Skip to content

chore(deps-dev): bump mocha to 12 - #105

Closed
Bill Schnurr (bschnurr) wants to merge 2 commits into
mainfrom
security/mocha-12
Closed

Bill Schnurr (bschnurr) wants to merge 2 commits into
mainfrom
security/mocha-12

Conversation

@bschnurr

Copy link
Copy Markdown
Member

Summary

Updates the TypeScript test runner from Mocha 11 to Mocha 12. The new dependency graph resolves serialize-javascript to 7.1.1, above the patched 7.0.5 threshold required by the open vscode-isort Dependabot alerts.

This is a prerequisite for updating the vscode-common-python-lsp submodule pointer in microsoft/vscode-isort. No overrides, resolutions, or force flags are used.

Validation

  • Internal-feed npm ci (0 vulnerabilities)
  • npm run lint
  • npm run build
  • npm run pretest
  • npm test (145 passing)

The source-wide Prettier check reports line-ending differences in unchanged files on Windows; this PR changes only typescript/package.json and typescript/package-lock.json.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bschnurr Bill Schnurr (bschnurr) added dependencies Management of dependencies, Dependabot PRs, etc debt Code Cleanup, Refactorings and Repo health. Not feature related no-changelog Updates not included in the release notes or changelog labels Sep 15, 2026
Keep committed package URLs compatible with unauthenticated GitHub Actions while Azure Pipelines rewrites them to the internal feed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bschnurr

Copy link
Copy Markdown
Member Author

Follow-up commit 0fc025e normalizes generated lockfile URLs back to registry.npmjs.org. Public npm ci now succeeds, while internal-feed installation remains supported through registry rewriting. TypeScript Build and TypeScript Lint now pass.

@bschnurr

Copy link
Copy Markdown
Member Author

Superseded: main already contains Mocha 12, and the merged aggregate PR #121 advances it to 12.0.3. The current main lockfile resolves serialize-javascript to 7.1.2, above the patched 7.0.5 threshold described here. This PR is no longer needed; consuming extensions can update their submodule pointer to current main.

auto-merge was automatically disabled October 16, 2026 20:55

Pull request was closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

debt Code Cleanup, Refactorings and Repo health. Not feature related dependencies Management of dependencies, Dependabot PRs, etc no-changelog Updates not included in the release notes or changelog

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant