[Bill Schnurr (bschnurr)]

Summary

Updates the parent test dependencies that retain vulnerable transitive packages:

• upgrades mocha from 11.x to 12.x, resolving serialize-javascript to 7.1.1;
• upgrades @vscode/test-electron from 2.x to 3.1.0, removing @tootallnate/once;
• updates external/vscode-common-python-lsp to the prerequisite Mocha 12 change in chore(deps-dev): bump mocha to 12 vscode-common-python-lsp#105.

This addresses Dependabot alerts #55 (GHSA-5c6j-r48x-rmvq), #81 (GHSA-qj8w-gfj5-8c6v), and #79 (GHSA-vpq2-c234-7xj6).

Dependency

Draft until microsoft/vscode-common-python-lsp#105 merges. After that PR is squash-merged, this branch must update the submodule pointer to the resulting commit on the shared repository's default branch and be revalidated.

Validation

• npm ci using the public lockfile URLs
• authenticated internal-feed npm ci
• npm run lint
• direct Prettier checks for TypeScript and YAML
• npm run pretest
• VS Code extension tests: 10 passing
• production VSIX packaging

No overrides, resolutions, --force, or --legacy-peer-deps were used. Committed lockfile URLs remain public for GitHub Actions; Azure Pipelines rewrites them to Pylance_PublicPackages for authenticated installation.

[Bill Schnurr (bschnurr)]

Copilot resolve the merge conflicts in this pull request

[Copilot]

Copilot resolve the merge conflicts in this pull request

Merged main into this branch in 712dd64. The only conflict was package-lock.json; I resolved it by taking main's lockfile (keeping the .npmrc/Dependabot changes from #747 and the transitive fixes from #744/#745) and regenerating it against this branch's package.json and submodule pointer.

Verified in the resulting lockfile: mocha 12.0.2, @vscode/test-electron 3.1.0, serialize-javascript 7.1.1, no @tootallnate/once, all registry URLs still public, and npm install --package-lock-only is a no-op.

Note: npm ci can't complete in this sandbox — the @vscode/python-environments tarball redirects to *.vsblob.vsassets.io, which is firewall-blocked, so lint/tests will need CI to confirm.

[Eduardo Villalpando Mello (edvilme)]

Copilot resolve merge conflicts with this PR and make sure it is updated

[Copilot]

Copilot resolve merge conflicts with this PR and make sure it is updated

Merged main (now through #749) in 1db9b2d — a true merge commit with both parents.

Two conflicts:

• package.json — @vscode/test-electron. This branch had it pinned to 2.3.10 (eb3ca98, to dodge the ora 8/string-width 7 subtree), while Bump the "dependencies" group with 3 updates across multiple ecosystems #749 bumped main to ^3.1.0. I took main's ^3.1.0, because the 2.3.10 pin reintroduces @tootallnate/once via http-proxy-agent@4 — the exact package this PR set out to remove. get-east-asian-width is present either way now, since main carries it independently of this branch.
• package-lock.json — resolved by taking main's lockfile and regenerating against this branch's package.json and submodule pointer. Regeneration is idempotent (identical hash on a second run).

Submodule stays at d26410d as set by #750; main didn't touch it.

Verified: mocha 12.0.2, @vscode/test-electron 3.1.0, serialize-javascript 7.1.2 under mocha, zero @tootallnate/once, registry URLs still public, root devDeps match the lockfile, and no unmet non-optional deps.

The branch now differs from main by only mocha ^12.0.1, the submodule pointer, and the lockfile — the test-electron half of this PR has effectively already landed on main.

One caveat: npm ci still can't run in this sandbox (the @vscode/python-environments tarball redirects to a firewalled *.vsblob.vsassets.io host), so lint/tests need CI to confirm.