[dependabot]

Bumps the dependencies group with 4 updates in the / directory: actions/setup-python, dtolnay/rust-toolchain, github/codeql-action/init and github/codeql-action/analyze.
Bumps the dependencies group with 2 updates in the /.github/actions/build-vsix directory: actions/setup-python and dtolnay/rust-toolchain.
Bumps the dependencies group with 1 update in the /.github/actions/lint directory: actions/setup-python.
Bumps the dependencies group with 3 updates in the /.github/actions/smoke-tests directory: actions/setup-python, actions/setup-node and actions/download-artifact.

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
• Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
• Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350

New Contributors

• @​luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
• 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
• e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
• 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
• af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
• 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
• Additional commits viewable in compare view

Updates dtolnay/rust-toolchain from 7e38f4b43b4db5c8dd498af069a4f6196df1d067 to 683b588c487a69d01f6c6ddf40f036ff682cc2c8

Commits

• 683b588 Add 1.99.1 patch release
• e2a55d2 Merge pull request #187 from dtolnay/pwn
• 6af9a09 Unify flags[@] and downgrade[@]
• 83d0610 Safely handle action inputs
• See full diff in compare view

Updates github/codeql-action/init from 4.37.9 to 4.39.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

v4.39.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Update default CodeQL bundle version to 2.27.4. #4284

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

• 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
• b5e1ed9 Trigger workflows
• 20f5ec3 Update changelog for v4.39.1
• c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
• 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
• 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
• b96e339 Change comment for getConfig call in upload-sarif
• 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
• a69c7cb Document that setting the env vars to false takes precedence
• 74ddcd9 Fix typo in comment
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.9 to 4.39.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

v4.39.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Update default CodeQL bundle version to 2.27.4. #4284

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

• 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
• b5e1ed9 Trigger workflows
• 20f5ec3 Update changelog for v4.39.1
• c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
• 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
• 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
• b96e339 Change comment for getConfig call in upload-sarif
• 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
• a69c7cb Document that setting the env vars to false takes precedence
• 74ddcd9 Fix typo in comment
• Additional commits viewable in compare view

Updates dtolnay/rust-toolchain from 7e38f4b43b4db5c8dd498af069a4f6196df1d067 to 1

Commits

• 683b588 Add 1.99.1 patch release
• e2a55d2 Merge pull request #187 from dtolnay/pwn
• 6af9a09 Unify flags[@] and downgrade[@]
• 83d0610 Safely handle action inputs
• See full diff in compare view

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
• Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
• Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350

New Contributors

• @​luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
• 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
• e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
• 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
• af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
• 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
• Additional commits viewable in compare view

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
• Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
• Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350

New Contributors

• @​luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
• 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
• e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
• 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
• af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
• 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
• Additional commits viewable in compare view

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
• Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
• Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350

New Contributors

• @​luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
• 6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
• e1be392 Bump @​types/semver from 7.7.1 to 7.8.0 (#1359)
• 06da627 Bump @​vercel/ncc from 0.44.0 to 0.45.0 (#1357)
• af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
• 7aeabeb Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
• Additional commits viewable in compare view

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
• Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
• Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350

