[mikeland73]

Summary

Updates the VS Code extension's runtime dependencies and dev toolchain. Runtime behavior stays the same.

Package	Old	New
engines.vscode / @types/vscode	^1.72.0	^1.90.0 / ~1.90.0
node-fetch + @types/node-fetch	^2	removed (uses the global fetch)
form-data	^4.0.6	removed (uses the global FormData)
js-yaml	^4.3.0	removed (not imported anywhere; it only served as a security pin)
which	^3.0.0	^7.0.0
@types/node	16.x (in dependencies and devDependencies)	20.x (devDependencies only)
typescript	^4.8.4	~6.0.3
@typescript-eslint/{parser,eslint-plugin}	^5.38.1	typescript-eslint ^8.72.0
eslint	^8.24.0	^10.13.0
@stylistic/eslint-plugin	none	^5.10.0 (new)
mocha / @types/mocha	^10.0.0 / ^10.0.0	^12.0.3 / ^10.0.10
glob / @types/glob	^8.0.3 / ^8.0.0	^13.0.6 / removed (glob ships its own types)
@vscode/test-electron	^2.1.5	^3.1.0
resolutions	7 security pins	removed (no longer needed)

Code and config changes

• fetch migration: src/openinvscode.ts now uses the global fetch and FormData instead of node-fetch and form-data. When the body is a FormData, the native fetch sets multipart/form-data with a boundary, just as before. The vm_id value is now passed as vmId ?? '', because native FormData only accepts strings. The caller has already checked that vm_id is present.
• Why VS Code 1.90 is the minimum: global fetch arrived with VS Code 1.82 (Node 18), but there it is still experimental. 1.90 (May 2024) ships Electron 29 / Node 20.9, where fetch and FormData are fully supported. Node 20 also suits the newer which/isexe packages.
• TypeScript 6: tsconfig.json now uses module: node16, which still compiles to CommonJS. The target and lib are now ES2022. types: ["node", "mocha"] is set explicitly because TS 6 no longer includes every installed @types package by default. The which and Mocha imports now use default imports (esModuleInterop).
• ESLint flat config: .eslintrc.json is replaced by eslint.config.mjs, keeping the same rules and ignores. typescript-eslint v8 removed @typescript-eslint/semi, so that rule is now @stylistic/semi. The lint script no longer passes --ext ts, which flat config doesn't support. .vscodeignore now excludes the new config file.
• Test runner: src/test/suite/index.ts uses glob 13's promise API. mocha 12 is ESM-only, so the runner loads it with a dynamic import().
• Shipped package: the only production dependencies are now which and isexe, both CommonJS. The packaged vsix is 33 files / ~36 KB.

Security

• Fixes the open Dependabot alert for serialize-javascript 7.1.1 (low). The lockfile now resolves 7.1.4 through mocha 12.
• The old resolutions block forced minimatch@3, brace-expansion@1 and others across all versions. That would break glob 13, so I removed it. The lockfile was regenerated from scratch with yarn 1.22.22, and yarn audit reports 0 vulnerabilities.

.github/workflows/vscode-ext-release.yaml needs no changes.

Test plan

• yarn install (yarn 1.22.22, Node 24): regenerated yarn.lock
• yarn audit: 0 vulnerabilities
• yarn run compile (tsc 6.0.3): no errors
• yarn run lint (eslint 10): no warnings. Also checked against a scratch file that @stylistic/semi, eqeqeq, curly and no-throw-literal still report.
• Extension test suite through @vscode/test-electron against the latest stable VS Code (1.143.1): 1 passing. I had to pass a shorter --user-data-dir locally because the worktree path made the IPC socket path too long.
• Runtime smoke check inside VS Code 1.90.0 (Node 20.9.0 / Electron 29.4.0): global fetch and FormData exist, and FormData produces a multipart/form-data; boundary=... content type. The compiled out/openinvscode.js loads. which('ls', {nothrow: true}) resolves to a path and a missing command returns null. A real fetch('https://releases.jetify.com/devbox') returns 200.
• Packaged with the same tool as the release workflow, vsce@2.15.0 package --yarn, and also with @vscode/vsce@latest package --yarn. Both succeed, and the vsix contains only out/, assets and which/isexe.
• The VM-info POST to api.devbox.sh and the open-in-VS-Code remote flow were not exercised end to end.

Note: mocha 12 needs require(esm) internally, so the test suite runs on recent VS Code (the default target for yarn test) but not on VS Code 1.90 itself. The shipped extension doesn't include mocha, so this doesn't affect users.

🤖 Generated with Claude Code