Skip to content

⬆ Bump the bun-packages group with 9 updates - #238

Merged
savannahostrowski merged 6 commits into
mainfrom
dependabot/bun/bun-packages-ec7d4f53ae
Nov 2, 2026
Merged

⬆ Bump the bun-packages group with 9 updates#238
savannahostrowski merged 6 commits into
mainfrom
dependabot/bun/bun-packages-ec7d4f53ae

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the bun-packages group with 9 updates:

Package From To
p-map 7.0.8 7.1.1
posthog-node 5.53.0 5.57.1
toml 5.0.0 5.0.1
web-tree-sitter 0.27.0 0.27.1
@biomejs/biome 2.5.14 2.6.3
@types/bun 1.4.2 1.4.4
@types/sinon 22.0.0 22.0.2
lint-staged 17.5.1 17.6.0
ovsx 1.2.0 1.3.0

Updates p-map from 7.0.8 to 7.1.1

Release notes

Sourced from p-map's releases.

v7.1.1

  • Subscribe once to a thenable from an async source next() 1dc1d1f

sindresorhus/p-map@v7.1.0...v7.1.1

v7.1.0

New

  • Add pMapSettled, pMapKeyed, and pMapSettledKeyed (#70) a05fd50
    • pMapSettled is like Promise.allSettled(), with a mapper and a concurrency limit
    • pMapKeyed and pMapSettledKeyed map the values of an object or a Map, like Promise.allKeyed() and Promise.allSettledKeyed()
  • Add pMapStop to stop iterating from the mapper, like break in a loop (#31) 27606f0
  • Add preserveOrder option to pMapIterable (#72) 2c0934b
    • Set it to false to get each result as soon as it is ready, instead of in input order
  • Make pMapIterable read ahead while the mappers run when backpressure is above concurrency (#78) cada71d
    • A slow input no longer leaves a mapper waiting for its next element. With the default backpressure, nothing changes

Improvements

  • Keep the caller in the stack trace of mapper errors (#34) 595754b
  • Make pMapIterable consume its results in linear time 7d5b6e1
    • It was O(n²) when backpressure let many results wait, which is the default
  • Reduce the per-element promise overhead ef82ce6
  • Give a nullish input the same TypeError as any other invalid input 6f4643d

Fixes

  • Fix handling of a source that settles its next() calls out of call order 415a474
    • The index and the result position now follow the order of the next() calls
    • With stopOnError: false, the errors in the AggregateError are now in input order, not in the order they happened
  • Fix pMapIterable dropping earlier results when a mapper throws while they are still being read 27606f0
    • The results before the error are now yielded first, like in a loop
  • Fix pMapSkip results not counting toward backpressure in pMapIterable 7d5b6e1
    • A mapper that skips most elements no longer reads further ahead than backpressure allows
  • Fix pMapIterable pulling and mapping input after return() or throw() while a next() call is pending 5f2c01d

sindresorhus/p-map@v7.0.8...v7.1.0

Commits
  • d61b6a3 7.1.1
  • 1dc1d1f Subscribe once to a thenable from an async source next()
  • 1051ec7 More tests
  • 683a68e 7.1.0
  • 595754b Keep the caller in the stack trace of mapper errors
  • d9cd930 Document how to choose a concurrency value
  • a05fd50 Add pMapSettled, pMapKeyed, and pMapSettledKeyed
  • 36078d3 Add dynamic concurrency recipe
  • cada71d Make pMapIterable read ahead while the mappers run when backpressure is a...
  • 27606f0 Add pMapStop to stop iterating from the mapper
  • Additional commits viewable in compare view

Updates posthog-node from 5.53.0 to 5.57.1

Release notes

Sourced from posthog-node's releases.

posthog-node@5.57.1

5.57.1

Patch Changes

  • #5385 faacff0 Thanks @​carlos-marchal-ph! - Apply the client privacyMode option to AI integrations, keep prompts out of errors, provider metadata and OTel spans in privacy mode, and redact MCP tool credentials (2026-10-23)

  • #5354 f827137 Thanks @​marandaneto! - Fall back instead of returning inconsistent local regex flag results for Unicode and advanced patterns. (2026-10-23)

  • Updated dependencies [f827137]:

    • @​posthog/core@​1.60.1

posthog-node@5.57.0

5.57.0

Minor Changes

  • #5234 1991b99 Thanks @​gustavohstrassburger! - feat: report flags local evaluation could not resolve on evaluateFlags() snapshots via unresolvedFlags, tag reads of them with local_evaluation_inconclusive, and warn once about flags whose definition local evaluation does not support

    Behavior changes:

    • A condition with a filter local evaluation cannot check and a filter that does not match now resolves locally as no match, instead of falling back to a server request or staying unresolved.
    • $feature_flag_called events from snapshot reads report local_evaluation_inconclusive instead of flag_missing for these flags.
    • The load-time warning now also logs with strictLocalEvaluation: true. (2026-10-22)

Patch Changes

  • Updated dependencies [1991b99]:
    • @​posthog/core@​1.60.0

posthog-node@5.56.4

5.56.4

Patch Changes

  • #5350 17260e5 Thanks @​marandaneto! - Fall back from local flag evaluation when a required property value is undefined. (2026-10-21)
  • Updated dependencies [17260e5]:
    • @​posthog/core@​1.59.3

posthog-node@5.56.3

5.56.3

Patch Changes

  • #5307 189da75 Thanks @​quotentiroler! - Local flag evaluation now matches a null property with string operators like the flags service, so negated operators such as not_icontains match instead of failing. (2026-10-21)
  • Updated dependencies [189da75]:
    • @​posthog/core@​1.59.2
Changelog

Sourced from posthog-node's changelog.

5.57.1

Patch Changes

  • #5385 faacff0 Thanks @​carlos-marchal-ph! - Apply the client privacyMode option to AI integrations, keep prompts out of errors, provider metadata and OTel spans in privacy mode, and redact MCP tool credentials (2026-10-23)

  • #5354 f827137 Thanks @​marandaneto! - Fall back instead of returning inconsistent local regex flag results for Unicode and advanced patterns. (2026-10-23)

  • Updated dependencies [f827137]:

    • @​posthog/core@​1.60.1

5.57.0

Minor Changes

  • #5234 1991b99 Thanks @​gustavohstrassburger! - feat: report flags local evaluation could not resolve on evaluateFlags() snapshots via unresolvedFlags, tag reads of them with local_evaluation_inconclusive, and warn once about flags whose definition local evaluation does not support

    Behavior changes:

    • A condition with a filter local evaluation cannot check and a filter that does not match now resolves locally as no match, instead of falling back to a server request or staying unresolved.
    • $feature_flag_called events from snapshot reads report local_evaluation_inconclusive instead of flag_missing for these flags.
    • The load-time warning now also logs with strictLocalEvaluation: true. (2026-10-22)

Patch Changes

  • Updated dependencies [1991b99]:
    • @​posthog/core@​1.60.0

5.56.4

Patch Changes

  • #5350 17260e5 Thanks @​marandaneto! - Fall back from local flag evaluation when a required property value is undefined. (2026-10-21)
  • Updated dependencies [17260e5]:
    • @​posthog/core@​1.59.3

5.56.3

Patch Changes

  • #5307 189da75 Thanks @​quotentiroler! - Local flag evaluation now matches a null property with string operators like the flags service, so negated operators such as not_icontains match instead of failing. (2026-10-21)
  • Updated dependencies [189da75]:
    • @​posthog/core@​1.59.2

5.56.2

Patch Changes

... (truncated)

Commits
  • a0b18d4 chore: update versions and lockfile [version bump]
  • f827137 fix(flags): fall back for incompatible local regex matching (#5354)
  • faacff0 fix(aio): keep content out of ai events in privacy mode (#5385)
  • 6897dc8 chore: update versions and lockfile [version bump]
  • 1991b99 feat(node): report unresolved local flags on evaluateFlags snapshots (#5234)
  • a856dd2 chore: update versions and lockfile [version bump]
  • 17260e5 fix(flags): defer undefined property values to remote evaluation (#5350)
  • 43fdd6b chore: update versions and lockfile [version bump]
  • 189da75 fix(flags): match null properties for string operators like the flags service...
  • 89b4e09 test(node): await enrichment before asserting flag event delivery (#5324)
  • Additional commits viewable in compare view

Updates toml from 5.0.0 to 5.0.1

Changelog

Sourced from toml's changelog.