New Contributors

• @​luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

• 6d4fd22 Cache upgrade to 6.3.0 (#1370)
• ec52d0a Bump @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
• ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
• 0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
• 3892123 Bump ts-jest from 29.4.11 to 29.4.14 (arch 2.2.0 3.0.0 fs-extra 11.2.0 11.4.1 glob 7.2.0 14.0.3 iconv-lite 0.6.3 0.7.3 inversify 6.0.2 8.2.3 jsonc-parser 3.2.0 3.3.1 minimatch 5.1.8 11.0.3 node-stream-zip 1.15.0 1.16.0 rxjs 6.6.7 7.8.2 stack-trace 0.0.10 1.0.0 vscode-debugprotocol 1.35.0 1.51.0 vscode-jsonrpc 9.0.0-next.5 10.0.0 vscode-languageclient 10.0.0-next.12 11.0.0 vscode-languageserver-protocol 3.17.6-next.10 3.18.5 vscode-tas-client 0.1.84 0.3.3 which 2.0.2 7.0.0 winreg 1.2.4 1.2.5 @types/winreg 1.2.31 1.2.36 xml2js 0.5.0 0.6.2 @types/bent 7.3.3 7.3.8 @types/chai-arrays 2.0.0 2.0.3 @types/download 8.0.3 8.0.5 @types/glob 7.2.0 9.0.0 @types/lodash 4.14.181 4.17.27 @types/node 22.19.3 26.6.6 @types/semver 5.5.0 7.8.0 @types/shortid 0.0.29 2.2.0 @types/stack-trace 0.0.29 0.0.33 @types/tmp 0.0.33 0.2.6 @types/vscode 1.100.0 1.144.0 @types/which 2.0.1 3.0.4 @types/winreg 1.2.31 1.2.36 @types/xml2js 0.4.9 0.4.14 @typescript-eslint/eslint-plugin 6.21.0 8.72.1 @typescript-eslint/parser 6.21.0 8.72.1 @vscode/vsce 3.9.2 4.1.0 chai 4.3.6 6.3.0 chai-as-promised 7.1.1 8.0.2 @types/chai-as-promised 7.1.5 8.0.2 cross-env 7.0.3 10.1.0 cross-spawn 6.0.6 7.0.6 del 6.0.0 9.0.1 eslint 8.57.1 10.14.0 eslint-config-prettier 8.5.0 10.1.8 eslint-plugin-import 2.31.0 2.32.0 eslint-plugin-jsx-a11y 6.5.1 6.10.2 eslint-plugin-no-only-tests 3.3.0 3.4.0 eslint-plugin-react 7.29.4 7.37.5 eslint-plugin-react-hooks 4.4.0 7.1.1 expose-loader 3.1.0 5.0.1 flat 5.0.2 6.0.1 get-port 5.1.1 7.2.0 gulp 5.0.0 5.0.1 mocha 11.8.0 12.0.3 mocha-junit-reporter 2.0.2 2.2.1 mocha-multi-reporters 1.5.1 1.5.2 node-loader 1.0.3 2.1.0 node-polyfill-webpack-plugin 1.1.4 4.1.0 prettier 2.0.2 3.9.10 sinon 18.0.0 22.1.0 @types/sinon 17.0.3 22.0.2 ts-loader 9.2.8 9.6.2 ts-node 10.7.0 10.9.2 tsconfig-paths-webpack-plugin 3.5.2 4.2.0 typescript 5.9.3 7.0.2 uuid 14.0.0 14.0.3 webpack 5.105.0 5.112.2 webpack-bundle-analyzer 4.5.0 5.4.0 webpack-cli 4.9.2 7.3.1 webpack-merge 5.8.0 6.0.1 yargs 15.3.1 18.2.0 typescript 5.9.3 7.0.2 @types/vscode 1.100.0 1.144.0

  Bumps the dependencies group with 3 updates in the /pythonExtensionApi directory: @types/vscode, typescript and source-map.

  Updates arch from 2.2.0 to 3.0.0

  Commits

  • 711dc8e 3.0.0
  • 0ed871e Merge pull request #22 from jakejarvis/detect-arm
  • 6a6c1f9 Detect ARM64 macOS running on Apple Silicon
  • See full diff in compare view
  
  

  Updates fs-extra from 11.2.0 to 11.4.1

  Changelog

  Sourced from fs-extra's changelog.

  11.4.1 / 2026-09-22

  • Properly handle read errors (e.g. due to permissions) in emptyDir*() (#1080)
  • Allow renaming with only Unicode normalization difference in the filename (APFS-specific) (#859, #1079)

  11.4.0 / 2026-07-23

  • Proper EEXIST error when trying to create a symlink and the dest already exists as a broken symlink (#925, #1076)

  11.3.6 / 2026-06-29

  • Fix handling of symlinked destination ancestors in copy/move methods (#1071, #1073)
  • Docs typo fixed (#1074)

  11.3.5 / 2026-05-06

  • Fix ensureLink*/ensureSymlink* identical file detection on Windows (#1068)
  • Fix error handling in timestamp preservation code (#1065, #1069)
  • Fix potential file descriptor leak on error in synchronous timestamp preservation code (#1066)

  11.3.4 / 2026-03-03

  • Fix bug where calling ensureSymlink/ensureSymlinkSync with a relative srcPath would fail if the symlink already existed (#1038, #1064)

  11.3.3 / 2025-12-18

  • Fix copying symlink when destination is a symlink to the same target (#1019, #1060)

  11.3.2 / 2025-09-15

  • Fix spurrious UnhandledPromiseRejectionWarning that could occur when calling .copy() in some cases (#1056, #1058)

  11.3.1 / 2025-08-05

  • Fix case where move/moveSync could incorrectly think files are identical on Windows (#1050)

  11.3.0 / 2025-01-15

  • Add promise support for newer fs methods (#1044, #1045)
  • Use fs.opendir in copy()/copySync() for better perf/scalability (#972, #1028)

  Commits

  • 1e223d3 11.4.1
  • 8cfd0a0 Remove obsolete docs note
  • de72292 Treat Unicode-normalization-only renames like case-only renames (#1079)
  • 7e0ce7f Remove broken link (#1083)
  • 00e858c Update GH Actions versions (#1082)
  • f829cc9 fix: propagate emptyDir directory read errors (#1080)
  • 53a8d1a 11.4.0
  • 9c2d3c9 Throw EEXIST when ensureSymlink dest is a broken symlink (#1076)
  • 62a4e72 11.3.6
  • 01c0ca6 Fix copy/move recursing into source through a symlinked dest ancestor (#1073)
  • Additional commits viewable in compare view
  
  

  Updates glob from 7.2.0 to 14.0.3

  Changelog

  Sourced from glob's changelog.

  changeglob

  14

  • Use minimatch 11. Each portion of a pattern with magic is now matched with a Matcher from @isaacs/nonrecursive-glob-match in place of a RegExp, so patterns can no longer cause ReDoS. Matching follows the minimatch 11 changes, which are closer to Bash in some edge cases.
  • Pattern#pattern() returns a Matcher for a portion with magic. The MMPattern type is now minimatch's ParseReturnFiltered, and the new MMMatcher type is the Matcher part of it.
  • Rename Pattern#isRegExp() to isMatcher(), and Processor#testRegExp() to testMatcher().
  • Remove the debug option, which minimatch no longer has.
  • Add the normalize option, to normalize unicode in the pattern and in the file names that it is matched against.
  • GlobWalker#walk() and walkSync() return arrays in place of sets, and MatchRecord#entries() is removed.
  • ignore patterns that start with / now start at the same place as other patterns that start with /: the root option if set, or else the root of the cwd, such as C:\ on Windows.
  • ignore patterns follow the windowsPathsNoEscape option, the same as other patterns.
  • On Windows, patterns that start with a long UNC root like //?/UNC/host/share/ walk that share, the same as //host/share/.
  • Faster ignore patterns (about 1.2 to 3 times faster), and less work for each entry in a walk (about 10% faster sync, and 15% to 30% faster async, for large trees).
  • Allow const string[] or readonly string[] as ignore option or pattern argument.
  • When the signal aborts an async walk, the walk stops. Before, it rejected, but continued to read directories.

  13

  • Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

  12

  • Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

  11.1

  ... (truncated)

  Commits

  • fc93fd5 14.0.3
  • cfdf76a update deps
  • 54bbe8b fix windows test
  • 18a539f ci: update node versions
  • 93957bf 14.0.2
  • 4682e8c fix: do not continue walking after signal abort
  • 668a669 14.0.1
  • 6ff2314 allow const/readonly string[] for ignore, patterns
  • bbe1e5d 14.0.0
  • d9586ad use actual published deps, not symlinks
  • Additional commits viewable in compare view
  Maintainer changes

  This version was pushed to npm by isaacs, a new releaser for glob since your current version.

  Install script changes

  This version adds prepare script that runs during installation. Review the package contents before updating.

  
  

  Updates iconv-lite from 0.6.3 to 0.7.3

  Release notes

  Sourced from iconv-lite's releases.

  0.7.3

  🚀 Improvements

  • Add iso-8859-8-i and iso-8859-8-e charset aliases - by @​baptistejamin in #394

  🐞 Bug fixes

  • Fix UTF-32 streaming across chunk boundaries - by @​spokodev and @​bjohansebas in #393

    When decoding a UTF-32 stream, a 4-byte code unit split across a chunk boundary was decoded incorrectly, and a truncated trailing unit is now replaced with U+FFFD instead of being dropped. When encoding, a surrogate held over between chunks no longer throws. Whole-buffer decode/encode were unaffected.

  New Contributors

  • @​baptistejamin made their first contribution in pillarjs/iconv-lite#394
  • @​spokodev made their first contribution in pillarjs/iconv-lite#393

  Full Changelog: pillarjs/iconv-lite@v0.7.2...v0.7.3

  v0.7.2

  🐞 Bug fixes

  • Correction of CommonJS exports in TypeScript definitions - by @​plbstl in #366

    Fixed the TypeScript definitions to correctly represent the CommonJS exports of the library. This resolves issues where consumers using TypeScript would encounter errors due to incorrect type definitions that did not align with the actual module exports.

  Other changes

  • Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in pillarjs/iconv-lite#373
  • Bump actions/checkout from 4 to 6 by @​dependabot[bot] in pillarjs/iconv-lite#374
  • chore: use files field in package.json instead of .npmignore by @​bjohansebas in pillarjs/iconv-lite#372
  • Bump github/codeql-action from 4.31.2 to 4.31.9 by @​dependabot[bot] in pillarjs/iconv-lite#375
  • Bump actions/upload-artifact from 4 to 6 by @​dependabot[bot] in pillarjs/iconv-lite#377
  • Bump actions/download-artifact from 6 to 7 by @​dependabot[bot] in pillarjs/iconv-lite#376

  Full Changelog: pillarjs/iconv-lite@v0.7.1...v0.7.2

  v0.7.1

  What's Changed

  🚀 Improvements

  • types: improve type definitions and add missing APIs - by @​plbstl and @​bjohansebas in pillarjs/iconv-lite#330

  Other changes

  • Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in pillarjs/iconv-lite#357
  • Bump actions/download-artifact from 5 to 6 by @​dependabot[bot] in pillarjs/iconv-lite#356
  • Bump github/codeql-action from 3.29.8 to 4.31.2 by @​dependabot[bot] in pillarjs/iconv-lite#355

  ... (truncated)

  Changelog

  Sourced from iconv-lite's changelog.

  0.7.3

  🚀 Improvements

  • Add iso-8859-8-i and iso-8859-8-e charset aliases - by @​baptistejamin in #394

  🐞 Bug fixes

  • Fix UTF-32 streaming across chunk boundaries - by @​spokodev and @​bjohansebas in #393

    When decoding a UTF-32 stream, a 4-byte code unit split across a chunk boundary was decoded incorrectly, and a truncated trailing unit is now replaced with U+FFFD instead of being dropped. When encoding, a surrogate held over between chunks no longer throws. Whole-buffer decode/encode were unaffected.

  0.7.2

  🐞 Bug fixes

  • Correction of CommonJS exports in TypeScript definitions - by @​plbstl in #366

    Fixed the TypeScript definitions to correctly represent the CommonJS exports of the library. This resolves issues where consumers using TypeScript would encounter errors due to incorrect type definitions that did not align with the actual module exports.

  0.7.1

  🚀 Improvements

  • types: improve type definitions and add missing APIs - by @​plbstl and @​bjohansebas in #330

  0.7.0

  🐞 Bug fixes

  • Handle split surrogate pairs when encoding utf8 - by @​yosion-p and @​ashtuchkin in #282:

    Handle a case where streaming utf8 encoder (converting js strings -> buffers) encounters surrogate pairs split between chunks (last character of one chunk is high surrogate and first character of the next chunk is a low surrogate).

  • Avoid false positives in encodingExists by using objects without a prototype - by @​bjohansebas in #328

    The encodingExists method could return incorrect results if the lookup matched properties inherited from the prototype of the object that stores the encodings, such as constructor and others. This change replaces that object with one that has no prototype, ensuring that only explicitly defined valid encodings in the library are considered. In addition, the fix is applied to the internal cache system to avoid the same kind of false positives

  🚀 Improvements

  • Make explicit that decode() method supports Uint8Array input - by @​jardicc in #271
  • Remove compatibility check for StringDecoder.end method - by @​bjohansebas in #331

  Commits

  • 43694e2 release: 0.7.3 (#411)
  • 11e96b5 fix(utf32): reassemble split codepoint from overflow buffer, not source index...
  • b52b9d3 feat: support iso-8859-8-i and iso-8859-8-e charset labels (#394)
  • 2bfa5ab ci: fix workflow configuration for v0.x branch (#404)
  • 6cf4f08 release: 0.7.2 (#379)
  • 7dff5ce fix: correction of CommonJS exports in TypeScript definitions (#366)
  • 61dd902 Bump actions/download-artifact from 6 to 7 (#376)
  • eda7530 Bump actions/upload-artifact from 4 to 6 (#377)
  • 4b4e4b6 Bump github/codeql-action from 4.31.2 to 4.31.9 (#375)
  • 25c8d11 chore: use files field in package.json instead of .npmignore (#372)
  • Additional commits viewable in compare view
  Maintainer changes

  This version was pushed to npm by bsebas, a new releaser for iconv-lite since your current version.

  
  

  Updates inversify from 6.0.2 to 8.2.3

  Release notes

  Sourced from inversify's releases.

  @​inversifyjs/http-better-auth@​6.0.3

  Patch Changes

  • Updated dependencies
    • @​inversifyjs/http-core@​5.9.1

  Commits

  • 5ba2e20 Merge pull request #2023 from inversify/changeset-release/main
  • 1123fa9 chore: bump package versions
  • be063f1 Merge pull request #2022 from inversify/fix/resolution-on-jit-for-big-arity
  • 68ebd78 test: improve assertions
  • 063632c fix: jit resolution
  • eefb744 Merge pull request #2021 from inversify/perf/improve-dynamic-value-resolution
  • c494a54 chore: update benchmark scenarios with async flows
  • 8608291 chore: add container benchmark scenario
  • 9a858d9 perf: update DynamicValueBinding
  • 6057964 chore: update vitest config to exclude fixtures from coverage
  • Additional commits viewable in compare view
  Maintainer changes

  This version was pushed to npm by notaphplover, a new releaser for inversify since your current version.

  
  

  Updates jsonc-parser from 3.2.0 to 3.3.1

  Release notes

  Sourced from jsonc-parser's releases.

  v3.3.1

  Changes:

  • #92: remove exports, prepare 3.3.1

  This list of changes was auto generated.

  v3.3.0

  Changes:

  Feature Requests:

  • #11: Can we have a "insertFinalNewline" option in "FormattingOptions"?
  • #4: Source map referenced but not included in published package

  Bugs:

  • #33: Formatting valid json content is causing an invalid json
  • #40: parseTree() returns undefined on empty string input

  Others:

  • #90: prepare 3.3.0
  • #88: Allow the visitor to cease callbacks
  • #89: Bump braces from 3.0.2 to 3.0.3

  • #84: prepare 3.2.1
  • #81: perf(format): cache breaklines and spaces as much as possible
  • #79: update dependencies
  • #75: ci: add batch
  • #72: delete pr-chat action
  • #71: add publish pipeline & cleanup ci
  • #70: set preserveConstEnums: true, switch to es2020
  • #69: sort edits in applyEdits
  • #66: An additional parameter keepLines has been added into the formatting options which allows to keep the original line formatting
  • #64: Adding Microsoft SECURITY.MD
  • #62: Add JSON path supplier parameter to visitor functions
  • #44: findNodeAtLocation does not handle incomplete property pair
  • #61: Update API section in README
  • #53: Clarify whether / how Edit[] can be concatenated
  • #46: Non-standard whitespace handling

  ... (truncated)

  Changelog

  Sourced from jsonc-parser's changelog.

  4.0.0-next.1 2026-03-04

  • package is now ESM-only.
  • remove UMD build and package entrypoints.

  3.3.0 2022-06-24

  • JSONVisitor.onObjectBegin and JSONVisitor.onArrayBegin can now return false to instruct the visitor that no children should be visited.

  Commits

  • 3c9b420 remove exports, prepare 3.3.1 (#92)
  • 4f3cf98 prepare 3.3.0 (#90)
  • 9e24580 Allow the visitor to cease callbacks (#88)
  • cfe32ac Bump braces from 3.0.2 to 3.0.3 (#89)
  • b6b34ba prepare 3.2.1 (#84)
  • c6d4008 perf(format): internalize breaklines and spaces as much as possible (#81)
  • e82ebd9 update dependencies (#79)
  • 18b2209 ci: add batch (#75)
  • c241fb3 delete pr-chat action (#72)
  • 4fa9c85 add publish pipeline & cleanup ci (#71)
  • See full diff in compare view
  Maintainer changes

  This version was pushed to npm by vscode-bot, a new releaser for jsonc-parser since your current version.

