge pull request #4280 from github/mbg/ci/validate-yaml
• cea289b Return different exit code when a language is not recognised
• 7287bb3 Remove exclude entry that's no longer needed
• 8eb7cdf Use normal .editorconfig pattern
• 160e547 Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml
• 913e1bb Merge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-uris
• Additional commits viewable in compare view

Updates dtolnay/rust-toolchain from 7e38f4b43b4db5c8dd498af069a4f6196df1d067 to 1

Commits

• 683b588 Add 1.99.1 patch release
• e2a55d2 Merge pull request #187 from dtolnay/pwn
• 6af9a09 Unify flags[@] and downgrade[@]
• 83d0610 Safely handle action inputs
• See full diff in compare view

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
• Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
• Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350

New Contributors

• @​luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
• 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
• e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
• 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
• af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
• 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
• Additional commits viewable in compare view

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
• Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
• Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350

New Contributors

• @​luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
• 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
• e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
• 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
• af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
• 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
• Additional commits viewable in compare view

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
• Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
• Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350

New Contributors

• @​luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (arch 2.2.0 3.0.0 fs-extra 11.2.0 11.4.1 glob 7.2.0 14.0.4 iconv-lite 0.6.3 0.7.3 inversify 6.0.2 8.3.0 jsonc-parser 3.2.0 3.3.1 minimatch 5.1.8 11.0.5 node-stream-zip 1.15.0 1.16.0 rxjs 6.6.7 7.8.2 semver 7.8.5 7.8.6 @types/semver 5.5.0 7.8.0 stack-trace 0.0.10 1.0.0 vscode-debugprotocol 1.35.0 1.51.0 vscode-jsonrpc 9.0.0-next.5 10.0.0 vscode-languageclient 10.0.0-next.12 11.0.0 vscode-languageserver-protocol 3.17.6-next.10 3.18.5 vscode-tas-client 0.1.84 0.3.3 which 2.0.2 7.0.0 winreg 1.2.4 1.2.5 @types/winreg 1.2.31 1.2.36 xml2js 0.5.0 0.6.2 @types/bent 7.3.3 7.3.8 @types/chai-arrays 2.0.0 2.0.3 @types/download 8.0.3 8.0.5 @types/glob 7.2.0 9.0.0 @types/lodash 4.14.181 4.17.27 @types/node 22.19.3 26.6.6 @types/semver 5.5.0 7.8.0 @types/shortid 0.0.29 2.2.0 @types/stack-trace 0.0.29 0.0.33 @types/tmp 0.0.33 0.2.6 @types/vscode 1.100.0 1.145.0 @types/which 2.0.1 3.0.4 @types/winreg 1.2.31 1.2.36 @types/xml2js 0.4.9 0.4.14 @typescript-eslint/eslint-plugin 6.21.0 8.72.2 @typescript-eslint/parser 6.21.0 8.72.2 @vscode/vsce 3.9.2 4.1.0 chai 4.3.6 6.3.0 chai-as-promised 7.1.1 8.0.2 @types/chai-as-promised 7.1.5 8.0.2 cross-env 7.0.3 10.1.0 cross-spawn 6.0.6 7.0.6 del 6.0.0 9.0.1 eslint 8.57.1 10.14.0 eslint-config-prettier 8.5.0 10.1.8 eslint-plugin-import 2.31.0 2.32.0 eslint-plugin-jsx-a11y 6.5.1 6.10.2 eslint-plugin-no-only-tests 3.3.0 3.4.0 eslint-plugin-react 7.29.4 7.37.5 eslint-plugin-react-hooks 4.4.0 7.1.1 expose-loader 3.1.0 5.0.1 flat 5.0.2 6.0.1 get-port 5.1.1 7.2.0 gulp 5.0.0 5.0.1 mocha 11.8.0 12.0.3 mocha-junit-reporter 2.0.2 2.2.1 mocha-multi-reporters 1.5.1 1.5.2 node-loader 1.0.3 2.1.0 node-polyfill-webpack-plugin 1.1.4 4.1.0 prettier 2.0.2 3.9.10 sinon 18.0.0 22.1.0 @types/sinon 17.0.3 22.0.2 ts-loader 9.2.8 9.6.2 ts-node 10.7.0 10.9.2 tsconfig-paths-webpack-plugin 3.5.2 4.2.0 typescript 5.9.3 7.0.2 uuid 14.0.0 14.0.3 webpack 5.105.0 5.112.2 webpack-bundle-analyzer 4.5.0 5.4.2 webpack-cli 4.9.2 7.3.1 webpack-merge 5.8.0 6.0.1 yargs 15.3.1 18.2.0 typescript 5.9.3 7.0.2 @types/vscode 1.100.0 1.145.0

