Build(deps-dev): bump the all-npm-dependencies group across 4 directories with 3 updates by dependabot[bot] · Pull Request #259 · advanced-security/codeql-development-mcp-server

dependabot · 2026-04-20T01:47:35Z

Updates the requirements on eslint, typescript and @vscode/vsce to permit the latest version.
Updates eslint from 10.2.0 to 10.2.1

Release notes

Sourced from eslint's releases.

v10.2.1

Bug Fixes

14be92b fix: model generator yield resumption paths in code path analysis (#20665) (sethamus)

84a19d2 fix: no-async-promise-executor false positives for shadowed Promise (#20740) (xbinaryx)

af764af fix: clarify language and processor validation errors (#20729) (Pixel998)

e251b89 fix: update eslint (#20715) (renovate[bot])

Documentation

ca92ca0 docs: reuse markdown-it instance for markdown filter (#20768) (Amaresh S M)

57d2ee2 docs: Enable Eleventy incremental mode for watch (#20767) (Amaresh S M)

c1621b9 docs: fix typos in code-path-analyzer.js (#20700) (Ayush Shukla)

1418d52 docs: Update README (GitHub Actions Bot)

39771e6 docs: Update README (GitHub Actions Bot)

71e0469 docs: fix incomplete JSDoc param description in no-shadow rule (#20728) (kuldeep kumar)

22119ce docs: clarify scope of for-direction rule with dead code examples (#20723) (Amaresh S M)

8f3fb77 docs: document meta.docs.dialects (#20718) (Pixel998)

Chores

7ddfea9 chore: update dependency prettier to v3.8.2 (#20770) (renovate[bot])

fac40e1 ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (#20763) (dependabot[bot])

7246f92 test: add tests for SuppressionsService.load() error handling (#20734) (kuldeep kumar)

4f34b1e chore: update pnpm/action-setup action to v5 (#20762) (renovate[bot])

51080eb test: processor service (#20731) (kuldeep kumar)

e7e1889 chore: remove stale babel-eslint10 fixture and test (#20727) (kuldeep kumar)

4e1a87c test: remove redundant async/await in flat config array tests (#20722) (Pixel998)

066eabb test: add rule metadata coverage for languages and docs.dialects (#20717) (Pixel998)

Commits

4d1d8f9 10.2.1
3e33105 Build: changelog update for 10.2.1
ca92ca0 docs: reuse markdown-it instance for markdown filter (#20768)
7ddfea9 chore: update dependency prettier to v3.8.2 (#20770)
57d2ee2 docs: Enable Eleventy incremental mode for watch (#20767)
c1621b9 docs: fix typos in code-path-analyzer.js (#20700)
fac40e1 ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (#20763)
7246f92 test: add tests for SuppressionsService.load() error handling (#20734)
4f34b1e chore: update pnpm/action-setup action to v5 (#20762)
1418d52 docs: Update README
Additional commits viewable in compare view

Updates typescript from 6.0.2 to 6.0.3

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

fixed issues query for TypeScript 6.0.0 (Beta).

fixed issues query for TypeScript 6.0.1 (RC).

fixed issues query for TypeScript 6.0.2 (Stable).

fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

npm

Commits

050880c Bump version to 6.0.3 and LKG
eeae9dd 🤖 Pick PR #63401 (Also check package name validity in...) into release-6.0 (#...
ad1c695 🤖 Pick PR #63368 (Harden ATA package name filtering) into release-6.0 (#63372)
0725fb4 🤖 Pick PR #63310 (Mark class property initializers as...) into release-6.0 (#...
See full diff in compare view

Updates @vscode/vsce from 3.9.0 to 3.9.1

Release notes

Sourced from @vscode/vsce's releases.

v3.9.1

Changes:

#1266: fix: module type mismatch

This list of changes was auto generated.

v3.9.1-0

Changes:

#1266: fix: module type mismatch

This list of changes was auto generated.

Commits

98cca9e fix: module type mismatch (#1266)
See full diff in compare view

Updates eslint to 10.2.1

Release notes

Sourced from eslint's releases.

v10.2.1

Bug Fixes

14be92b fix: model generator yield resumption paths in code path analysis (#20665) (sethamus)

84a19d2 fix: no-async-promise-executor false positives for shadowed Promise (#20740) (xbinaryx)

af764af fix: clarify language and processor validation errors (#20729) (Pixel998)

e251b89 fix: update eslint (#20715) (renovate[bot])

Documentation

ca92ca0 docs: reuse markdown-it instance for markdown filter (#20768) (Amaresh S M)

57d2ee2 docs: Enable Eleventy incremental mode for watch (#20767) (Amaresh S M)

c1621b9 docs: fix typos in code-path-analyzer.js (#20700) (Ayush Shukla)

