chore(deps-dev): bump @vscode/vsce from 3.9.2 to 4.0.0

[dependabot]

Bumps @vscode/vsce from 3.9.2 to 4.0.0.

Release notes

Sourced from @​vscode/vsce's releases.

v4.0.0

Changes:

• #1329: Offer prompted migration of legacy PAT credentials
• #1325: Remove leven dependency
• #1324: Replace form-data with Node streams
• #1326: Fix MSAL declaration build failure
• #1323: Relock deps and mirror to package.json
• #1314: Replace chalk with Node styling
• #1312: Remove parse-semver dependency
• #1313: Reduce secretlint dependency tree
• #1315: chore(deps): bump the github-actions group with 2 updates
• #1306: Pin GitHub Actions to full-length commit SHAs

• #1309: Replace glob with tinyglobby
• #1308: Raise Node.js baseline to 22
• #1305: Update and replace many dependencies
• #1298: chore(deps): bump js-yaml from 4.2.0 to 4.3.1
• #1297: Hide OIDC option from publish help
• #1296: Remove redundant secretlint dependency
• #1295: chore(deps): bump fast-uri from 3.1.4 to 3.1.5
• #1294: chore(deps): bump brace-expansion
• #1293: chore(deps): bump fast-uri from 3.1.2 to 3.1.4
• #1292: chore(deps): bump linkify-it from 5.0.1 to 5.0.2
• #1291: auth: support OIDC trusted publishing
• #1289: chore(deps): bump js-yaml and @​textlint/linter-formatter
• #1288: chore(deps): bump form-data from 4.0.4 to 4.0.6
• #1287: chore(deps): bump markdown-it from 14.1.1 to 14.2.0
• #1284: chore(deps): bump tmp from 0.2.6 to 0.2.7

This list of changes was auto generated.

v3.9.3-12

Changes:

• #1329: Offer prompted migration of legacy PAT credentials
• #1325: Remove leven dependency
• #1324: Replace form-data with Node streams
• #1326: Fix MSAL declaration build failure
• #1323: Relock deps and mirror to package.json
• #1314: Replace chalk with Node styling
• #1312: Remove parse-semver dependency

This list of changes was auto generated.

... (truncated)

Commits

• 9f25124 Merge pull request #1329 from microsoft/benibenj/migrate-legacy-pat-storage
• 7d84e92 Offer prompted migration of legacy PAT credentials
• 75cae44 Merge pull request #1325 from jakebailey/remove-leven
• ae9f2b7 Merge pull request #1324 from jakebailey/remove-form-data
• fa08d59 Capture both output streams in the CLI tests
• 3fb79d8 Fix multipart stream lifecycle issues
• bee68cf Extract command suggestion helper and test it
• b40452e Merge pull request #1326 from microsoft/benibenj/agents/validate-package-lock...
• d2cd4d4 Keep PR CI workflow unchanged
• fa0fdf7 Fix MSAL declaration build failure
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4d909c4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🤖 Bip Bop - Automated Dependency review of @vscode/vsce@4.0.0

Note

Model: gpt-5.6-luna
Reviewed commit: 4d909c4774c3
Workflow: View research run

🟢 Verdict: MERGE

Confidence: high

Readiness: waiting for checks

The semver-major @vscode/vsce update is technically compatible and low risk for this repository. The branch is mergeable and current (behind_by: 0), but required validation is still running and one approving review remains required.

Key findings

• Dependency: @vscode/vsce 3.9.2 → 4.0.0, a semver-major development dependency update in packages/linting/vscode/package.json.
• Compatibility: v4 requires Node >=22; repository CI and publishing workflows use Node 24 (package metadata, Node setup).
• Relevant upstream changes: v4 replaces form-data, removes several dependencies, raises the Node baseline, and adds legacy PAT migration (v4.0.0 release notes, upstream comparison).
• The repository’s publishing call site explicitly uses vsce publish --no-dependencies --azure-credential, so the default PAT credential path and legacy-PAT migration are not used (CI workflow, upstream publish options).
• No OSV advisories were returned for @vscode/vsce@4.0.0 (OSV query).
• No review comments or unresolved review threads were present. The required changeset is not applicable: this is a private extension package and the change does not version a published package; the changeset bot confirms no version bump is expected (changeset notice).
• Completed checks currently include agent-context verification and auto-labeling. Build, unit tests, code quality, Playwright, and the dependency research check are still pending; these will validate repository build/test and workflow compatibility, but do not provide full real Marketplace publishing or Azure/OIDC integration coverage (PR checks).
• Main rules require one approving review, resolved threads, linear history, and successful required quality/status checks (main ruleset).

Repository impact

Impact is limited to the VS Code extension’s packaging/publishing toolchain and its lockfile. The affected workflow already supplies Node 24, invokes the new CLI with the supported Azure credential option, and rebuilds @vscode/vsce-sign; no source adaptation is indicated. The PR is one commit ahead of current main and behind_by: 0 (compare result).

Merge path

• Wait for required PR validation to complete successfully; investigate any failed check from its logs before deciding.
• Obtain one approving review and ensure required review-thread resolution remains satisfied.
• Optional hardening: exercise the Marketplace publish job in its protected Azure/OIDC environment after merge.
• This workflow can rebase the branch and add a required dependency changeset if repository policy later determines one is needed, but a maintainer must still decide whether to merge.

Generated by Fusion AI using the repository dependency-review skill.