[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ovsx (source)	1.2.0 → 1.4.0

---

Release Notes

eclipse-openvsx/openvsx (ovsx)

v1.4.0

Compare Source

Added

• publish --registrationCode (or OVSX_REGISTRATION_CODE) completes the trusted publisher registration of a private repository on its first publish (#​2350)

Fixed

• publish -i ext.vsix now warns about the packaging options it ignores, as publish ext.vsix does, naming the file, and publishes the package once instead of once per --target (#​2351)
• get and verify ignore a timeout or connection reset while draining the error body of a rejected download, instead of cleaning up a partial file that was never written (#​2386)
• publish prints the exact byte counts next to the friendly sizes of a size limit, so a package one byte over its limit no longer reads as "1 MB exceeds the size limit of 1 MB" (#​2392)
• publish --trusted-publishing asks the registry which audience its ID token must carry, so trusted publishing works on a registry whose configured audience is not its URL (#​2391)
• publish --trusted-publishing only sends its ID token to a registry reached over https, apart from a loopback address, and a failed registry version lookup is no longer remembered (#​2391)
• search reports an invalid --size or --offset value as a usage error instead of crashing with a stack trace (#​2414)
• verify-pat, unpublish and create-namespace only store a prompted personal access token once the registry accepts it, so a mistyped token is no longer reused on every later run until logout (#​2427)

Removed

• LoginOptions is no longer exported from the package entry point; it was the options type of login, which the entry point never actually exported

Dependencies

• Bump vite from 8.3.2 to 8.3.5 (#​2357)
• Replace is-ci with ci-info 4.4.0 (#​2377)
• Bump undici from 8.11.2 to 8.12.3 (#​2387)
• Resolve @azure/msal-node to 7.1.1 (#​2388)
• Upgrade yarn from 4.9.1 to 4.18.1 and set npmMinimalAgeGate to 7 days, so versions published in the last 7 days are not picked for new resolutions (#​2393)
• Bump qs from 6.16.0 to 6.16.1 (#​2415)

v1.3.0

Compare Source

Changed

• publish checks a package against the size limit that applies to its own namespace, which a size override can raise above the registry default, and refuses an oversized upload before sending it. Against a registry older than 1.3.0, which cannot report that limit, it warns against the default and publishes anyway; if a registry that should be able to report it does not answer, it says the check did not happen rather than passing silently (#​2129)

Fixed

• --version reads the version from package.json at runtime instead of a generated src/version.ts, so it can no longer report a stale version (#​2295)
• publish now deletes the .vsix it packages into the temp directory once publishing finishes or fails, instead of leaving one behind per package and target (#​2286)
• Drop the X-OpenVSX-Token header, which carries the personal access token when --username/--password are set, on a redirect to another origin, as is done for Authorization (#​2309)
• A request with a body that is redirected with 301/302/303 now fails with an error naming the redirect target, instead of being resent as a GET without its body (#​2309)
• Trusted publishing's OIDC ID token request now uses the registry client's request handling: it follows redirects (dropping the runner token on a redirect to another origin) and reports the token service's error message instead of only its status (#​2322)
• An HTML page in a successful response (any <!doctype html> casing, or a text/html Content-Type) now fails with an error naming the status, instead of printing the raw HTML or a JSON SyntaxError (#​2326)
• An error response whose JSON body starts with whitespace now reports the server's message instead of only its status (#​2326)

Dependencies

• Bump commander from 6.2.1 to 14.0.3; a command given more arguments than it takes now fails instead of ignoring the extras (#​2294)
• Bump @​vscode/vsce from 3.7.1 to 4.0.0 (#​2288)
• Bump vitest from 4.1.11 to 5.0.3, adding vite as a direct dev dependency - vitest 5 no longer bundles it, only requires it as a peer (#​2291)
• Remove leven; the command-suggestion distance check now uses a vendored Levenshtein implementation, the same way @vscode/vsce itself replaced its own leven dependency in 4.0.0 (#​2290)
• Remove tmp; temporary file names are now generated with crypto.randomUUID (#​2284)
• Remove follow-redirects; requests use node:http/node:https and the registry client follows redirects itself (#​2309)
• Bump ip-address from 10.4.0 to 10.7.2 (#​2264)
• Bump brace-expansion to 1.1.21, 2.1.7, 5.0.12
• Bump markdown-it from 14.2.0 to 14.3.2 (#​2281)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.