  
  

  Updates minimatch from 5.1.8 to 11.0.3

  Changelog

  Sourced from minimatch's changelog.

  change log

  11.0

  • Match each path portion with Matcher from @isaacs/nonrecursive-glob-match, in place of a RegExp. Items in Minimatch.set are now strings, Matcher objects, or GLOBSTAR.
  • Remove makeRe(), Minimatch#regexp, and the MMRegExp type.
  • Remove the AST class.
  • Remove the maxExtglobRecursion option.
  • An empty path portion, such as the last one in a/b/, only matches an empty pattern portion. So a/b/ no longer matches a/b/?(x) or a/b/*(x), the same as a/b/*.
  • Add the normalize option, to normalize unicode in the pattern and in each portion of the tested path.
  • Remove the debug option and the debug() method.
  • Remove the matchOne(), slashSplit(), and levelTwoFileOptimize() methods. They are internal now.
  • Fix patterns with more than one ** and sections of different lengths between them, such as **/a/b/c/**/d/**, which failed to match some paths since 10.2.3.
  • Fix partial matching of patterns with **, which since 10.2.3 matched some paths under a dot portion that ** can not walk, and did not match some paths that end in the pattern's last portion.
  • partial matching of patterns with many ** no longer takes exponential time.
  • On Windows, a .. no longer removes the drive letter, or the host and share of a UNC path, at the start of a pattern or (at optimization level 2) a path. So C:/a/../../x no longer matches x or /x.
  • On Windows, compare the host and share of UNC paths like //host/share/... case-insensitively, the same as drive letters.
  • On Windows, long UNC paths like //?/UNC/host/share/... match //host/share/... and vice versa, the same as //?/c:/... and c:/....
  • At optimization level 2, stop splitting **/.. portions once there are braceExpandMax patterns, and do not dedupe sets of more than 1000 patterns. Before, a short pattern could take minutes to compile.
  • minimatch() keeps the 256 Minimatch objects that it used most recently, so it does not compile the same pattern again.
  • Faster to compile brace patterns that make rows that are merged, such as **/*.{png,jpg,gif}, because the Matchers for the rows that are merged are not made.

  10.2

  ... (truncated)

  Commits

  • b0c2aa8 11.0.3
  • 293267a perf: cache matchers more aggressively by postponing creation
  • 52d2aec cache 256 patterns
  • 4380455 11.0.2
  • 322feb1 update @​isaacs/nonrecursive-glob-match
  • 96cad78 ci: exclude windows from testing node 22 and 24
  • 47afe88 11.0.1
  • 77a0f5c limit **/.. optimization pass to avoid quadratic explosion
  • 6f9f131 11.0.0
  • 02dcbe4 update oxlint
  • Additional commits viewable in compare view
  Install script changes

  This version adds prepare script that runs during installation. Review the package contents before updating.

  
  

  Updates node-stream-zip from 1.15.0 to 1.16.0

  Changelog

  Sourced from node-stream-zip's changelog.

  v1.16.0 (2026-07-22)

  + fixed reading compressed entry size to prevent exploitation reported by @​DumDumSu
* updated dependencies

  Commits

  • 2d9da01 release 1.16.0
  • d6646bf up deps
  • b9b496a fixed reading compressed entry size
  • a050b3f fixed tests
  • 7c5d503 readme
  • c7cd392 removed a duplicated test
  • f58b5b8 node.js 14
  • 74f30a3 node.js 12
  • 571f55b node.js 12
  • See full diff in compare view
  
  

  Updates rxjs from 6.6.7 to 7.8.2

  Changelog

  Sourced from rxjs's changelog.

  7.8.2 (2025-02-22)

  Bug Fixes

  • animationFrameScheduler: some tasks are never flushed and sometimes it breaks completely (#7444) (8bbfa4e)
  • mergeWith: works correctly with an Array (#7281) (27855c6)
  • subscriber: strict type signature for next method (#7172) (0e2ef5e)

  7.8.1 (2023-04-26)

  Bug Fixes

  • asapScheduler: No longer stops after scheduling twice during flush (#7198) (1b52405), closes ReactiveX#7196
  • throttle: properly handle default ThrottleConfig values (#7176) (ceb821c)

  7.8.0 (2022-12-15)

  Features

  • buffer: closingNotifier now supports any ObservableInput (#7073) (61b877a)
  • delayWhen: delayWhen's delayDurationSelector now supports any ObservableInput (#7049) (dfd95db)
  • sequenceEqual: compareTo now supports any ObservableInput (#7102) (d501961)
  • share: ShareConfig factory properties now supports any ObservableInput (#7093) (cc3995a)
  • skipUntil: notifier now supports any ObservableInput (#7091) (60d6c40)
  • window: windowBoundaries now supports any ObservableInput (#7088) (8c4347c)

  7.7.0 (2022-12-15)

