[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ovsx (source)	0.10.9 → 1.3.0

---

Release Notes

eclipse-openvsx/openvsx (ovsx)

v1.3.0

Compare Source

Changed

• publish checks a package against the size limit that applies to its own namespace, which a size override can raise above the registry default, and refuses an oversized upload before sending it. Against a registry older than 1.3.0, which cannot report that limit, it warns against the default and publishes anyway; if a registry that should be able to report it does not answer, it says the check did not happen rather than passing silently (#​2129)

Fixed

• --version reads the version from package.json at runtime instead of a generated src/version.ts, so it can no longer report a stale version (#​2295)
• publish now deletes the .vsix it packages into the temp directory once publishing finishes or fails, instead of leaving one behind per package and target (#​2286)
• Drop the X-OpenVSX-Token header, which carries the personal access token when --username/--password are set, on a redirect to another origin, as is done for Authorization (#​2309)
• A request with a body that is redirected with 301/302/303 now fails with an error naming the redirect target, instead of being resent as a GET without its body (#​2309)
• Trusted publishing's OIDC ID token request now uses the registry client's request handling: it follows redirects (dropping the runner token on a redirect to another origin) and reports the token service's error message instead of only its status (#​2322)
• An HTML page in a successful response (any <!doctype html> casing, or a text/html Content-Type) now fails with an error naming the status, instead of printing the raw HTML or a JSON SyntaxError (#​2326)
• An error response whose JSON body starts with whitespace now reports the server's message instead of only its status (#​2326)

Dependencies

• Bump commander from 6.2.1 to 14.0.3; a command given more arguments than it takes now fails instead of ignoring the extras (#​2294)
• Bump @​vscode/vsce from 3.7.1 to 4.0.0 (#​2288)
• Bump vitest from 4.1.11 to 5.0.3, adding vite as a direct dev dependency - vitest 5 no longer bundles it, only requires it as a peer (#​2291)
• Remove leven; the command-suggestion distance check now uses a vendored Levenshtein implementation, the same way @vscode/vsce itself replaced its own leven dependency in 4.0.0 (#​2290)
• Remove tmp; temporary file names are now generated with crypto.randomUUID (#​2284)
• Remove follow-redirects; requests use node:http/node:https and the registry client follows redirects itself (#​2309)
• Bump ip-address from 10.4.0 to 10.7.2 (#​2264)
• Bump brace-expansion to 1.1.21, 2.1.7, 5.0.12
• Bump markdown-it from 14.2.0 to 14.3.2 (#​2281)

v1.2.0

Compare Source

Added

• Add --follow-symlinks to publish, forwarding vsce's option of the same name so that the file walk recurses into symlinked directories instead of packing each symlink as a file. Needed for a node_modules assembled out of symlinks, as pnpm's is (#​368)
• Add search command to search the registry for extensions, mirroring the web UI's search: --category, --target, --sort-by and --sort-order narrow the query, --size and --offset page through the results, and --json prints the registry's raw response (#​2154)
• Add list command to print the extensions a namespace holds, sorted by name so the output stays stable across registries, with --json for the raw namespace metadata (#​2154)
• Add show command to print an extension's metadata, mirroring vsce show: identity, publisher, rating, notices and a version history listing each version's target platforms (#​2149). namespace.extension@version reports a single version, --target scopes the report to one target platform, --all-versions lists every published version instead of the most recent few, and --json prints the registry's raw metadata
• Add unpublish command to delete an extension or some of its versions, mirroring vsce unpublish (#​1958); requires a registry running version 1.2.0 or later, which unpublish checks for before deleting
• publish checks the packaged extension's size against the limit reported by the registry's /api/version endpoint before uploading, instead of failing only after the upload completes (#​1953)
• Add verify command to check a downloaded .vsix package's signature against the registry's public key, mirroring vsce verify-signature (#​993)
• Add verify-signature command, verifying an already-extracted package/manifest/signature file trio entirely offline (no registry involved), matching vsce verify-signature's own command shape (#​993)

Fixed

• Error messages naming a URL no longer include its query string, which for createNamespace, verifyPat, publish and delete carried the personal access token straight to stderr and into CI logs (#​2186)

• A connection lost after a JSON response has started no longer leaves the command waiting on a body that is not coming: the response's own error is now what settles the request, so it fails with the reset rather than hanging (#​2186)

• Requests now give up after 30 seconds without progress instead of hanging indefinitely when a server accepts a connection and then says nothing. OVSX_TIMEOUT overrides the duration in milliseconds and OVSX_TIMEOUT=0 disables it; it measures inactivity, so a large extension downloading slowly is unaffected, and it covers the trusted-publishing ID token request as well as the registry's own (#​2186)

• Fix downloads that could be read before they were written. download resolved when the response ended rather than when the file was closed, and a write stream opens and flushes asynchronously, so a caller reading the path immediately afterwards could find the file empty or absent - which verify did, intermittently failing to read the public key it had just fetched. A failed download no longer touches the target path: the body is written beside it and renamed into place only once it has arrived whole, so a 404 or a dropped connection leaves what was there alone. A connection dropped mid-download now rejects rather than leaving the caller waiting forever (#​2185)

Changed

• createNamespace, verifyPat, publish and delete now send the personal access token primarily via an Authorization: Bearer header (or, when OVSX_USERNAME/OVSX_PASSWORD are set, an X-OpenVSX-Token header, since Authorization is then already in use for Basic auth to a fronting proxy), moving away from a token query parameter that gets recorded in server and reverse-proxy access logs. The CLI checks the registry's reported version (/api/version) and only still sends the token as a query parameter, alongside the header, when talking to a registry older than 1.3.0, i.e. one that predates header support - including one whose version can't be determined at all, which is treated as too old rather than assumed to be caught up; on 1.3.0 and later the header is all it sends (#​1344)
• publish --trusted-publishing retries the token exchange when the registry answers that it could not verify the ID token (502, 503, 504), rather than failing the build on a blip reaching the identity provider. A refusal is never retried
• publish --trusted-publishing requests a new token and retries once when the registry refuses the one it was publishing with. The issued token is short-lived and shared by every target platform of a release, so publishing a wide fan-out of large packages could outlive it and fail partway through. Targets that are refused together share one new token, and a token supplied with --pat is never retried
• Bump minimum supported Node.js version to 22, matching the webui component

Dependencies

• Bump fast-uri from 3.1.5 to 3.1.7
• Bump qs from 6.15.2 to 6.16.0
• Bump @​humanfs/node from 0.16.6 to 0.16.8
• Bump js-yaml from 4.3.1 to 4.3.2
• Bump nanoid from 3.3.16 to 3.3.18

v1.1.1

Compare Source

Dependencies

• Bump ip-address from 10.2.0 to 10.4.0
• Bump fast-uri from 3.1.4 to 3.1.5
• Bump js-yaml from 4.3.0 to 4.3.1

v1.1.0

Compare Source

Added

• Add an encrypted filestore as fallback to the system keychain if it cant be accessed (#​1950)
• Add --allow-missing-repository option to the publish command, passed on to vsce to package an extension whose package.json has no repository field without asking for confirmation (#​1735)
• Support trusted publishing: publish can exchange an OIDC ID token for a short-lived publishing token, via --trusted-publishing, --idToken and --oidcAudience

Changed

• Replace keytar with cross-keychain to store credentials in the system keychain (#​1950)
• Mask token input when using login command (#​1966

Dependencies

• Bump js-yaml from 4.2.0 to 4.3.0 (#​1976)
• Bump tar from 7.5.16 to 7.5.21 (#​1987)
• Bump brace-expansion from 1.1.16 to 1.1.18 (#​2031)

v1.0.2

Compare Source

Dependencies

• Bump tmp from 0.2.6 to 0.2.7 (#​1903)
• Bump tar from 7.5.11 to 7.5.16 (#​1911)
• Bump form-data from 4.0.4 to 4.0.6 (#​1910)
• Bump js-yaml from 4.1.1 to 4.2.0 (#​1912)
• Bump markdown-it from 14.1.1 to 14.2.0 (#​1913)

v1.0.1

Compare Source

Fixes

• Properly encode path segments in getUrl method (#​1893)

v1.0.0

Compare Source

Dependencies

• Bump fast-uri from 3.1.0 to 3.1.2 (#​1829)
• Bump brace-expansion from 5.0.5 to 5.0.6 (#​1846)
• Bump qs from 6.15.0 to 6.15.2 (#​1869)
• Bump tmp from 0.2.4 to 0.2.6 (#​1877)

v0.10.12

Compare Source

Dependencies

• Bump follow-redirects from 1.15.6 to 1.16.0 (#​1759)
• Bump ip-address from 10.1.0 to 10.2.0 (#​1820)

v0.10.11

Compare Source

Dependencies

• Bump picomatch from 2.3.1 to 2.3.2 (#​1719)
• Bump picomatch from 4.0.3 to 4.0.4
• Bump brace-expansion from 1.1.12 to 1.1.13 (#​1725)
• Bump brace-expansion from 2.0.2 to 2.0.3
• Bump brace-expansion from 5.0.4 to 5.0.5
• Bump lodash from 4.17.23 to 4.18.1 (#​1745)

v0.10.10

Compare Source

Dependencies

• Bump ajv from 6.12.6 to 6.14.0 (#​1632)
• Bump ajv from 8.17.1 to 8.18.0
• Bump tar from 7.5.7 to 7.5.11 (#​1681)
• Bump minimatch to 3.1.5, 9.0.9 and 10.2.4
• Bump underscore from 1.13.6 to 1.13.8 (#​1656)
• Bump flatted from 3.3.1 to 3.4.2 (#​1703)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.