1418d52 docs: Update README (GitHub Actions Bot)

39771e6 docs: Update README (GitHub Actions Bot)

71e0469 docs: fix incomplete JSDoc param description in no-shadow rule (#20728) (kuldeep kumar)

22119ce docs: clarify scope of for-direction rule with dead code examples (#20723) (Amaresh S M)

8f3fb77 docs: document meta.docs.dialects (#20718) (Pixel998)

Chores

7ddfea9 chore: update dependency prettier to v3.8.2 (#20770) (renovate[bot])

fac40e1 ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (#20763) (dependabot[bot])

7246f92 test: add tests for SuppressionsService.load() error handling (#20734) (kuldeep kumar)

4f34b1e chore: update pnpm/action-setup action to v5 (#20762) (renovate[bot])

51080eb test: processor service (#20731) (kuldeep kumar)

e7e1889 chore: remove stale babel-eslint10 fixture and test (#20727) (kuldeep kumar)

4e1a87c test: remove redundant async/await in flat config array tests (#20722) (Pixel998)

066eabb test: add rule metadata coverage for languages and docs.dialects (#20717) (Pixel998)

Commits

4d1d8f9 10.2.1
3e33105 Build: changelog update for 10.2.1
ca92ca0 docs: reuse markdown-it instance for markdown filter (#20768)
7ddfea9 chore: update dependency prettier to v3.8.2 (#20770)
57d2ee2 docs: Enable Eleventy incremental mode for watch (#20767)
c1621b9 docs: fix typos in code-path-analyzer.js (#20700)
fac40e1 ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (#20763)
7246f92 test: add tests for SuppressionsService.load() error handling (#20734)
4f34b1e chore: update pnpm/action-setup action to v5 (#20762)
1418d52 docs: Update README
Additional commits viewable in compare view

Updates eslint to 10.2.1

Release notes

Sourced from eslint's releases.

v10.2.1

Bug Fixes

14be92b fix: model generator yield resumption paths in code path analysis (#20665) (sethamus)

84a19d2 fix: no-async-promise-executor false positives for shadowed Promise (#20740) (xbinaryx)

af764af fix: clarify language and processor validation errors (#20729) (Pixel998)

e251b89 fix: update eslint (#20715) (renovate[bot])

Documentation

ca92ca0 docs: reuse markdown-it instance for markdown filter (#20768) (Amaresh S M)

57d2ee2 docs: Enable Eleventy incremental mode for watch (#20767) (Amaresh S M)

c1621b9 docs: fix typos in code-path-analyzer.js (#20700) (Ayush Shukla)

1418d52 docs: Update README (GitHub Actions Bot)

39771e6 docs: Update README (GitHub Actions Bot)

71e0469 docs: fix incomplete JSDoc param description in no-shadow rule (#20728) (kuldeep kumar)

22119ce docs: clarify scope of for-direction rule with dead code examples (#20723) (Amaresh S M)

8f3fb77 docs: document meta.docs.dialects (#20718) (Pixel998)

Chores

7ddfea9 chore: update dependency prettier to v3.8.2 (#20770) (renovate[bot])

fac40e1 ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (#20763) (dependabot[bot])

7246f92 test: add tests for SuppressionsService.load() error handling (#20734) (kuldeep kumar)

4f34b1e chore: update pnpm/action-setup action to v5 (#20762) (renovate[bot])

51080eb test: processor service (#20731) (kuldeep kumar)

e7e1889 chore: remove stale babel-eslint10 fixture and test (#20727) (kuldeep kumar)

4e1a87c test: remove redundant async/await in flat config array tests (#20722) (Pixel998)

066eabb test: add rule metadata coverage for languages and docs.dialects (#20717) (Pixel998)

Commits

4d1d8f9 10.2.1
3e33105 Build: changelog update for 10.2.1
ca92ca0 docs: reuse markdown-it instance for markdown filter (#20768)
7ddfea9 chore: update dependency prettier to v3.8.2 (#20770)
57d2ee2 docs: Enable Eleventy incremental mode for watch (#20767)
c1621b9 docs: fix typos in code-path-analyzer.js (#20700)
fac40e1 ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (#20763)
7246f92 test: add tests for SuppressionsService.load() error handling (#20734)
4f34b1e chore: update pnpm/action-setup action to v5 (#20762)
1418d52 docs: Update README
Additional commits viewable in compare view

Updates typescript to 6.0.3

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

fixed issues query for TypeScript 6.0.0 (Beta).

fixed issues query for TypeScript 6.0.1 (RC).

fixed issues query for TypeScript 6.0.2 (Stable).

fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

npm

Commits

050880c Bump version to 6.0.3 and LKG
eeae9dd 🤖 Pick PR #63401 (Also check package name validity in...) into release-6.0 (#...
ad1c695 🤖 Pick PR #63368 (Harden ATA package name filtering) into release-6.0 (#63372)
0725fb4 🤖 Pick PR #63310 (Mark class property initializers as...) into release-6.0 (#...
See full diff in compare view

Updates @vscode/vsce to 3.9.1

Release notes

Sourced from @vscode/vsce's releases.

v3.9.1

Changes:

#1266: fix: module type mismatch

This list of changes was auto generated.

v3.9.1-0

Changes:

#1266: fix: module type mismatch

This list of changes was auto generated.

Commits

98cca9e fix: module type mismatch (#1266)
See full diff in compare view

Updates eslint to 10.2.1

Release notes

Sourced from eslint's releases.

v10.2.1

Bug Fixes

14be92b fix: model generator yield resumption paths in code path analysis (#20665) (sethamus)

84a19d2 fix: no-async-promise-executor false positives for shadowed Promise (#20740) (xbinaryx)

af764af fix: clarify language and processor validation errors (#20729) (Pixel998)

e251b89 fix: update eslint (#20715) (renovate[bot])

Documentation

ca92ca0 docs: reuse markdown-it instance for markdown filter (#20768) (Amaresh S M)

57d2ee2 docs: Enable Eleventy incremental mode for watch (#20767) (Amaresh S M)

c1621b9 docs: fix typos in code-path-analyzer.js (#20700) (Ayush Shukla)

1418d52 docs: Update README (GitHub Actions Bot)

39771e6 docs: Update README (GitHub Actions Bot)

71e0469 docs: fix incomplete JSDoc param description in no-shadow rule (#20728) (kuldeep kumar)

22119ce docs: clarify scope of for-direction rule with dead code examples (#20723) (Amaresh S M)

8f3fb77 docs: document meta.docs.dialects (#20718) (Pixel998)

Chores

7ddfea9 chore: update dependency prettier to v3.8.2 (#20770) (renovate[bot])

fac40e1 ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (#20763) (dependabot[bot])

7246f92 test: add tests for SuppressionsService.load() error handling (#20734) (kuldeep kumar)

4f34b1e chore: update pnpm/action-setup action to v5 (#20762) (renovate[bot])

51080eb test: processor service (#20731) (kuldeep kumar)

e7e1889 chore: remove stale babel-eslint10 fixture and test (#20727) (kuldeep kumar)

4e1a87c test: remove redundant async/await in flat config array tests (#20722) (Pixel998)

066eabb test: add rule metadata coverage for languages and docs.dialects (#20717) (Pixel998)

Commits

4d1d8f9 10.2.1
3e33105 Build: changelog update for 10.2.1
ca92ca0 docs: reuse markdown-it instance for markdown filter (#20768)
7ddfea9 chore: update dependency prettier to v3.8.2 (#20770)
57d2ee2 docs: Enable Eleventy incremental mode for watch (#20767)
c1621b9 docs: fix typos in code-path-analyzer.js (#20700)
fac40e1 ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (#20763)
7246f92 test: add tests for SuppressionsService.load() error handling (#20734)
4f34b1e chore: update pnpm/action-setup action to v5 (#20762)
1418d52 docs: Update README
Additional commits viewable in compare view

Updates typescript to 6.0.3

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

fixed issues query for TypeScript 6.0.0 (Beta).

fixed issues query for TypeScript 6.0.1 (RC).

fixed issues query for TypeScript 6.0.2 (Stable).

fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

npm

Commits

050880c Bump version to 6.0.3 and LKG
eeae9dd 🤖 Pick PR #63401 (Also check package name validity in...) into release-6.0 (#...
ad1c695 🤖 Pick PR #63368 (Harden ATA package name filtering) into release-6.0 (#63372)
0725fb4 🤖 Pick PR #63310 (Mark class property initializers as...) into release-6.0 (#...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ries with 3 updates Updates the requirements on [eslint](https://github.com/eslint/eslint), [typescript](https://github.com/microsoft/TypeScript) and [@vscode/vsce](https://github.com/Microsoft/vsce) to permit the latest version. Updates `eslint` from 10.2.0 to 10.2.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.2.0...v10.2.1) Updates `typescript` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v6.0.2...v6.0.3) Updates `@vscode/vsce` from 3.9.0 to 3.9.1 - [Release notes](https://github.com/Microsoft/vsce/releases) - [Commits](microsoft/vscode-vsce@v3.9.0...v3.9.1) Updates `eslint` to 10.2.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.2.0...v10.2.1) Updates `eslint` to 10.2.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.2.0...v10.2.1) Updates `typescript` to 6.0.3 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v6.0.2...v6.0.3) Updates `@vscode/vsce` to 3.9.1 - [Release notes](https://github.com/Microsoft/vsce/releases) - [Commits](microsoft/vscode-vsce@v3.9.0...v3.9.1) Updates `eslint` to 10.2.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.2.0...v10.2.1) Updates `typescript` to 6.0.3 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v6.0.2...v6.0.3) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.2.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-dependencies - dependency-name: typescript dependency-version: 6.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-dependencies - dependency-name: "@vscode/vsce" dependency-version: 3.9.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-npm-dependencies - dependency-name: eslint dependency-version: 10.2.1 dependency-type: direct:development dependency-group: all-npm-dependencies - dependency-name: eslint dependency-version: 10.2.1 dependency-type: direct:development dependency-group: all-npm-dependencies - dependency-name: typescript dependency-version: 6.0.3 dependency-type: direct:development dependency-group: all-npm-dependencies - dependency-name: "@vscode/vsce" dependency-version: 3.9.1 dependency-type: direct:development dependency-group: all-npm-dependencies - dependency-name: eslint dependency-version: 10.2.1 dependency-type: direct:development dependency-group: all-npm-dependencies - dependency-name: typescript dependency-version: 6.0.3 dependency-type: direct:development dependency-group: all-npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-04-20T01:47:49Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/eslint

^10.2.1

Unknown

npm/@vscode/vsce

^3.9.1

Unknown

npm/eslint

^10.2.1

Unknown

npm/typescript

^6.0.3

Unknown

npm/@eslint/config-array

0.23.5

Unknown

npm/@eslint/config-helpers

0.5.5

Unknown

npm/@eslint/core

1.2.1

Unknown

npm/@eslint/object-schema

3.0.5

Unknown

npm/@eslint/plugin-kit

0.7.1

Unknown

npm/@vscode/vsce

3.9.1

🟢 6.4

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	🟢 10	19 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	⚠️ -1	packaging workflow not detected
License	🟢 9	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Branch-Protection	🟢 8	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
Fuzzing	⚠️ 0	project is not fuzzed

npm/eslint

10.2.1

🟢 6.3

Details

Check	Score	Reason
Code-Review	🟢 6	Found 17/25 approved changesets -- score normalized to 6
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 9	SAST tool detected but not run on all commits

npm/typescript

6.0.3

🟢 8.3

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 18/19 approved changesets -- score normalized to 9
Packaging	⚠️ -1	packaging workflow not detected
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Vulnerabilities	🟢 7	3 existing vulnerabilities detected
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Branch-Protection	⚠️ -1	internal error: error during GetBranch(release-5.9): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
SAST	🟢 10	SAST tool is run on all commits
Fuzzing	🟢 10	project is fuzzed
CI-Tests	🟢 10	29 out of 29 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 35 contributing companies or organizations

npm/eslint

^10.2.1

Unknown

npm/typescript

^6.0.3

Unknown

Scanned Files

client/package.json
extensions/vscode/package.json
package-lock.json
server/package.json

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 20, 2026

dependabot bot requested review from data-douser and enyil as code owners April 20, 2026 01:47

dependabot bot added the javascript Pull requests that update javascript code label Apr 20, 2026

dependabot bot requested a review from a team as a code owner April 20, 2026 01:47

data-douser approved these changes Apr 20, 2026

View reviewed changes

data-douser merged commit bbfe71e into main Apr 20, 2026
17 checks passed

data-douser deleted the dependabot/npm_and_yarn/all-npm-dependencies-095ea5f0a7 branch April 20, 2026 03:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Build(deps-dev): bump the all-npm-dependencies group across 4 directories with 3 updates#259

Build(deps-dev): bump the all-npm-dependencies group across 4 directories with 3 updates#259
data-douser merged 1 commit intomainfrom
dependabot/npm_and_yarn/all-npm-dependencies-095ea5f0a7

dependabot bot commented on behalf of github Apr 20, 2026

Uh oh!

github-actions bot commented Apr 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Apr 20, 2026

v10.2.1

Bug Fixes

Documentation

Chores

TypeScript 6.0.3

v3.9.1

Changes:

v3.9.1-0

Changes:

v10.2.1

Bug Fixes

Documentation

Chores

v10.2.1

Bug Fixes

Documentation

Chores

TypeScript 6.0.3

v3.9.1

Changes:

v3.9.1-0

Changes:

v10.2.1

Bug Fixes

Documentation

Chores

TypeScript 6.0.3

Uh oh!

github-actions bot commented Apr 20, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant