Update VS Code Dependencies - #706
Conversation
There was a problem hiding this comment.
Pull Request Overview
This pull request updates dependencies in the VS Code extension's package-lock.json file, including version upgrades for several packages and the addition of new @isaacs/* packages. While the dependency updates generally appear reasonable, there are critical issues with peer dependency flags that need to be addressed.
Key Changes
- Added new dependencies
@isaacs/balanced-matchand@isaacs/brace-expansionto replace the olderbrace-expansionpackage - Updated versions for
glob,minimatch,js-yaml, andtar-fspackages with new integrity hashes - Marked several packages with
"peer": trueflag, which is incorrect for packages explicitly listed as devDependencies
Reviewed Changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| DevSkim-VSCode-Plugin/package-lock.json | Updates dependency versions and adds new @isaacs scoped packages. Contains incorrect "peer": true flags for packages that are direct devDependencies. |
| Changelog.md | Documents the dependency updates for version 1.0.67 released on 2025-11-18. |
Files not reviewed (1)
- DevSkim-VSCode-Plugin/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-5.62.0.tgz", | ||
| "integrity": "sha512-VlJEV0fOQ7BExOsHYAGrgbEiZoi8D+Bl2+f6V2RrXerRSylnp+ZBHmPvaIa8cz0Ajx7WO7Z5RqfgYg7ED1nRhA==", | ||
| "dev": true, | ||
| "peer": true, |
There was a problem hiding this comment.
The @typescript-eslint/parser package is marked with "peer": true, but it's explicitly listed as a devDependency in package.json (line 331). Packages that are direct dependencies (including devDependencies) should not have the "peer": true flag. This flag should only be present for packages that are installed solely to satisfy peer dependency requirements of other packages, not for packages that are directly declared as dependencies.
| "peer": true, |
| "integrity": "sha512-ypowyDxpVSYpkXr9WPv2PAZCtNip1Mv5KTW0SCurXv/9iOpcrH9PaqUElksqEB6pChqHGDRCFTyrZlGhnLNGiA==", | ||
| "deprecated": "This version is no longer supported. Please see https://eslint.org/version-support for other options.", | ||
| "dev": true, | ||
| "peer": true, |
There was a problem hiding this comment.
The eslint package is marked with "peer": true, but it's explicitly listed as a devDependency in package.json (line 334). Packages that are direct dependencies (including devDependencies) should not have the "peer": true flag. This flag should only be present for packages that are installed solely to satisfy peer dependency requirements of other packages, not for packages that are directly declared as dependencies.
| "peer": true, |
| "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.9.5.tgz", | ||
| "integrity": "sha512-1FXk9E2Hm+QzZQ7z+McJiHL4NW1F2EzMu9Nq9i3zAaGqibafqYwCVU6WyWAuyQRRzOlxou8xZSyXLEN8oKj24g==", | ||
| "dev": true, | ||
| "peer": true, |
There was a problem hiding this comment.
The typescript package is marked with "peer": true, but it's explicitly listed as a devDependency in package.json (line 336). Packages that are direct dependencies (including devDependencies) should not have the "peer": true flag. This flag should only be present for packages that are installed solely to satisfy peer dependency requirements of other packages, not for packages that are directly declared as dependencies.
| "peer": true, |
This pull request updates several dependencies in the
DevSkim-VSCode-Plugin/package-lock.jsonfile to newer versions, adds new package variants, and introduces peer dependency flags to improve compatibility and package management. The most significant changes are grouped below.Dependency Upgrades and Replacements:
globandminimatchdependencies for the VS Code extension, including replacingbrace-expansionwith@isaacs/brace-expansionand updating related sub-dependencies and license information. [1] [2]@isaacs/balanced-matchand@isaacs/brace-expansionto support updated glob and minimatch packages.js-yaml(both direct and nested),tar-fs, and their integrity hashes to the latest releases. [1] [2] [3]Peer Dependency Adjustments:
@typescript-eslint/parser,acorn,eslint,typescript) as peer dependencies to improve compatibility and package management. [1] [2] [3] [4]Documentation:
Changelog.mdto reflect the new version (1.0.67) and document the dependency updates for the VS Code extension.