  Bumps the dependencies group with 3 updates in the /pythonExtensionApi directory: @types/vscode, typescript and source-map.

  Updates arch from 2.2.0 to 3.0.0

  Commits

  • 711dc8e 3.0.0
  • 0ed871e Merge pull request #22 from jakejarvis/detect-arm
  • 6a6c1f9 Detect ARM64 macOS running on Apple Silicon
  • See full diff in compare view
  
  

  Updates fs-extra from 11.2.0 to 11.4.1

  Changelog

  Sourced from fs-extra's changelog.

  11.4.1 / 2026-09-22

  • Properly handle read errors (e.g. due to permissions) in emptyDir*() (#1080)
  • Allow renaming with only Unicode normalization difference in the filename (APFS-specific) (#859, #1079)

  11.4.0 / 2026-07-23

  • Proper EEXIST error when trying to create a symlink and the dest already exists as a broken symlink (#925, #1076)

  11.3.6 / 2026-06-29

  • Fix handling of symlinked destination ancestors in copy/move methods (#1071, #1073)
  • Docs typo fixed (#1074)

  11.3.5 / 2026-05-06

  • Fix ensureLink*/ensureSymlink* identical file detection on Windows (#1068)
  • Fix error handling in timestamp preservation code (#1065, #1069)
  • Fix potential file descriptor leak on error in synchronous timestamp preservation code (#1066)

  11.3.4 / 2026-03-03

  • Fix bug where calling ensureSymlink/ensureSymlinkSync with a relative srcPath would fail if the symlink already existed (#1038, #1064)

  11.3.3 / 2025-12-18

  • Fix copying symlink when destination is a symlink to the same target (#1019, #1060)

  11.3.2 / 2025-09-15

  • Fix spurrious UnhandledPromiseRejectionWarning that could occur when calling .copy() in some cases (#1056, #1058)

  11.3.1 / 2025-08-05

  • Fix case where move/moveSync could incorrectly think files are identical on Windows (#1050)

  11.3.0 / 2025-01-15

  • Add promise support for newer fs methods (#1044, #1045)
  • Use fs.opendir in copy()/copySync() for better perf/scalability (#972, #1028)

  Commits

  • 1e223d3 11.4.1
  • 8cfd0a0 Remove obsolete docs note
  • de72292 Treat Unicode-normalization-only renames like case-only renames (#1079)
  • 7e0ce7f Remove broken link (#1083)
  • 00e858c Update GH Actions versions (#1082)
  • f829cc9 fix: propagate emptyDir directory read errors (#1080)
  • 53a8d1a 11.4.0
  • 9c2d3c9 Throw EEXIST when ensureSymlink dest is a broken symlink (#1076)
  • 62a4e72 11.3.6
  • 01c0ca6 Fix copy/move recursing into source through a symlinked dest ancestor (#1073)
  • Additional commits viewable in compare view
  
  

  Updates glob from 7.2.0 to 14.0.4

  Changelog

  Sourced from glob's changelog.

