[Snyk] Security upgrade @vscode/vsce from 3.9.1 to 3.9.2

[anandgupta42]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18512280

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

---

Note

Low Risk
Patch-level dev/publish dependency bump with no runtime extension code changes; main residual risk is packaging/publish workflows if vsce behavior shifted.

Overview
Bumps @vscode/vsce from ^3.9.1 to ^3.9.2 in package.json and refreshes package-lock.json. This is a dependency-only change aimed at addressing Snyk SNYK-JS-BRACEEXPANSION-18512280 (high severity resource-allocation issue in the brace-expansion chain).

The lockfile also reflects @vscode/vsce’s updated transitive tree— notably newer glob (^13.0.6) and minimatch (^10.2.2 / ^10.2.6) under node_modules/@vscode/vsce—with no application source changes. vsce remains the tool used for vsce package / vsce publish extension packaging.

^{Reviewed by Cursor Bugbot for commit 4693b12. Bugbot is set up for automated code reviews on this repo. Configure here.}

[anandgupta42]

This is a patch version upgrade. The changes consist of dependency updates and internal build process fixes. There are no documented breaking changes or new features.

Changes:

• A fix to skip an internal API scan.
• Updates to dependencies such as tmp, qs, uuid, and minimatch.
• The continuous integration (CI) environment was updated to use Node 22, which does not affect the package's runtime requirements.

Source: GitHub Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8b71df0f-9358-4a15-b7fd-abf720414c7e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Clean Snyk dependency bump of @vscode/vsce (^3.9.1 → ^3.9.2) to address SNYK-JS-BRACEEXPANSION-18512280. The only source change is the single version line in package.json; @vscode/vsce is a build/publish tool with no runtime extension code touched. The package-lock.json changes are internally consistent (updated integrity hashes and transitive glob/minimatch tree) and are already guarded by lockfile-lint.yml, so they were not re-reviewed line by line. Patch-level bump, low merge risk. LGTM.

Files Reviewed (2 files)

• package.json
• package-lock.json

---

_{Reviewed by glm-5.2 · Input: 24.3K · Output: 3.6K · Cached: 239.4K}

_{Review guidance: REVIEW.md from base branch master}

[github-actions]

Bundle Size Report

darwin-arm64: 75.7 MB

Category	Size	Compressed	Files
Native: altimate-core	43.1 MB	15.4 MB	1
Webview JS bundles	36.2 MB	12.3 MB	346
Media assets	29.6 MB	25.8 MB	91
Native: zeromq	20.5 MB	8.2 MB	15
Webview images	15.3 MB	12.2 MB	18
Extension backend (JS)	2.8 MB	0.6 MB	1
Python packages	2.0 MB	0.5 MB	95
Native: other node_modules	1.0 MB	0.2 MB	139
Webview CSS	0.8 MB	0.2 MB	2
Webview other	0.5 MB	0.1 MB	5
Other	0.1 MB	31 KB	17
Total	151.8 MB	75.5 MB	730

linux-x64: 77.6 MB

Category	Size	Compressed	Files
Native: altimate-core	50.7 MB	16.8 MB	1
Webview JS bundles	36.2 MB	12.3 MB	346
Media assets	29.6 MB	25.8 MB	91
Native: zeromq	21.9 MB	8.7 MB	16
Webview images	15.3 MB	12.2 MB	18
Extension backend (JS)	2.8 MB	0.6 MB	1
Python packages	2.0 MB	0.5 MB	95
Native: other node_modules	1.0 MB	0.2 MB	139
Webview CSS	0.8 MB	0.2 MB	2
Webview other	0.5 MB	0.1 MB	5
Other	0.1 MB	31 KB	17
Total	160.8 MB	77.4 MB	731

win32-x64: 78.0 MB

Category	Size	Compressed	Files
Native: altimate-core	55.9 MB	17.4 MB	1
Webview JS bundles	36.2 MB	12.3 MB	346
Media assets	29.6 MB	25.8 MB	91
Native: zeromq	20.0 MB	8.1 MB	15
Webview images	15.3 MB	12.2 MB	18
Extension backend (JS)	2.8 MB	0.6 MB	1
Native: other node_modules	2.3 MB	0.7 MB	147
Python packages	2.0 MB	0.5 MB	95
Webview CSS	0.8 MB	0.2 MB	2
Webview other	0.5 MB	0.1 MB	5
Other	0.1 MB	31 KB	17
Total	165.4 MB	77.9 MB	738