5.0.1 - October 12 2026

  • Address four security advisories, each reachable by parsing untrusted input:
    • CVE-2026-114142, in which a crafted document could still write to Object.prototype. Two distinct key paths could render to the same bookkeeping string, letting an array-of-tables header clear the guard on an unrelated key, after which a dotted key could descend through a date value into its prototype chain. The compiler now records how each table was defined on the table itself rather than in string-keyed sets, so paths cannot collide and key paths can only descend through tables the compiler created.
    • CVE-2026-114143, in which dotted keys, table headers, and inline-table keys with many segments took quadratic time to resolve.
    • CVE-2026-114141, in which every array-of-tables header rescanned all paths defined so far, so documents with many such headers took quadratic time.
    • CVE-2026-114144, in which integer literals were converted to BigInt before any size check, so a multi-megabyte literal consumed super-linear CPU time before being rejected. Literals with more digits than any 64-bit integer are now rejected before conversion.
Commits

Updates web-tree-sitter from 0.27.0 to 0.27.1

Release notes

Sourced from web-tree-sitter's releases.

v0.27.1

What's Changed

Full Changelog: tree-sitter/tree-sitter@v0.27.0...v0.27.1

Commits
  • 10eb5ac release v0.27.1
  • 4eb3973 fix(web): pass the progress callback to the cursor in Query.captures
  • 60cdb55 fix(test): give the query timeout tests room to time out
  • See full diff in compare view

Updates @biomejs/biome from 2.5.14 to 2.6.3

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.3

2.6.3

Patch Changes

  • #12275 807e616 Thanks @​dyc3! - Added the new nursery rule noArraySortForMinMax, which reports sorting an array only to read its smallest or largest value. Use Math.min() or Math.max() instead.

    const minimum = array.toSorted((a, b) => a - b)[0];

  • #12432 cf61682 Thanks @​dyc3! - Added the nursery rule noBooleanSortComparator, which reports sort comparators that return a boolean instead of a number. For example, array.sort((a, b) => a > b) never puts the first item before the second, so the array isn't sorted correctly.

  • #12304 b4654c5 Thanks @​dyc3! - Added the new nursery rule noEagerArrayMethodsInLoops, which reports .map() and .filter() calls in the header of for...of loops. These calls build a new array that is only used by the loop.

    for (const name of users.map((user) => user.name)) {
  console.log(name);
}

  • #12121 66c3791 Thanks @​dyc3! - Added the nursery rule noNewRequire, which disallows calling require with new, such as new require("app-header").

  • #12316 34b520d Thanks @​dyc3! - Added the new nursery rule noObsoleteAttributes, which disallows obsolete attributes on HTML elements and suggests what to use instead.

    <table bgcolor="#ffffff" cellpadding="5"></table>

  • #12258 cce2385 Thanks @​dyc3! - Added the nursery rule noPathConcat, which disallows building file paths and URLs by joining strings to __dirname, __filename, import.meta.dirname, import.meta.filename, or import.meta.url.

    const fullPath = __dirname + "/foo.js"; // reported

  • #12287 e12ad78 Thanks @​dyc3! - Added the new nursery rule noPlaywrightNthMethods, which disallows selecting Playwright elements by position with first(), last(), and nth(). A test that relies on the position of an element can act on a different element when the page changes.

    await page.locator("button").first().click();

  • #12343 62ad123 Thanks @​vibbix! - Added the nursery rule noSelfNestedLayer, which disallows nesting a cascade layer inside a layer with the same name. Layer names inside an @layer block are relative to it, so the inner layer below creates the sublayer components.components instead of adding to components.