  changeglob

  14

  • Use minimatch 11. Each portion of a pattern with magic is now matched with a Matcher from @isaacs/nonrecursive-glob-match in place of a RegExp, so patterns can no longer cause ReDoS. Matching follows the minimatch 11 changes, which are closer to Bash in some edge cases.
  • Pattern#pattern() returns a Matcher for a portion with magic. The MMPattern type is now minimatch's ParseReturnFiltered, and the new MMMatcher type is the Matcher part of it.
  • Rename Pattern#isRegExp() to isMatcher(), and Processor#testRegExp() to testMatcher().
  • Remove the debug option, which minimatch no longer has.
  • Add the normalize option, to normalize unicode in the pattern and in the file names that it is matched against.
  • GlobWalker#walk() and walkSync() return arrays in place of sets, and MatchRecord#entries() is removed.
  • ignore patterns that start with / now start at the same place as other patterns that start with /: the root option if set, or else the root of the cwd, such as C:\ on Windows.
  • ignore patterns follow the windowsPathsNoEscape option, the same as other patterns.
  • On Windows, patterns that start with a long UNC root like //?/UNC/host/share/ walk that share, the same as //host/share/.
  • Faster ignore patterns (about 1.2 to 3 times faster), and less work for each entry in a walk (about 10% faster sync, and 15% to 30% faster async, for large trees).
  • Allow const string[] or readonly string[] as ignore option or pattern argument.
  • When the signal aborts an async walk, the walk stops. Before, it rejected, but continued to read directories.

  13

  • Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

  12

  • Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

  11.1

  ... (truncated)

  Commits

  • 240dbb7 14.0.4
  • c6105eb minimatch@11.0.5
  • 81544ff minimatch@11.0.3
  • 0159413 more readme formatting/typo fixing
  • 8652101 fix typo in JSDoc of the "cwd" option
  • fc93fd5 14.0.3
  • cfdf76a update deps
  • 54bbe8b fix windows test
  • 18a539f ci: update node versions
  • 93957bf 14.0.2
  • Additional commits viewable in compare view
  Maintainer changes

  This version was pushed to npm by isaacs, a new releaser for glob since your current version.

  Install script changes

  This version adds prepare script that runs during installation. Review the package contents before updating.

  
  

  Updates iconv-lite from 0.6.3 to 0.7.3

  Release notes

  Sourced from iconv-lite's releases.

  0.7.3

  🚀 Improvements

  • Add iso-8859-8-i and iso-8859-8-e charset aliases - by @​baptistejamin in #394

  🐞 Bug fixes

  • Fix UTF-32 streaming across chunk boundaries - by @​spokodev and @​bjohansebas in #393

    When decoding a UTF-32 stream, a 4-byte code unit split across a chunk boundary was decoded incorrectly, and a truncated trailing unit is now replaced with U+FFFD instead of being dropped. When encoding, a surrogate held over between chunks no longer throws. Whole-buffer decode/encode were unaffected.

  New Contributors

  • @​baptistejamin made their first contribution in pillarjs/iconv-lite#394
  • @​spokodev made their first contribution in pillarjs/iconv-lite#393

  Full Changelog: pillarjs/iconv-lite@v0.7.2...v0.7.3

  v0.7.2

  🐞 Bug fixes

  • Correction of CommonJS exports in TypeScript definitions - by @​plbstl in #366

    Fixed the TypeScript definitions to correctly represent the CommonJS exports of the library. This resolves issues where consumers using TypeScript would encounter errors due to incorrect type definitions that did not align with the actual module exports.

  Other changes

  • Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in pillarjs/iconv-lite#373
  • Bump actions/checkout from 4 to 6 by @​dependabot[bot] in pillarjs/iconv-lite#374
  • chore: use files field in package.json instead of .npmignore by @​bjohansebas in pillarjs/iconv-lite#372
  • Bump github/codeql-action from 4.31.2 to 4.31.9 by @​dependabot[bot] in pillarjs/iconv-lite#375
  • Bump actions/upload-artifact from 4 to 6 by @​dependabot[bot] in pillarjs/iconv-lite#377
  • Bump actions/download-artifact from 6 to 7 by @​dependabot[bot] in pillarjs/iconv-lite#376

  Full Changelog: pillarjs/iconv-lite@v0.7.1...v0.7.2

  v0.7.1

  What's Changed

  🚀 Improvements

  • types: improve type definitions and add missing APIs - by @​plbstl and @​bjohansebas in pillarjs/iconv-lite#330

  Other changes

  • Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in pillarjs/iconv-lite#357
  • Bump actions/download-artifact from 5 to 6 by @​dependabot[bot] in pillarjs/iconv-lite#356
  • Bump github/codeql-action from 3.29.8 to 4.31.2 by @​dependabot[bot] in pillarjs/iconv-lite#355

  ... (truncated)

  Changelog

  Sourced from iconv-lite's changelog.

