[Sean McManus (sean-mcmanus)]

Summary

• Update follow-redirects to 1.16.2, addressing GHSA-mrwp-f3q8-3g9p, and update vulnerable undici, ip-address, and qs dependencies.
• Remove the unused Actions mocha dev dependency, eliminating its braces and glob dependency paths.
• Update the extension packaging dependency trees to @azure/identity 4.14.1 and @azure/msal-node 7.1.1, addressing GHSA-xcx6-jx8p-x3h5 without overriding incompatible dependency ranges.
• Update the Extension's serialize-javascript to 7.1.3, which fixes GHSA-m5mm-p8h7-m29v. The Extension still uses braces 3.0.3, for which no fixed release is available.
• Require VS Code 1.82 or newer, whose desktop and remote extension hosts use Node 18 or newer, and align the direct Node typings. VS Code 1.77–1.81 clients will no longer receive this extension update.

minimatch remains affected by GHSA-g3hv-75wg-m249 in the Actions, Extension, Extension Pack, and Themes dependency trees. The first patched major version is outside several current parent dependency ranges.

Validation

• Actions: clean install, typecheck, and 39 tests.
• Extension: frozen Yarn install, lockfile checks, and TypeScript typecheck. The typecheck and lock tests also passed on Node 18.15; a full extension-host run was not performed.
• Themes and Extension Pack: clean installs and VSIX packaging.
• Offline query-string and serializer regression checks, plus a loopback redirect smoke test for follow-redirects 1.16.2.
• Fifteen offline Identity/MSAL and VSCE credential-flow checks with fake credentials and network access blocked. Live Azure sign-in and publishing were not validated.

This PR was investigated and created by GitHub Copilot (in VS Code). Any message starting with ✨Copilot was sent by Copilot.

[Copilot]

🔵 Needs a closer look

MSAL 7 is forced outside Azure Identity’s declared dependency ranges, and authenticated publishing was not validated against live Azure sign-in.

No open issues 🎉

3 files not reviewed

• .github/actions/package-lock.json: Generated file
• ExtensionPack/package-lock.json: Generated file
• Themes/package-lock.json: Generated file

What changed in this PR

Updates dependencies across Actions and extension packaging to address security advisories without changing application code.

Changes:

• Updates vulnerable transitive dependencies and raises serialize-javascript to 7.1.3.
• Pins @azure/msal-node to 7.1.1 across the three extension packages.
• Upgrades Actions Mocha to 12.0.3, removing its braces dependency; the Extension’s existing braces dependency remains.

File	Description
Themes/​package.json	Adds the patched MSAL override.
Themes/​package-lock.json	Locks updated MSAL and qs dependencies.
ExtensionPack/​package.json	Adds the patched MSAL override.
ExtensionPack/​package-lock.json	Locks updated MSAL dependencies.
Extension/​yarn.lock	Locks updated MSAL, qs, and serialization dependencies.
Extension/​package.json	Adds the MSAL pin and raises the serialization resolution.
.github/​actions/​package.json	Upgrades Mocha and the serialization override.
.github/​actions/​package-lock.json	Records security updates and Mocha’s revised dependency tree.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the dependency updates.

No open issues 🎉

2 files not reviewed

• .github/actions/package-lock.json: Generated file
• Themes/package-lock.json: Generated file

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The major authentication upgrades affect publishing credentials, but live Azure sign-in and Marketplace publishing still require human validation.

No open issues 🎉

3 files not reviewed

• .github/actions/package-lock.json: Generated file
• ExtensionPack/package-lock.json: Generated file
• Themes/package-lock.json: Generated file

_{Review effort: Balanced}