dependabot[bot]
7f25500e74
Bump aquasecurity/trivy-action to latest ( #7966 )
2026-09-08 13:24:21 -08:00
dependabot[bot]
e57e399b41
Bump github/codeql-action/init from 4.37.8 to 4.37.9 ( #7999 )
2026-09-08 13:18:55 -08:00
dependabot[bot]
b262510fd8
Bump github/codeql-action/analyze from 4.37.6 to 4.37.9 ( #8001 )
2026-09-08 13:14:51 -08:00
dependabot[bot]
716a4eedbe
Bump github/codeql-action/autobuild from 4.37.6 to 4.37.8 ( #7974 )
2026-09-08 12:50:22 -08:00
dependabot[bot]
577da3111f
chore: bump github/codeql-action/init from 4.37.6 to 4.37.8 ( #7975 )
2026-09-08 12:49:54 -08:00
Asher
2d5dbf0b77
Update codeql actions to 4.37.6
...
One was updated by Dependabot, but not the others.
2026-08-19 14:57:47 -08:00
dependabot[bot]
2edeb1c991
chore: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.6 ( #7917 )
2026-08-19 13:28:08 -08:00
dependabot[bot]
02badb2056
chore: bump github/codeql-action/init from 4.36.2 to 4.37.6 ( #7918 )
2026-08-19 13:24:38 -08:00
dependabot[bot]
30852bb006
chore: bump actions/setup-node from 6.4.0 to 7.0.0 ( #7921 )
2026-08-19 13:22:13 -08:00
dependabot[bot]
1dabd152be
chore: bump actions/checkout from 6.0.3 to 7.0.1 ( #7874 )
2026-07-21 19:18:19 +00:00
dependabot[bot]
a59c3ab990
Bump github/codeql-action from 4.35.4 to 4.36.2 ( #7860 )
2026-06-16 11:51:47 -08:00
dependabot[bot]
a7f457046f
Bump actions/checkout from 6.0.2 to 6.0.3 ( #7852 )
2026-06-16 11:51:19 -08:00
dependabot[bot]
c9faf343ba
chore: bump aquasecurity/trivy-action ( #7769 )
2026-05-22 12:27:36 -08:00
Asher
9527b7879f
Pin GitHub actions
2026-05-07 10:30:37 -08:00
dependabot[bot]
841ec45573
chore: bump aquasecurity/trivy-action from 0.33.1 to 0.34.1 ( #7676 )
2026-03-03 12:29:03 -09:00
dependabot[bot]
352636408c
chore: bump github/codeql-action from 3 to 4 ( #7546 )
2026-01-23 12:39:40 -09:00
dependabot[bot]
eccb1eb537
chore: bump actions/setup-node from 4 to 6 ( #7550 )
2025-12-02 13:04:45 -09:00
dependabot[bot]
9819b91c74
chore: bump actions/checkout from 5 to 6 ( #7585 )
2025-12-01 12:47:25 -09:00
dependabot[bot]
35e7b09a85
chore: bump actions/checkout from 4 to 5 ( #7508 )
2025-10-28 16:12:00 -08:00
dependabot[bot]
7beb05d04f
chore: bump aquasecurity/trivy-action from 0.32.0 to 0.33.1 ( #7507 )
2025-10-28 16:11:42 -08:00
dependabot[bot]
1805daed07
chore: bump aquasecurity/trivy-action from 0.31.0 to 0.32.0 ( #7450 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.31.0 to 0.32.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](76071ef0d7...dc5a429b52support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-04 10:31:21 -08:00
dependabot[bot]
740a2d3aa3
chore: bump aquasecurity/trivy-action from 0.30.0 to 0.31.0 ( #7408 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.30.0 to 0.31.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](6c175e9c40...76071ef0d7support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-15 12:39:08 -08:00
Jakub Domeracki
6e26dad1b1
fix: update GitHub Actions Runner images ( #7379 )
2025-06-16 12:04:57 -08:00
dependabot[bot]
b07335a0f1
chore: bump aquasecurity/trivy-action from 0.29.0 to 0.30.0 ( #7288 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.29.0 to 0.30.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](18f2510ee3...6c175e9c40support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-14 10:57:40 -08:00
dependabot[bot]
96800cc521
chore: bump aquasecurity/trivy-action from 0.28.0 to 0.29.0 ( #7097 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.28.0 to 0.29.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](915b19bbe7...18f2510ee3support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-11 11:11:50 -09:00
dependabot[bot]
fc97e248c3
chore: bump aquasecurity/trivy-action from 0.24.0 to 0.28.0 ( #7060 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.24.0 to 0.28.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](6e7b7d1fd3...915b19bbe7support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-08 10:12:29 -09:00
Olivier Benz
fc6064dcd3
Update Code to 1.94.2 ( #7026 )
...
* Update Code to 1.94.2
* Convert from yarn to npm
This is to match VS Code. We were already partially using npm for the
releases so this is some nice alignment.
* Update caniuse-lite
This was complaining on every unit test.
* Update eslint
I was having a bunch of dependency conflicts and eslint seemed to be the
culprit so I just removed it and set it up again, since it seems things
have changed quite a bit.
* Update test dependencies
I was getting oom when running the unit tests...updating seems to work.
* Remove package.json `scripts` property in release
The new pre-install script was being included, which is dev-only.
This was always the intent; did not realize jq's merge was recursive.
* Remove jest and devDependencies in release as well
* Update test extension dependencies
This appears to be conflicting with the root dependencies.
* Fix playwright exec
npm does not let you run binaries like yarn does, as far as I know.
* Fix import of server-main.js
* Fix several tests by waiting for selectors
2024-10-17 20:32:21 -08:00
Asher
a9eb923790
Remove unused audit-ci dependency
...
There is a `yarn ci` script which was using audit-ci but this does not
appear to be called anywhere.
The security worflow uses `yarn audit` and `npm audit` which seem fine
enough anyway.
2024-07-10 13:23:24 -08:00
dependabot[bot]
2b33ca8a3f
chore: bump aquasecurity/trivy-action from 0.21.0 to 0.24.0 ( #6894 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.21.0 to 0.24.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](fd25fed697...6e7b7d1fd3support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-10 13:10:01 -08:00
dependabot[bot]
fc47b4f1c5
chore: bump aquasecurity/trivy-action from 0.19.0 to 0.21.0 ( #6819 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.19.0 to 0.21.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](d710430a67...fd25fed697support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-03 10:44:54 -08:00
dependabot[bot]
ebd79ed958
chore: bump aquasecurity/trivy-action from 0.18.0 to 0.19.0 ( #6739 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.18.0 to 0.19.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](062f259268...d710430a67support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-05 14:24:18 -08:00
dependabot[bot]
5453d02872
chore: bump aquasecurity/trivy-action from 0.16.1 to 0.18.0 ( #6705 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.16.1 to 0.18.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](d43c1f16c0...062f259268support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-07 10:20:04 -09:00
dependabot[bot]
2db0184c4a
chore: bump github/codeql-action from 2 to 3 ( #6653 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 2 to 3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/v2...v3 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-01 16:37:33 -09:00
dependabot[bot]
21e798ccdf
chore: bump aquasecurity/trivy-action from 0.14.0 to 0.16.1 ( #6621 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.14.0 to 0.16.1.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](2b6a709cf9...d43c1f16c0support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-05 13:28:00 -09:00
Asher
da254c39ee
Set Node version in a single place ( #6534 )
...
This should make it much easier to update. Also use 18.15.0
specifically since that is what VS Code ships with.
Additionally, it fixes the post-install script being skipped due to
a Yarn v1 bug that happens when Yarn installs node-gyp, which
it does because 18.18 onward stopped bundling node-gyp.
2023-11-14 12:45:56 -09:00
dependabot[bot]
ae75f76e30
chore: bump aquasecurity/trivy-action from 0.13.1 to 0.14.0 ( #6530 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.13.1 to 0.14.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](f78e9ecf42...2b6a709cf9support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-14 09:26:40 -09:00
dependabot[bot]
c4efcaf079
chore: bump actions/setup-node from 3 to 4 ( #6512 )
...
Bumps [actions/setup-node](https://github.com/actions/setup-node ) from 3 to 4.
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/v3...v4 )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-14 09:23:05 -09:00
dependabot[bot]
3fc30cae3e
chore: bump aquasecurity/trivy-action from 0.12.0 to 0.13.1 ( #6514 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.12.0 to 0.13.1.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](fbd16365eb...f78e9ecf42support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-14 09:21:03 -09:00
dependabot[bot]
80dfb2b2a9
chore: bump actions/checkout from 3 to 4 ( #6462 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v3...v4 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-04 15:50:11 -08:00
dependabot[bot]
8ee45686b0
chore: bump aquasecurity/trivy-action from 0.11.2 to 0.12.0 ( #6461 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.11.2 to 0.12.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](41f05d9ecf...fbd16365ebsupport@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-02 13:24:45 -08:00
Asher
acc50a5d36
Update dependencies and force-update qs ( #6440 )
...
* Update dependencies and force-update qs
This is mainly an attempt to get rid of as many resolutions as possible
since it seems they are unnecessary except for qs (according to yarn/npm
audit).
For qs use 6.9.7 since Express is using 6.9.6 and that matches the most
closely.
Also add overrides since this is npm's version of yarn's resolutions and
we need it for the shrinkwrap to generate with the right dependencies.
Decided to keep pinning @types/node as well although I am not sure it is
necessary. Express is pulling in v20 types. Since this is
development-only we only need it in resolutions.
* Run formatter
Some rules seem to have changed with the dependency updates.
* Replace deprecated bodyParser.json() usage
* Audit npm shrinkwrap as well
* Skip installing dependencies in audit
It seems the tools only require the lock files.
* Fix tests when using ipv6
* Add missing openssl dependency to flake
2023-09-21 16:13:34 -08:00
Asher
70d0c603cc
Update to VS Code 1.82.2 ( #6436 )
...
* Update VS Code to 1.82.2
* Add new libkrb5 dependency
* Update patches
The only changes were to context except:
- The URL callback provider uses a new _callbackRoute argument and moved
locations.
- The telemetry provider gets passed the request service as the first
argument now.
- CSP hash changed, as usual.
* Update Node to v18
* Revert back to es2020
es2022 is breaking Safari.
2023-09-20 15:33:28 -08:00
dependabot[bot]
e72e8bb6b5
chore: bump aquasecurity/trivy-action from 0.10.0 to 0.11.2 ( #6303 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.10.0 to 0.11.2.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](e5f43133f6...41f05d9ecfsupport@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-07-13 16:04:18 -05:00
dependabot[bot]
7722ef1437
chore: bump aquasecurity/trivy-action from 0.9.2 to 0.10.0 ( #6178 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.9.2 to 0.10.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](1f0aa582c8...e5f43133f6support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-05-01 11:17:06 -05:00
Asher
78282a1fd6
Make random formatting change to security.yaml
...
This is an attempt to set myself as the notification target.
Closes #6090 .
2023-03-21 12:24:10 -08:00
dependabot[bot]
85e083580d
chore: bump aquasecurity/trivy-action from 0.9.0 to 0.9.2 ( #6075 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.9.0 to 0.9.2.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](cff3e9a7f6...1f0aa582c8support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-14 16:49:25 -05:00
renovate[bot]
6e1b9131e9
chore(deps): update aquasecurity/trivy-action digest to cff3e9a ( #5994 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-02-06 11:36:05 -06:00
renovate[bot]
c885c96644
chore(deps): update minor dependency updates ( #5720 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2022-11-09 14:03:07 -07:00
renovate[bot]
606811fbfd
chore(deps): update aquasecurity/trivy-action digest to e55de85 ( #5702 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2022-10-25 08:32:55 -07:00
Joe Previte
8629d6a474
refactor: run security on package.json changes ( #5602 )
...
* refactor: run security on package.json changes
* fixup: add to main push too
2022-09-29 14:46:48 -05:00