  0.7.3

  🚀 Improvements

  • Add iso-8859-8-i and iso-8859-8-e charset aliases - by @​baptistejamin in #394

  🐞 Bug fixes

  • Fix UTF-32 streaming across chunk boundaries - by @​spokodev and @​bjohansebas in #393

    When decoding a UTF-32 stream, a 4-byte code unit split across a chunk boundary was decoded incorrectly, and a truncated trailing unit is now replaced with U+FFFD instead of being dropped. When encoding, a surrogate held over between chunks no longer throws. Whole-buffer decode/encode were unaffected.

  0.7.2

  🐞 Bug fixes

  • Correction of CommonJS exports in TypeScript definitions - by @​plbstl in #366

    Fixed the TypeScript definitions to correctly represent the CommonJS exports of the library. This resolves issues where consumers using TypeScript would encounter errors due to incorrect type definitions that did not align with the actual module exports.

  0.7.1

  🚀 Improvements

  • types: improve type definitions and add missing APIs - by @​plbstl and @​bjohansebas in #330

  0.7.0

  🐞 Bug fixes

  • Handle split surrogate pairs when encoding utf8 - by @​yosion-p and @​ashtuchkin in #282:

    Handle a case where streaming utf8 encoder (converting js strings -> buffers) encounters surrogate pairs split between chunks (last character of one chunk is high surrogate and first character of the next chunk is a low surrogate).

  • Avoid false positives in encodingExists by using objects without a prototype - by @​bjohansebas in #328

    The encodingExists method could return incorrect results if the lookup matched properties inherited from the prototype of the object that stores the encodings, such as constructor and others. This change replaces that object with one that has no prototype, ensuring that only explicitly defined valid encodings in the library are considered. In addition, the fix is applied to the internal cache system to avoid the same kind of false positives

  🚀 Improvements

  • Make explicit that decode() method supports Uint8Array input - by @​jardicc in #271
  • Remove compatibility check for StringDecoder.end method - by @​bjohansebas in #331

  Commits

  • 43694e2 release: 0.7.3 (#411)
  • 11e96b5 fix(utf32): reassemble split codepoint from overflow buffer, not source index...
  • b52b9d3 feat: support iso-8859-8-i and iso-8859-8-e charset labels (#394)
  • 2bfa5ab ci: fix workflow configuration for v0.x branch (#404)
  • 6cf4f08 release: 0.7.2 (#379)
  • 7dff5ce fix: correction of CommonJS exports in TypeScript definitions (#366)
  • 61dd902 Bump actions/download-artifact from 6 to 7 (#376)
  • eda7530 Bump actions/upload-artifact from 4 to 6 (#377)
  • 4b4e4b6 Bump github/codeql-action from 4.31.2 to 4.31.9 (#375)
  • 25c8d11 chore: use files field in package.json instead of .npmignore (#372)
  • Additional commits viewable in compare view
  Maintainer changes

  This version was pushed to npm by bsebas, a new releaser for iconv-lite since your current version.

  
  

  Updates inversify from 6.0.2 to 8.3.0

  Release notes

  Sourced from inversify's releases.

  inversify@8.3.0

  Minor Changes

  • Added Container.inspectCurrentPlan. It returns a snapshot of the plan the container would use for a get or getAll request, without resolving any service. The snapshot describes the request constraints, the selected bindings and their planned dependencies.
  • Added PlanInspection, PlanServiceInspection and PlanBindingInspection types.