  Features

  • distinct: flush argument now supports any ObservableInput (#7081) (74c9ebd)
  • repeatWhen: notifier supports ObservableInput (#7103) (8f1b976)
  • retryWhen: notifier now supports any ObservableInput (#7105) (794f806)
  • sample: notifier now supports any ObservableInput (#7104) (b18c2eb)

  7.6.0 (2022-12-03)

  Bug Fixes

  • schedulers: no longer cause TypeScript build failures when Node types aren't included (c1a07b7)
  • types: Improved subscribe and tap type overloads (#6718) (af1a9f4), closes #6717

  Features

  • onErrorResumeNextWith: renamed onErrorResumeNext and exported from the top level. (onErrorResumeNext operator is stil available, but deprecated) (#6755) (51e3b2c)

  7.5.7 (2022-09-25)

  Bug Fixes

  ... (truncated)

  Commits

  • e5351d0 chore(publish): 7.8.2
  • 8bbfa4e fix(animationFrameScheduler): some tasks are never flushed and sometimes it b...
  • 4a2d0d2 docs(rxjs.dex): replace polyfill.io with a Cloudflare equivalent (#7487)
  • 2fb0740 chore: 7.x remove global npm install and ignore latest TS (#7398)
  • d69d890 docs: fix missing overloads in docs when overload count is less than 3 (#7367...
  • 27855c6 fix(mergeWith): works correctly with an Array (#7281)
  • 9db6563 docs: provide URL for the V8 docs app (#7244)
  • 5c3fb33 docs: add MonoTypeOperatorFunction documentation (#7284)
  • 0e2ef5e fix(subscriber): strict type signature for next method (#7172)
  • b6d00c1 docs: improve glossary and semantics page (#7267)
  • Additional commits viewable in compare view
  
  

  Updates stack-trace from 0.0.10 to 1.0.0

  Release notes

  Sourced from stack-trace's releases.

  v1.0.0

  What's Changed

  • Updated CallSite object API link by @​DylanTackoor in felixge/node-stack-trace#28
  • test on Node.js 8 by @​mightyiam in felixge/node-stack-trace#24
  • fix test-long-stack-trace.js by @​mightyiam in felixge/node-stack-trace#23
  • use npm scripts instead of Makefile by @​mightyiam in felixge/node-stack-trace#22
  • Exclude unnecessary files from the npm package by @​pkuczynski in felixge/node-stack-trace#33
  • Fix: Correctly parse paths with braces by @​timfish in felixge/node-stack-trace#32
  • Feature/esm jest by @​niemyjski in felixge/node-stack-trace#35
  • Adjust node engine requirements to be less restrictive by @​mweichert in felixge/node-stack-trace#39
  • fix(tests): make stack frame comparison test environment-independent for Jest 30 upgrade by @​niemyjski in felixge/node-stack-trace#65
  • Migrate tests to native node:test, remove Babel/Jest tooling, and clarify long-stack-trace behavior by @​niemyjski in felixge/node-stack-trace#66
  • Address PR #66 review comments, verify and close issues #13, #25 by @​niemyjski in felixge/node-stack-trace#67

  New Contributors

  • @​DylanTackoor made their first contribution in felixge/node-stack-trace#28
  • @​mightyiam made their first contribution in felixge/node-stack-trace#24
  • @​pkuczynski made their first contribution in felixge/node-stack-trace#33
  • @​timfish made their first contribution in felixge/node-stack-trace#32
  • @​niemyjski made their first contribution in felixge/node-stack-trace#35
  • @​mweichert made their first contribution in felixge/node-stack-trace#39
  • @​dependabot[bot] made their first contribution in felixge/node-stack-trace#43
  • @​gameroman made their first contribution in felixge/node-stack-trace#58

  Full Changelog: felixge/node-stack-trace@v0.0.10...v1.0.0

  1.0.0-pre2

  What's Changed

  • Adjust node engine requirements to be less restrictive by @​mweichert in felixge/node-stack-trace#39

