0013 — Keep development tooling free of known dependency advisories

• Status: Accepted
• Date: 2026-10-04

Context

The maintainer requested remediation of the twelve remaining development-dependency audit entries after Dependabot PRs #61 and #62 were merged. The full-tree npm audit reported nine high and three moderate entries; the production-only audit reported zero. Those entries include affected packages and dependent packages, rather than twelve independent advisories. This confirms vulnerable versions in the development tree, without establishing runtime exploitability.

Vitest 4.1.11 fixes the redirect-mock advisory. Updating brace-expansion, js-yaml, and qs within their existing declared ranges removes their audit entries. The remaining braces advisory has no fixed release in the available 3.x line. @vscode/vsce 4.0.0 replaces the affected secretlint/globby/fast-glob dependency chain and removes fast-uri from that tree, but ovsx 1.0.2 still declares a ^3.7.1 packager dependency.

Decision

• Pin Vitest 5.0.3 (see the amendment below) and @vscode/vsce 4.0.0 as development dependencies. Keep Node 24, the existing npm/esbuild/Cargo pipeline, and the published editor API floor.
• Override transitive @vscode/vsce with $@vscode/vsce, matching the exact direct version. Pin ovsx 1.2.0 (see the amendment below) and verify its CLI startup and the existing createVSIX API offline.
• Refresh affected indirect dependencies within their existing ranges. Preserve the approved production dependency graph and its notices.
• Review the @vscode/vsce-sign 2.1.0 installer and synchronize its exact allowlist entry with the repository policy and fixture. Remove the obsolete keytar install permission. New native keyring packages are development-only and have no install lifecycle script.
• Run npm audit --audit-level=low on the entire locked dependency tree in PR CI, compatibility candidate builds, and tagged release candidate builds. Do not suppress development advisories.

Consequences and validation

The new packager requires Node 22 or newer, within the accepted Node 24 tooling baseline. Its public createVSIX API retains the options used by the repository and by ovsx, but the override crosses ovsx’s declared major range. Clean npm ci, CLI startup, unit and boundary tests, VSIX content checks, and reproducibility checks are required before merge. Publishing an existing VSIX must retain the current arguments; a live registry publish is outside this maintenance task.

All new packaging, installation, and scan evidence applies to the updated development tree. Existing 0.4.0 release lifecycle and performance receipts continue to describe only their original bytes. A zero-result npm audit is a time-bound known-advisory result, not a complete security claim.

2026-10-05 amendment: Vitest 5 benchmark migration

The maintainer authorized the major-version migration in Dependabot PR #71. This supersedes the original Vitest 4.1.11 pin with 5.0.3; the packager, overrides, installer policy, Node baseline, and editor API floor retain their existing decisions.

Following the Vitest 5 migration guide and the version-pinned benchmark API, the five harness workloads use async tests with the test-context bench fixture and explicitly await each registration’s .run(). Benchmark discovery is limited to test/benchmarks, separate from ordinary unit tests. PR CI runs the existing npm run benchmark command so registration alone cannot masquerade as an executed measurement.

Validation requires clean installation, formatting, lint, type checks, all test and security gates, five completed benchmark measurements, full-tree audit, and reproducible inspected VSIX packaging. These harness measurements remain overhead evidence, not headed-editor QR evidence.

2026-10-06 amendment: Open VSX CLI 1.2.0

Dependabot PR #69 updates the development-only ovsx pin from 1.0.2 to 1.2.0. Its Node 22 minimum fits the Node 24 baseline. It still declares @vscode/vsce ^3.7.1, so the reviewed override to 4.0.0 remains necessary. The added prompt and keychain helpers remain development-only; the production dependency graph is unchanged.

The tagged workflow’s CLI version assertion must match 1.2.0. Keep the existing verify-pat straydog and retained-VSIX publish --skip-duplicate arguments, token scope, and tag-only authorization unchanged. Validation covers clean locked installation, CLI version/help, the overridden packager API, supply-chain checks, full-tree audit, and reproducible inspected VSIX packaging. No registry publication or credential verification is performed as part of this dependency maintenance.

2026-10-26 amendment: MSAL Node and serializer advisories

Dependabot PR #81 exposes existing development-tree advisories also present on main. Pin @azure/msal-node to 7.1.0 through an override because the locked Azure Identity 4.13.3 declares 6.x, while GHSA-xcx6-jx8p-x3h5 requires 7.1.0. Advance the existing serialize-javascript override from 7.0.7 to 7.1.3 for GHSA-m5mm-p8h7-m29v.

Both remain development-only. Preserve production dependencies, Node 24, the editor floor, and the exact installer allowlist. The cross-major MSAL override requires an offline Azure Identity client-secret token acquisition with a fake transport, in addition to the packager and editor gates; it does not establish live Azure authentication. Retain a serializer regression for a function source ending with a bare script terminator. Clean installation, full-tree audit, supply-chain checks, and the existing test/package gates remain required.

The review of the installed 6.0.1 and 7.1.0 declarations and the upstream changelog identifies removal of interactive responseMode as the major change. Locked Azure Identity does not set that option. Its public/confidential client, managed identity, logger, token-cache, silent, client-credential, device-code, username/password, authorization-code, on-behalf-of, and interactive API entry points remain present. Both MSAL versions require Node >=20 and retain CommonJS exports; the reviewed tooling runs Node 24.18.0. A second local fake-transport check also acquires a token through Azure Identity’s managed-identity path.

The reachability boundary is @vscode/vsce -> @azure/identity -> MSAL, all development-only. VSCE’s optional Azure authentication chain uses environment, CLI, managed identity, PowerShell, and developer CLI credentials. Packaging does not request those tokens; the Open VSX publication path uses its supplied PAT and registry client instead. Production-only dependency inspection, packaged-content/security checks, CLI startup, and actual VSIX packaging confirm no Azure/MSAL dependency enters the shipped runtime. These checks support this tooling override, not live Azure credential qualification.

2026-10-26 amendment: Open VSX CLI 1.3.0

Dependabot PR #82 advances the development-only ovsx pin to 1.3.0 and the tagged workflow’s version assertion to match. The CLI now declares @vscode/vsce ^4.0.0, so the existing exact override no longer crosses its declared major range. Its transitive Commander upgrade from 6.2.1 to 14.0.3 rejects surplus positional arguments. The retained-VSIX publication passes exactly one path per invocation, and verify-pat passes exactly the straydog namespace, so both fit the new parser.

Keep the existing tag boundary, token scope, verify-pat straydog, and publish <retained.vsix> --skip-duplicate commands. A loopback-only integration test runs the installed CLI against a fake registry with a test token, verifies the exact retained VSIX upload and duplicate handling, and rejects extra arguments. It exercises the real Commander parser and registry client without live publication or credential use. Clean installation, full-tree audit, packager API, reproducibility, supply-chain, and supported-editor gates remain required before merging.