  Patch Changes

  • Fixed activation and deactivation handler order. Container activation handlers run from parent containers to child containers. Container deactivation handlers run from child containers to parent containers, before the binding handler and @preDestroy.
  • Updated dependencies
    • @​inversifyjs/core@​15.1.0
    • @​inversifyjs/container@​3.2.0

  inversify@8.2.4

  Patch Changes

  • Parity version.
  • Updated dependencies
    • @​inversifyjs/common@​2.0.2
    • @​inversifyjs/container@​3.1.4
    • @​inversifyjs/core@​15.0.2

  Commits

  • a13778d Merge pull request #2232 from inversify/changeset-release/main
  • 1cdecdf chore: bump package versions
  • 42371f5 Merge pull request #2231 from inversify/fix/activion-deactivation-order
  • e501ed9 fix: activation and deactivation order
  • f878acc Merge pull request #2230 from inversify/feat/container-instrospection
  • 4de29b0 test: add missing tests
  • 1b8838b feat: add Container.inspectCurrentPlan
  • 2e06528 Merge pull request #2228 from inversify/changeset-release/main
  • 15e077e chore: bump package versions
  • 58478f8 Merge pull request #2227 from inversify/fix/http-core-logger-usage
  • Additional commits viewable in compare view
  Maintainer changes

  This version was pushed to npm by notaphplover, a new releaser for inversify since your current version.

  
  

  Updates jsonc-parser from 3.2.0 to 3.3.1

  Release notes

  Sourced from jsonc-parser's releases.

  v3.3.1

  Changes:

  • #92: remove exports, prepare 3.3.1

  This list of changes was auto generated.

  v3.3.0

  Changes:

  Feature Requests:

  • #11: Can we have a "insertFinalNewline" option in "FormattingOptions"?
  • #4: Source map referenced but not included in published package

  Bugs:

  • #33: Formatting valid json content is causing an invalid json
  • #40: parseTree() returns undefined on empty string input

  Others:

  • #90: prepare 3.3.0
  • #88: Allow the visitor to cease callbacks
  • #89: Bump braces from 3.0.2 to 3.0.3

  • #84: prepare 3.2.1
  • #81: perf(format): cache breaklines and spaces as much as possible
  • #79: update dependencies
  • #75: ci: add batch
  • #72: delete pr-chat action
  • #71: add publish pipeline & cleanup ci
  • #70: set preserveConstEnums: true, switch to es2020
  • #69: sort edits in applyEdits
  • #66: An additional parameter keepLines has been added into the formatting options which allows to keep the original line formatting
  • #64: Adding Microsoft SECURITY.MD
  • #62: Add JSON path supplier parameter to visitor functions
  • #44: findNodeAtLocation does not handle incomplete property pair
  • #61: Update API section in README
  • #53: Clarify whether / how Edit[] can be concatenated
  • #46: Non-standard whitespace handling

  ... (truncated)

  Changelog

  Sourced from jsonc-parser's changelog.

  4.0.0-next.1 2026-03-04

  • package is now ESM-only.
  • remove UMD build and package entrypoints.

  3.3.0 2022-06-24

  • JSONVisitor.onObjectBegin and JSONVisitor.onArrayBegin can now return false to instruct the visitor that no children should be visited.

  Commits

  • 3c9b420 remove exports, prepare 3.3.1 (#92)
  • 4f3cf98 prepare 3.3.0 (#90)
  • 9e24580 Allow the visitor to cease callbacks (#88)
  • cfe32ac Bump braces from 3.0.2 to 3.0.3 (#89)
  • b6b34ba prepare 3.2.1 (#84)
  • c6d4008 perf(format): internalize breaklines and spaces as much as possible (#81)
  • e82ebd9 update dependencies (#79)
  • 18b2209 ci: add batch (#75)
  • c241fb3 delete pr-chat action (#72)
  • 4fa9c85 add publish pipeline & cleanup ci (#71)
  • See full diff in compare view
  Maintainer changes

  This version was pushed to npm by vscode-bot, a new releaser for jsonc-parser since your current version.

  
  

  Updates minimatch from 5.1.8 to 11.0.5

  Changelog

  Sourced from minimatch's changelog.

  change log

  11.0

  • Match each path portion with Matcher from @isaacs/nonrecursive-glob-match, in place of a RegExp. Items in Minimatch.set are now strings, Matcher objects, or GLOBSTAR.
  • Remove makeRe(), Minimatch#regexp, and the MMRegExp type.
  • Remove the AST class.
  • Remove the maxExtglobRecursion option.
  • An empty path portion, such as the last one in a/b/, only matches an empty pattern portion. So a/b/ no longer matches a/b/?(x) or a/b/*(x), the same as a/b/*.
  • Add the normalize option, to normalize unicode in the pattern and in each portion of the tested path.
  • Remove the debug option and the debug() method.
  • Remove the matchOne(), slashSplit(), and levelTwoFileOptimize() methods. They are internal now.
  • Fix patterns with more than one ** and sections of different lengths between them, such as **/a/b/c/**/d/**, which failed to match some paths since 10.2.3.
  • Fix partial matching of patterns with **, which since 10.2.3 matched some paths under a dot portion that ** can not walk, and did not match some paths that end in the pattern's last portion.
  • partial matching of patterns with many ** no longer takes exponential time.
  • On Windows, a .. no longer removes the drive letter, or the host and share of a UNC path, at the start of a pattern or (at optimization level 2) a path. So C:/a/../../x no longer matches x or /x.
  • On Windows, compare the host and share of UNC paths like //host/share/... case-insensitively, the same as drive letters.
  • On Windows, long UNC paths like //?/UNC/host/share/... match //host/share/... and vice versa, the same as //?/c:/... and c:/....
  • At optimization level 2, throw a RangeError if splitting **/.. portions would make more than braceExpandMax patterns, or add more than 1,000,000 path portions. Before, a short pattern could take minutes to compile.
  • At optimization level 2, dedupe patterns without comparing each pair, so that a large set is deduped in about linear time. Fix {**/x,x/y}, which was deduped to **/x, so x/y did not match.
  • Match a numeric brace range of 100 or more values, such as {0..999}, as one pattern portion, in place of one pattern for each value. For a glob walk, this is one directory read, in place of a stat for each value. hasMagic() is true for these

  ... (truncated)

  Commits

  • ea0a4a6 11.0.5
  • e83fdf3 match large numeric brace ranges without expanding them
  • 85d681c fixup! ci: update github actions to latest major versions
  • a675e79 ci: update github actions to latest major versions
  • 70f442d dedupe level 2 patterns without a pairwise compare
  • b2d7c28 ci: increase timeout on test
  • 2d5578b throw when **/.. pattern expansion goes above the limit
  • 9c6ebb1 fix: reject incomplete glob split expansions
  • 73f0e1b fix: bound total cells added by the glob split pass
  • f24eba9 11.0.4
  • Additional commits viewable in compare view
  Install script changes

  This version adds prepare script that runs during installation. Review the package contents before updating.

  
  

  Updates node-stream-zip from 1.15.0 to 1.16.0

  Changelog

  Sourced from node-stream-zip's changelog.

  v1.16.0 (2026-07-22)

  + fixed reading compressed entry size to prevent exploitation reported by @​DumDumSu
* updated dependencies

  Commits

  • 2d9da01 release 1.16.0
  • d6646bf up deps
  • b9b496a fixed reading compressed entry size
  • a050b3f fixed tests
  • 7c5d503 readme
  • c7cd392 removed a duplicated test
  • f58b5b8 node.js 14
  • 74f30a3 node.js 12
  • 571f55b node.js 12
  • See full diff in compare view
  
  

  Updates rxjs from 6.6.7 to 7.8.2

  Changelog

  Sourced from rxjs's changelog.

  7.8.2 (2025-02-22)

  Bug Fixes

  • animationFrameScheduler: some tasks are never flushed and sometimes it breaks completely (#7444) (8bbfa4e)
  • mergeWith: works correctly with an Array (#7281) (27855c6)
  • subscriber: strict type signature for next method (#7172) (0e2ef5e)

  7.8.1 (2023-04-26)

  Bug Fixes

  • asapScheduler: No longer stops after scheduling twice during flush (#7198) (1b52405), closes ReactiveX#7196
  • throttle: properly handle default ThrottleConfig values (#7176) (ceb821c)

  7.8.0 (2022-12-15)

  Features

  • buffer: closingNotifier now supports any ObservableInput (#7073) (61b877a)
  • delayWhen: delayWhen's delayDurationSelector now supports any ObservableInput (#7049) (dfd95db)
  • sequenceEqual: compareTo now supports any ObservableInput (#7102) (d501961)
  • share: ShareConfig factory properties now supports any ObservableInput (#7093) (cc3995a)
  • skipUntil: notifier now supports any ObservableInput (#7091) (60d6c40)
  • window: windowBoundaries now supports any ObservableInput (#7088) (8c4347c)

  7.7.0 (2022-12-15)

  Features

  • distinct: flush argument now supports any ObservableInput (#7081) (74c9ebd)
  • repeatWhen: notifier supports ObservableInput (#7103) (8f1b976)
  • retryWhen: notifier now supports any ObservableInput (#7105) (794f806)
  • sample: notifier now supports any ObservableInput (#7104) (b18c2eb)

  7.6.0 (2022-12-03)

  Bug Fixes

  • schedulers: no longer cause TypeScript build failures when Node types aren't included (c1a07b7)
  • types: Improved subscribe and tap type overloads (#6718) (af1a9f4), closes #6717

  Features

  • onErrorResumeNextWith: renamed onErrorResumeNext and exported from the top level. (onErrorResumeNext operator is stil available, but deprecated) (#6755) (51e3b2c)

  7.5.7 (2022-09-25)

  Bug Fixes

  ... (truncated)

  Commits

  • e5351d0 chore(publish): 7.8.2
  • 8bbfa4e fix(animationFrameScheduler): some tasks are never flushed and sometimes it b...
  • 4a2d0d2 docs(rxjs.dex): replace polyfill.io with a Cloudflare equivalent (#7487)
  • 2fb0740 chore: 7.x remove global npm install and ignore latest TS (#7398)
  • d69d890 docs: fix missing overloads in docs when overload count is less than 3 (#7367...
  • 27855c6 fix(mergeWith): works correctly with an Array (#7281)
  • 9db6563 docs: provide URL for the V8 docs app (#7244)
  • 5c3fb33 docs: add MonoTypeOperatorFunction documentation (#7284)
  • 0e2ef5e fix(subscriber): strict type signature for next method (#7172)
  • b6d00c1 docs: improve glossary and semantics page (#7267)
  • Additional commits viewable in compare view
  
  

  Updates semver from 7.8.5 to 7.8.6

  Release notes

  Sourced from semver's releases.

  v7.8.6

  7.8.6 (2026-11-02)

  Bug Fixes

  • 69b305d #918 improve range parsing performance (#918) (@​reggi, @​Copilot)

  Chores

  • 7257c14 #917 cover comparator normalization (#917) (@​reggi, @​Copilot)

  Changelog

  Sourced from semver's changelog.

  7.8.6 (2026-11-02)

  Bug Fixes

  • 69b305d #918 improve range parsing performance (#918) (@​reggi, @​Copilot)

  Chores

  • 7257c14 #917 cover comparator normalization (#917) (@​reggi, @​Copilot)

  Commits

  • b37b033 chore: release 7.8.6 (#940)
  • 69b305d fix: improve range parsing performance (#918)
  • 7257c14 chore: cover comparator normalization (#917)
  • See full diff in compare view
  
  

  Updates @types/semver from 5.5.0 to 7.8.0

  Commits

  • See full diff in compare view
  
  

  Updates stack-trace from 0.0.10 to 1.0.0

  Release notes

  Sourced from stack-trace's releases.

  v1.0.0

  What's Changed

  • Updated CallSite object API link by @​DylanTackoor in felixge/node-stack-trace#28
  • test on Node.js 8 by @​mightyiam in felixge/node-stack-trace#24
  • fix test-long-stack-trace.js by @​mightyiam in felixge/node-stack-trace#23
  • use npm scripts instead of Makefile by @​mightyiam in felixge/node-stack-trace#22
  • Exclude unnecessary files from the npm package by @​pkuczynski in felixge/node-stack-trace#33
  • Fix: Correctly parse paths with braces by @​timfish in felixge/node-stack-trace#32
  • Feature/esm jest by @​niemyjski in felixge/node-stack-trace#35
  • Adjust node engine requirements to be less restrictive by @​mweichert in felixge/node-stack-trace#39
  • fix(tests): make stack frame comparison test environment-independent for Jest 30 upgrade by @​niemyjski in felixge/node-stack-trace#65
  • Migrate tests to native node:test, remove Babel/Jest tooling, and clarify long-stack-trace behavior by @​niemyjski in importlib-metadata and tomli.

