Skip to content

chore: update VS Code plugin npm dependencies (consolidate dependabot PRs)#733

Draft
Copilot wants to merge 2 commits intomainfrom
copilot/update-dependencies-devskim-plugin
Draft

chore: update VS Code plugin npm dependencies (consolidate dependabot PRs)#733
Copilot wants to merge 2 commits intomainfrom
copilot/update-dependencies-devskim-plugin

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Mar 26, 2026

Summary

Consolidates 6 open Dependabot security PRs (#725, #727, #728, #729, #730, #731) into a single dependency update by running npm audit fix (and npm audit fix --force for the client where a major version bump was needed).

Changes

DevSkim-VSCode-Plugin/ (root)

  • picomatch bumped from 2.3.1 → 2.3.2
  • undici bumped to 7.24.6
  • qs bumped to 6.15.0
  • minimatch bumped to latest patched versions
  • Additional transitive dependency fixes

DevSkim-VSCode-Plugin/client/

  • @vscode/test-electron bumped from 1.6.1 → 2.5.2 (major bump; removes vulnerable @tootallnate/once and http-proxy-agent)
  • minimatch bumped to 3.1.5

Changelog.md — new entry [1.0.77] documenting all dependency updates

Dependabot PRs Resolved

PR Package Change
#725 qs 6.14.1 → 6.15.0
#727 minimatch (client) 3.1.2 → 3.1.5
#728 minimatch (root) 3.1.2/10.1.2 → 3.1.5/10.2.4+
#729 @vscode/test-electron + @tootallnate/once 1.6.1 → 2.5.2
#730 undici 7.20.0 → 7.24.6
#731 picomatch 2.3.1 → 2.3.2

Both npm audit runs now report 0 vulnerabilities.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants