NPM upgrade, bump dependencies to reduce vulnerabilities and add lockfile maintenance guide - #17741
Merged
Conversation
ndoschek
changed the title
Member
Author
ndoschek
force-pushed
the
nd/npm-upgrade
branch
2 times, most recently
from
July 3, 2026 10:46
63d4620 to
e6961cc
Compare
This comment was marked as outdated.
This comment was marked as outdated.
jfaltermeier
reviewed
Jul 3, 2026
jfaltermeier
left a comment
jfaltermeier
left a comment
Contributor
There was a problem hiding this comment.
I've added two comments about VSCode types/engines, besides that it looks good.
| }, | ||
| "engines": { | ||
| "vscode": "^1.51.0" | ||
| "vscode": "^1.120.0" |
Contributor
There was a problem hiding this comment.
I know this was broken before, but the sample plugins do not build. I think we need to align the engine with the types below.
Member
Author
There was a problem hiding this comment.
Ah definitely, thanks for catching that Johannes!
I had that vsce update prepared but overlooked alignes the engines, I updated them now to match the types and they should build again 👍
| "devDependencies": { | ||
| "@theia/api-provider-sample": "1.73.0" | ||
| "@theia/api-provider-sample": "1.73.0", | ||
| "@types/vscode": "^1.120.0" |
Contributor
There was a problem hiding this comment.
Should we use 125 here as well?
ndoschek
force-pushed
the
nd/npm-upgrade
branch
2 times, most recently
from
July 3, 2026 14:14
e31fe9d to
fd8902d
Compare
ndoschek
changed the title
Member
Author
|
I also updated the last commit to already add a helper for the lockfile maintenance instead of only documenting. Could you have another look there as well? TIA |
- ran npm upgrade after 1.73.x - align dependency ranges with resolved versions in package-lock - align MCPFrontendContributionManager and MCPTestContribution - pin yauzl override to ~3.3.2 (was ^3.3.1) to block the 3.4.0 bump that re-introduces the extract-zip race on Node 24 (GH-17570) Contributed on behalf of STMicroelectronics
- compression-webpack-plugin 9 to 12, copy-webpack-plugin 8 to 14 (serialize-javascript RCE/XSS/DoS) - esbuild 0.24 to 0.28 (dev server CORS) - add esbuild to root devDependencies so it hoists to the repo root - scanoss 0.15 to 0.40 (nested tar advisories) - electron-mocha 12 to 13, mocha 10 to 11 (minimatch ReDoS, js-yaml DoS) - nyc 17 to 18, dockerode 4 to 5 (uuid bounds check) Contributed on behalf of STMicroelectronics
- bumps @vscode/vsce from ^2.32.0 to ^3.9.2 - resolves the high-severity linkify-it ReDoS vulnerability that was pulled in transitively via markdown-it - add generic readme for Theia sample plugins - update vscode engines for all sample plugins to align with the @types/vscode version Contributed on behalf of STMicroelectronics
- place temp dir under $HOME so the XDG trash dir is on the same filesystem - avoids EACCES when /tmp is on a mount whose root is not user-writable Contributed on behalf of STMicroelectronics
- add scripts/npm-install-with-platforms.js: runs npm install --include=optional and restores platform-specific optional-dep entries and libc fields that npm strips based on host platform - add scripts/verify-lockfile-platforms.js: asserts known libc-bearing entries and platform-specific optional-dep families are present in the lockfile - wire the verifier into the ci-cd lint job, gated on package-lock.json changes for PRs, always run on push and manual dispatch as a canary - extend scripts/check_git_status.sh with a lockfile-specific hint pointing at the regen script when the lockfile drifts after install - add doc/lockfile-maintenance.md describing the problem, the snapshot-and-restore workflow, and the CI guard, linked from Developing.md and the CLAUDE.md read-on-demand list Contributed on behalf of STMicroelectronics
Member
Author
|
https://gitlab.eclipse.org/eclipsefdn/emo-team/iplab/-/work_items/29406 was now also approved in the meantime, so I updated the commit again to also have the mermaid upgrade in there and updated the commit messages once more. |
github-project-automation
Bot
moved this from Waiting on reviewers
to Needs merge
in PR Backlog
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What it does
via markdown-it
regenerate-on-22-then-restore workflow. Link it from Developing.md and the
CLAUDE.md read-on-demand list.
How to test
npm ciruns cleanly@modelcontextprotocol/inspectoragainst the Theia MCP server: the sampletest-toolstill executes successfullyFollow-ups
Breaking changes
Attribution
Contributed on behalf of STMicroelectronics
Review checklist
nlsservice (for details, please see the Internationalization/Localization section in the Coding Guidelines)Reminder for reviewers