Repository navigation
Fix Dependabot alerts and publish under prefix-dev - #59
Merged
Merged
Conversation
- Update vulnerable dev dependencies (fast-uri, brace-expansion, browserslist, baseline-browser-mapping) - Override minimatch to ^11.0.1 for GHSA-g3hv-75wg-m249 - Change publisher to prefix-dev and update repository links - Pin @vscode/vsce and ovsx as devDependencies - Fix undefined FETCH_DEPTH in release workflow
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security
npm audit fixresolves all 15 open Dependabot alerts (fast-uri→ 3.1.9,brace-expansion→ 5.0.12,browserslist→ 4.29.5,baseline-browser-mapping→ 2.11.35).overridesentry forcingminimatchto^11.0.1(GHSA-g3hv-75wg-m249). It's pulled in by eslint, typescript-eslint and vsce, all build-time only. Their declared range is^10, but lint andvsce package(including.vscodeignorematching) work fine with 11.npm auditnow reports 0 vulnerabilities.Publish under
prefix-devpublisheris nowprefix-dev, so the extension ID becomesprefix-dev.pixi-code(also updatedEXTENSION_IDinsrc/common/utils.ts).prefix-dev/pixi-code.CI
@vscode/vsceandovsxas devDependencies and call them withnpx --no-install, so publishing uses locked versions.env.FETCH_DEPTHinrelease.yaml.Before merging
Every push to
mainpublishes a pre-release, so these need to be in place first:MARKETPLACE_TOKEN: a PAT for theprefix-devpublisher on the VS Code Marketplace.OPENVSX_TOKEN: a token with access to theprefix-devnamespace on OpenVSX (npx ovsx create-namespace prefix-dev -p <token>if it doesn't exist).Existing installs of
renan-r-santos.pixi-codewon't migrate automatically. Deprecating the old listing in favour of the new ID would help users find it.Test plan
npm run format:checknpm run lintnpm run compile-testsnpm run compilevsce package(contents verified: only dist, assets, README, CHANGELOG, LICENSE, RELEASE.md, package.json)🤖 Generated with Claude Code