    @layer components {
  @layer components {
    .button {
      color: red;
    }

... (truncated)

Commits

Updates @types/bun from 1.4.2 to 1.4.4

Commits

Updates @types/sinon from 22.0.0 to 22.0.2

Commits

Updates lint-staged from 17.5.1 to 17.6.0

Release notes

Sourced from lint-staged's releases.

v17.6.0

Minor Changes

  • #1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

    import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*': {
title: 'Fail if PDF files are committed',
task: async (filepaths, { log }) => {
const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
if (pdfFiles.length > 0) {
log('PDF files should not be committed: %s', pdfFiles)
throw new Error('Failed')
}
},
},
})

  • #1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

    If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

  • #1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

  • #1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

    import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
})

  • #1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

  • #1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

Changelog

Sourced from lint-staged's changelog.

17.6.0

Minor Changes

  • #1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

    import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*': {
title: 'Fail if PDF files are committed',
task: async (filepaths, { log }) => {
const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
if (pdfFiles.length > 0) {
log('PDF files should not be committed: %s', pdfFiles)
throw new Error('Failed')
}
},
},
})

  • #1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

    If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

  • #1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

  • #1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

    import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
})

  • #1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

  • #1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

Commits
  • 48f9f4e Merge pull request #1857 from lint-staged/changeset-release/main
  • 16b2e21 chore(changeset): release
  • 195f156 docs: improve changeset
  • 0ba6261 fix: create hidden directory only when required
  • 66ac2de docs: fixes to changesets
  • 80af8d7 Merge pull request #1863 from lint-staged/fix-issues
  • e433488 fix: handle task editing a symlinked file to a regular file, and --fail-on-ch...
  • e5019b3 fix: handle trailing newlines when detecting changed files
  • 74efec8 ci: run Cygwin and MSYS2 tests on Node.js 26
  • 655b7dc fix: use TypeScript types instead of JSDoc
  • Additional commits viewable in compare view

Updates ovsx from 1.2.0 to 1.3.0

Release notes

Sourced from ovsx's releases.

CLI v1.3.0

Added

  • Add --follow-symlinks to publish, forwarding vsce's option of the same name so that the file walk recurses into symlinked directories instead of packing each symlink as a file. Needed for a node_modules assembled out of symlinks, as pnpm's is (#368)
  • Add search command to search the registry for extensions, mirroring the web UI's search: --category, --target, --sort-by and --sort-order narrow the query, --size and --offset page through the results, and --json prints the registry's raw response (#2154)
  • Add list command to print the extensions a namespace holds, sorted by name so the output stays stable across registries, with --json for the raw namespace metadata (#2154)
  • Add show command to print an extension's metadata, mirroring vsce show: identity, publisher, rating, notices and a version history listing each version's target platforms (#2149). namespace.extension@version reports a single version, --target scopes the report to one target platform, --all-versions lists every published version instead of the most recent few, and --json prints the registry's raw metadata
  • Add unpublish command to delete an extension or some of its versions, mirroring vsce unpublish (#1958); requires a registry running version 1.2.0 or later, which unpublish checks for before deleting
  • publish checks the packaged extension's size against the limit reported by the registry's /api/version endpoint before uploading, instead of failing only after the upload completes (#1953)
  • Add verify command to check a downloaded .vsix package's signature against the registry's public key, mirroring vsce verify-signature (#993)
  • Add verify-signature command, verifying an already-extracted package/manifest/signature file trio entirely offline (no registry involved), matching vsce verify-signature's own command shape (#993)

Fixed

  • Error messages naming a URL no longer include its query string, which for createNamespace, verifyPat, publish and delete carried the personal access token straight to stderr and into CI logs (#2186)

  • A connection lost after a JSON response has started no longer leaves the command waiting on a body that is not coming: the response's own error is now what settles the request, so it fails with the reset rather than hanging (#2186)

  • Requests now give up after 30 seconds without progress instead of hanging indefinitely when a server accepts a connection and then says nothing. OVSX_TIMEOUT overrides the duration in milliseconds and OVSX_TIMEOUT=0 disables it; it measures inactivity, so a large extension downloading slowly is unaffected, and it covers the trusted-publishing ID token request as well as the registry's own (#2186)

  • Fix downloads that could be read before they were written. download resolved when the response ended rather than when the file was closed, and a write stream opens and flushes asynchronously, so a caller reading the path immediately afterwards could find the file empty or absent - which verify did, intermittently failing to read the public key it had just fetched. A failed download no longer touches the target path: the body is written beside it and renamed into place only once it has arrived whole, so a 404 or a dropped connection leaves what was there alone. A connection dropped mid-download now rejects rather than leaving the caller waiting forever (#2185)

Changed

  • createNamespace, verifyPat, publish and delete now send the personal access token primarily via an Authorization: Bearer header (or, when OVSX_USERNAME/OVSX_PASSWORD are set, an X-OpenVSX-Token header, since Authorization is then already in use for Basic auth to a fronting proxy), moving away from a token query parameter that gets recorded in server and reverse-proxy access logs. The CLI checks the registry's reported version (/api/version) and only still sends the token as a query parameter, alongside the header, when talking to a registry older than 1.3.0, i.e. one that predates header support - including one whose version can't be determined at all, which is treated as too old rather than assumed to be caught up; on 1.3.0 and later the header is all it sends (#1344)
  • publish --trusted-publishing retries the token exchange when the registry answers that it could not verify the ID token (502, 503, 504), rather than failing the build on a blip reaching the identity provider. A refusal is never retried
  • publish --trusted-publishing requests a new token and retries once when the registry refuses the one it was publishing with. The issued token is short-lived and shared by every target platform of a release, so publishing a wide fan-out of large packages could outlive it and fail partway through. Targets that are refused together share one new token, and a token supplied with --pat is never retried
  • Bump minimum supported Node.js version to 22, matching the webui component

Dependencies

  • Bump fast-uri from 3.1.5 to 3.1.7
  • Bump qs from 6.15.2 to 6.16.0
  • Bump @​humanfs/node from 0.16.6 to 0.16.8
  • Bump js-yaml from 4.3.1 to 4.3.2
  • Bump nanoid from 3.3.16 to 3.3.18

Frontend Library v1.3.0

Added

  • Add a /publish page and turn the navbar's Publish button into a drop target: a file drag anywhere in the app turns the button into a drop area, and every .vsix package dropped on it — or on the publish page's own drop area — is queued and uploaded straight away, with no confirmation dialog. The page shows the queue as a line of extension cards — a skeleton while a package uploads, the real card once the registry accepts it, labelled with whatever the registry did with it — and keeps polling anything left under review or still missing its icon
  • Export PublishButton, which carries the publish link, its p shortcut and the app's .vsix drop target in one component, so a deployment with its own menu content keeps drag-and-drop publishing
  • Add a "Data Consistency" page to the admin dashboard (#1622): a live overview of every registered consistency check's finding count, with actions to refresh it and to fix findings one at a time or all at once
  • Show a "Namespace not verified" state on an extension card when it can't be activated because its namespace already exists in a referenced external gallery and hasn't been verified, in both the "My Extensions" and namespace member extension lists. The card keeps its colour and takes a warning-toned frame and icon, since this is the publisher's to fix rather than an extension that is simply switched off
  • Show a warning notice with a claim action wherever an unverified namespace is holding something back — the extension settings page when the extension has a namespace ownership conflict, and the namespace settings page for any unverified namespace — making clear the namespace must be claimed (verified) first. The action is the deployment's configured elements.claimNamespace, falling back to the namespace access documentation when none is configured. The admin dashboard's extension and namespace views show the same explanation without the claim action, since claiming is the publisher's action to take, not an admin's on someone else's behalf
  • Add a "Search Index" page to the admin dashboard: which engine answers searches, how many extensions the index holds against how many it is built from, and a button to rebuild it where there is an index to rebuild. The two counts sit side by side because an index that has quietly lost entries answers searches perfectly well, just with nothing in them, which is indistinguishable from an empty registry unless both numbers are visible at once
  • Mark a version that was published through a trusted publishing workflow with an icon next to "Published by" on the extension detail page, linking to the deployment's trusted publishing documentation. The default deployment points that link at the Trusted Publishing wiki page
  • Add a Pill component — the clickable glass pill the category pills are built on, now usable on its own — and extract the MonoSlash, glassSurface and compactControl page primitives out of the search field, the pills and the search header
  • Add userLoading to MainContext, so custom pages can tell "not logged in" from "still resolving the user"
  • Add a userMenuContent slot to PageSettings.elements: extra entries for the logged-in account menu, rendered above the admin entry. The slot receives a MenuEntry component to build entries with, so each entry is styled by the menu it appears in — the desktop and mobile menus style theirs differently, and a consumer cannot match both on its own
  • Add an adminPages slot to PageSettings.elements: extra admin dashboard pages, each declaring a name, icon, optional description and optional category, and each appearing in the side panel, as a card on the dashboard overview and as a route. Contributions are additive — a category name matching a built-in group appends to it, and a page whose path would shadow a built-in one is ignored
  • Widen the published API for consumers building their own pages: the request layer (sendRequest, sendNonRetriableRequest, ErrorResponse, controllerFromSignal), MainContext, AppProviders, NotFound, createDefaultTheme with the MONO_FONT/NAVBAR_HEIGHT tokens, the createRoute/createAbsoluteURL/addQuery/formatCompactNumber/toRelativeTime utils, the useDebouncedCallback and useGridCursor hooks, the navbar-chrome, search-focus and page-search-bar hooks, the category icon helpers, ExtensionDetailRoutes, and the itemIcon/MenuItemText building blocks for userMenuContent entries

... (truncated)

Changelog

Sourced from ovsx's changelog.

[1.3.0] - 2026-10-16

Changed

  • publish checks a package against the size limit that applies to its own namespace, which a size override can raise above the registry default, and refuses an oversized upload before sending it. Against a registry older than 1.3.0, which cannot report that limit, it warns against the default and publishes anyway; if a registry that should be able to report it does not answer, it says the check did not happen rather than passing silently (#2129)

Fixed

  • --version reads the version from package.json at runtime instead of a generated src/version.ts, so it can no longer report a stale version (#2295)
  • publish now deletes the .vsix it packages into the temp directory once publishing finishes or fails, instead of leaving one behind per package and target (#2286)
  • Drop the X-OpenVSX-Token header, which carries the personal access token when --username/--password are set, on a redirect to another origin, as is done for Authorization (#2309)
  • A request with a body that is redirected with 301/302/303 now fails with an error naming the redirect target, instead of being resent as a GET without its body (#2309)
  • Trusted publishing's OIDC ID token request now uses the registry client's request handling: it follows redirects (dropping the runner token on a redirect to another origin) and reports the token service's error message instead of only its status (#2322)
  • An HTML page in a successful response (any <!doctype html> casing, or a text/html Content-Type) now fails with an error naming the status, instead of printing the raw HTML or a JSON SyntaxError (#2326)
  • An error response whose JSON body starts with whitespace now reports the server's message instead of only its status (#2326)

Dependencies

  • Bump commander from 6.2.1 to 14.0.3; a command given more arguments than it takes now fails instead of ignoring the extras (#2294)
  • Bump @​vscode/vsce from 3.7.1 to 4.0.0 (#2288)
  • Bump vitest from 4.1.11 to 5.0.3, adding vite as a direct dev dependency - vitest 5 no longer bundles it, only requires it as a peer (#2291)
  • Remove leven; the command-suggestion distance check now uses a vendored Levenshtein implementation, the same way @vscode/vsce itself replaced its own leven dependency in 4.0.0 (#2290)
  • Remove tmp; temporary file names are now generated with crypto.randomUUID (#2284)
  • Remove follow-redirects; requests use node:http/node:https and the registry client follows redirects itself (#2309)
  • Bump ip-address from 10.4.0 to 10.7.2 (#2264)
  • Bump brace-expansion to 1.1.21, 2.1.7, 5.0.12
  • Bump markdown-it from 14.2.0 to 14.3.2 (#2281)
Commits
  • e0b958f chore: prepare for cli 1.3.0 release
  • 106e81b docs: tidy the 1.3.0 release notes (#2344)
  • 5d26c73 docs: use Keep a Changelog headings in all change logs (#2343)
  • 5f2de6f fix(cli): handle HTML and whitespace-prefixed JSON responses (#2326)
  • fc539ff fix(cli): share registry request handling with OIDC (#2322)
  • 418cf1a chore(cli): use stream/consumers buffer() in readZip (#2319)
  • 729edb9 chore(cli): replace util fs callback wrappers with fs.promises (#2310)

@dependabot
⬆ Bump the bun-packages group with 9 updates
1aa29b2 
Bumps the bun-packages group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [p-map](https://github.com/sindresorhus/p-map) | `7.0.8` | `7.1.1` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.53.0` | `5.57.1` |
| [toml](https://github.com/BinaryMuse/toml-node) | `5.0.0` | `5.0.1` |
| [web-tree-sitter](https://github.com/tree-sitter/tree-sitter/tree/HEAD/lib/binding_web) | `0.27.0` | `0.27.1` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.14` | `2.6.3` |
| [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.4.2` | `1.4.4` |
| [@types/sinon](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sinon) | `22.0.0` | `22.0.2` |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.5.1` | `17.6.0` |
| [ovsx](https://github.com/eclipse-openvsx/openvsx/tree/HEAD/cli) | `1.2.0` | `1.3.0` |


Updates `p-map` from 7.0.8 to 7.1.1
- [Release notes](https://github.com/sindresorhus/p-map/releases)
- [Commits](sindresorhus/p-map@v7.0.8...v7.1.1)

Updates `posthog-node` from 5.53.0 to 5.57.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.57.1/packages/node)

Updates `toml` from 5.0.0 to 5.0.1
- [Changelog](https://github.com/BinaryMuse/toml-node/blob/main/CHANGELOG.md)
- [Commits](BinaryMuse/toml-node@v5.0.0...v5.0.1)

Updates `web-tree-sitter` from 0.27.0 to 0.27.1
- [Release notes](https://github.com/tree-sitter/tree-sitter/releases)
- [Commits](https://github.com/tree-sitter/tree-sitter/commits/v0.27.1/lib/binding_web)

Updates `@biomejs/biome` from 2.5.14 to 2.6.3
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/CHANGELOG_v1.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.6.3/packages/@biomejs/biome)

Updates `@types/bun` from 1.4.2 to 1.4.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun)

Updates `@types/sinon` from 22.0.0 to 22.0.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sinon)

Updates `lint-staged` from 17.5.1 to 17.6.0
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v17.5.1...v17.6.0)

Updates `ovsx` from 1.2.0 to 1.3.0
- [Release notes](https://github.com/eclipse-openvsx/openvsx/releases)
- [Changelog](https://github.com/eclipse-openvsx/openvsx/blob/main/cli/CHANGELOG.md)
- [Commits](https://github.com/eclipse-openvsx/openvsx/commits/v1.3.0/cli)

---
updated-dependencies:
- dependency-name: p-map
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-packages
- dependency-name: posthog-node
  dependency-version: 5.57.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-packages
- dependency-name: toml
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-packages
- dependency-name: web-tree-sitter
  dependency-version: 0.27.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-packages
- dependency-name: "@biomejs/biome"
  dependency-version: 2.6.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun-packages
- dependency-name: "@types/bun"
  dependency-version: 1.4.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-packages
- dependency-name: "@types/sinon"
  dependency-version: 22.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-packages
- dependency-name: lint-staged
  dependency-version: 17.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun-packages
- dependency-name: ovsx
  dependency-version: 1.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@savannahostrowski savannahostrowski added the internal Internal changes label Nov 2, 2026
@savannahostrowski
savannahostrowski merged commit bd6ee14 into main Nov 2, 2026
8 checks passed
@savannahostrowski
savannahostrowski deleted the dependabot/bun/bun-packages-ec7d4f53ae branch November 2, 2026 17:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file internal Internal changes javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@savannahostrowski