  New Contributors

  • @​mweichert made their first contribution in felixge/node-stack-trace#39

  Full Changelog: felixge/node-stack-trace@1.0.0-pre1...1.0.0-pre2

  1.0.0-pre1

  What's Changed

  • Don't expect column number to always exists by @​kjg in felixge/node-stack-trace#17
  • Add Travis CI by @​kjg in felixge/node-stack-trace#18
  • Updated CallSite object API link by @​DylanTackoor in felixge/node-stack-trace#28
  • test on Node.js 8 by @​mightyiam in felixge/node-stack-trace#24
  • fix test-long-stack-trace.js by @​mightyiam in felixge/node-stack-trace#23
  • use npm scripts instead of Makefile by @​mightyiam in felixge/node-stack-trace#22
  • Exclude unnecessary files from the npm package by @​pkuczynski in felixge/node-stack-trace#33
  • Fix: Correctly parse paths with braces by @​timfish in felixge/node-stack-trace#32
  • Feature/esm jest by @​niemyjski in felixge/node-stack-trace#35

  New Contributors

  • @​kjg made their first contribution in felixg...

    Description has been truncated
    Bumps the dependencies group with 2 updates in the / directory: importlib-metadata and tomli.

    Updates importlib-metadata from 9.0.1 to 10.1.0

    Changelog

    Sourced from importlib-metadata's changelog.

    v10.1.0

    Features

    • Detecting whether a distribution supplies metadata no longer reads or parses that metadata where the metadata directory can be inspected instead, so retrieving a distribution by name, which prefers the valid candidates, is substantially faster.
    • Reverted the preference for the greater metadata directory added in v9.1.0. The ordering was lexicographic on the directory name and not on the parsed version, so it only approximated a preference for the newer version. Where a path supplies more than one metadata directory for a distribution, discovery once again reports them in the order the path supplies python/cpython#100666

    Bugfixes

    • entry_points() now prefers distributions whose metadata is readable, so an empty metadata directory left behind by an unclean upgrade no longer shadows the valid one of the same name and suppresses its entry points. Invalid distributions are deferred to the end of the enumeration rather than dropped. (#534)
    • The preference for valid distributions no longer propagates the MetadataNotFound of a distribution that a provider derived from importlib.metadata, whose exception is a different class from this package's and so escaped the preference rather than marking the distribution invalid.

    v10.0.0

    Features

    • Added IDistribution and IPackagePath protocols so consumers can target a stable, shared interface across importlib.metadata and importlib_metadata. A provider supplying its own Distribution subclass is warned about only when the class omits members that interface requires, not merely because it derives from importlib.metadata. origin is exempt from that expectation until support for Python 3.12 is dropped, as there is none to inherit before Python 3.13. (#486)

    Deprecations and Removals

    • When providers supply objects from importlib.metadata, they are now adapted to the classes from importlib_metadata. (#486)

    v9.1.0

    ... (truncated)

    Commits

    • d196fdb Finalize
    • 5d253ae Merge pull request #553 from python/bugfix/534-entry-points-prefer-valid
    • 0aa24f3 Prefer valid distributions when collecting entry points.
    • e52be78 Detect the presence of metadata without reading it.
    • 60bbaca Merge pull request #552 from python/debt/revert-prefer-greater-version
    • 7e162d8 Revert "Prefer the greater metadata directory when a path supplies several."
    • 3be1416 Finalize
    • e3dad22 Merge pull request #505 from python/bugfix/486-local-objects
    • 301b791 Finalize
    • 4b7c45f Avoid a dot in the news fragment id.
    • Additional commits viewable in compare view
    
    

    Updates tomli from 2.4.1 to 2.5.0

    Changelog

    Sourced from tomli's changelog.

    2.5.0

    • Added
      • Binary wheels for Python 3.15
    • Fixed
      • Set nested inline array/table limit to 400 to fix mypyc generated binaries crashing unrecoverably in constrained environments (e.g. worker thread in a python:3.13-alpine image)

    2.3.1

    • Fixed
      • Backport: Limit number of parts of a TOML key to address quadratic time complexity

    Commits

    • a2a5789 Bump version: 2.4.1 → 2.5.0
    • 94a6081 Add 2.5.0 changelog
    • 85f8748 Update README.md
    • 70fd460 Allow flit_core v4
    • 00d0610 Update pre-commit
    • eb93c12 Improve tomllib compatibility and sync docs (#299)
    • 18d8d59 Bump cibuildwheel for Python 3.15 wheels (#317)
    • 1e6e869 Set smaller MAX_INLINE_NESTING to avoid python:3.13-alpine worker thread crash
    • c329998 Use Trusted Publishing
    • ba611c5 Add zizmor security scanner to pre-commit (#301)
    • Additional commits viewable in compare view
    
    

[dependabot]

Superseded by #26278.