[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ovsx (source)	1.3.0 → 1.4.0

Used by vscode-extension-publish.yml only; nothing here runs it before a release. Before merging: read the changelogs of vsce and ovsx (publish --packagePath, --skip-duplicate); check their engines.node against node-version. After merging: Move major tag, and watch the next extension release (vscode-jest-runner).

---

Release Notes

eclipse-openvsx/openvsx (ovsx)

v1.4.0

Compare Source

Added

• publish --registrationCode (or OVSX_REGISTRATION_CODE) completes the trusted publisher registration of a private repository on its first publish (#​2350)

Fixed

• publish -i ext.vsix now warns about the packaging options it ignores, as publish ext.vsix does, naming the file, and publishes the package once instead of once per --target (#​2351)
• get and verify ignore a timeout or connection reset while draining the error body of a rejected download, instead of cleaning up a partial file that was never written (#​2386)
• publish prints the exact byte counts next to the friendly sizes of a size limit, so a package one byte over its limit no longer reads as "1 MB exceeds the size limit of 1 MB" (#​2392)
• publish --trusted-publishing asks the registry which audience its ID token must carry, so trusted publishing works on a registry whose configured audience is not its URL (#​2391)
• publish --trusted-publishing only sends its ID token to a registry reached over https, apart from a loopback address, and a failed registry version lookup is no longer remembered (#​2391)
• search reports an invalid --size or --offset value as a usage error instead of crashing with a stack trace (#​2414)
• verify-pat, unpublish and create-namespace only store a prompted personal access token once the registry accepts it, so a mistyped token is no longer reused on every later run until logout (#​2427)

Removed

• LoginOptions is no longer exported from the package entry point; it was the options type of login, which the entry point never actually exported

Dependencies

• Bump vite from 8.3.2 to 8.3.5 (#​2357)
• Replace is-ci with ci-info 4.4.0 (#​2377)
• Bump undici from 8.11.2 to 8.12.3 (#​2387)
• Resolve @azure/msal-node to 7.1.1 (#​2388)
• Upgrade yarn from 4.9.1 to 4.18.1 and set npmMinimalAgeGate to 7 days, so versions published in the last 7 days are not picked for new resolutions (#​2393)
• Bump qs from 6.16.0 to 6.16.1 (#​2415)

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.