    Updates importlib-metadata from 9.0.1 to 10.2.0

    Changelog

    Sourced from importlib-metadata's changelog.

    v10.2.0

    Features

    • Restored csv, inspect, json, zipfile, _adapters, and importlib.metadata to module scope, where a reader can see what the module depends on, instead of hiding them in the functions that use them for performance. They are declared in __lazy_modules__ and so stay deferred, and deferred alike on every supported Python: 3.15 honors the declaration natively (PEP 810) and earlier Pythons reach the same behavior through the lazy-importer backport, which is now a dependency there. (#554)

    Bugfixes

    • MetadataPathFinder is now installed on sys.meta_path only after the module is fully initialized. Previously it was installed partway through, so anything walking sys.meta_path during that window, such as another thread calling entry_points(), would raise NameError: name 'PathDistribution' is not defined. An import interrupted in that window left the half-built finder installed for the life of the process, failing every subsequent lookup. (#525)
    • Return License-File, Import-Name, and Import-Namespace as lists in JSON-compatible metadata, including when only one value is present, and retain all repeated values as required by PEP 566.

    Improved Documentation

    • Added a caveats page describing how this package and importlib.metadata interoperate: the two class hierarchies, the protocols both satisfy, and what that asks of consumers and of custom providers. (#505)

    v10.1.0

    Features

    • Detecting whether a distribution supplies metadata no longer reads or parses that metadata where the metadata directory can be inspected instead, so retrieving a distribution by name, which prefers the valid candidates, is substantially faster.
    • Reverted the preference for the greater metadata directory added in v9.1.0. The ordering was lexicographic on the directory name and not on the parsed version, so it only approximated a preference for the newer version. Where a path supplies more than one metadata directory for a distribution, discovery once again reports them in the order the path supplies python/cpython#100666

    ... (truncated)

    Commits

    • 7e35ac1 Finalize
    • 93b8d15 Merge pull request #545 from kokotatan/fix-json-multiple-use-metadata
    • 57db4ad Merge pull request #557 from python/feature/eager-imports
    • 43c451e Keep only the lazy import test that is about this package.
    • 61af6b3 Import the adapters as a module where that is possible.
    • 1d5a2ce Merge pull request #556 from python/bugfix/525-install-after-init
    • fa2b269 Stop returning the class from install.
    • 579d2e9 Move the install expectation to tests/compat.
    • c52e108 Carry the rationale in install, not at the call site.
    • 8495a7f Resolve a lazy name before isinstance.
    • Additional commits viewable in compare view
    
    

    Updates tomli from 2.4.1 to 2.5.0

    Changelog

    Sourced from tomli's changelog.

    2.5.0

    • Added
      • Binary wheels for Python 3.15
    • Fixed
      • Set nested inline array/table limit to 400 to fix mypyc generated binaries crashing unrecoverably in constrained environments (e.g. worker thread in a python:3.13-alpine image)

    2.3.1

    • Fixed
      • Backport: Limit number of parts of a TOML key to address quadratic time complexity

    Commits

    • a2a5789 Bump version: 2.4.1 → 2.5.0
    • 94a6081 Add 2.5.0 changelog
    • 85f8748 Update README.md
    • 70fd460 Allow flit_core v4
    • 00d0610 Update pre-commit
    • eb93c12 Improve tomllib compatibility and sync docs (#299)
    • 18d8d59 Bump cibuildwheel for Python 3.15 wheels (#317)
    • 1e6e869 Set smaller MAX_INLINE_NESTING to avoid python:3.13-alpine worker thread crash
    • c329998 Use Trusted Publishing
    • ba611c5 Add zizmor security scanner to pre-commit (#301)
    • Additional commits viewable in compare view