Document VS Code Marketplace release - #1165
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughDocuments Vera Language 0.2.0 Marketplace availability, adds installation instructions, clarifies language-server requirements, updates generated editor-support content, records a dependency security fix, and removes the completed Marketplace publication roadmap item. ChangesVS Code Marketplace release documentation
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 8✅ Passed checks (8 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1165 +/- ##
=======================================
Coverage 93.81% 93.81%
=======================================
Files 99 99
Lines 33457 33457
Branches 458 458
=======================================
Hits 31389 31389
Misses 2055 2055
Partials 13 13
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Addressed the Kimi K3 review in Finding 1 — stale agent-facing Marketplace guardrails: fixedThe finding was valid. Validation:
Finding 2 —
|
The lockfile change in this branch reads as incidental drift, but `brace-expansion <= 5.0.7` carries GHSA-mh99-v99m-4gvg, a high-severity denial of service (unbounded expansion length crashes the process out of memory), and 5.0.8 is the first patched version -- there is an open Dependabot alert on `editors/vscode/package-lock.json` naming exactly it. A high-severity fix should not merge invisibly inside a documentation PR, so it gets a CHANGELOG `### Security` entry with the scope stated: it reaches the lockfile transitively via `minimatch`, so it is build-time tooling for the extension rather than anything shipped to users, and the narrowed `node` range (18 dropped) changes nothing because the extension targets VS Code ^1.91.0 and both CI workflows build on Node 22. Co-Authored-By: Claude <noreply@anthropic.invalid>
d36426c to
da5e10e
Compare
ReviewRebased onto The premise checks out
The finding: a high-severity fix is riding here invisibly
It isn't. There is an open Dependabot alert (#18, high severity) on that exact manifest:
The change is right and should stay. What was wrong is that it would have merged silently inside a documentation PR — nobody reading the title, the body or the release notes would learn a high-severity advisory closed. Added a CHANGELOG Checks that came back clean
Two notes, neither blockingA claim I can't reproduce. The CHANGELOG says the published package "was downloaded and compared file-for-file with a fresh build from Process narration in a rule file.
with the "was verified from a clean profile" evidence staying in the CHANGELOG entry, where it belongs. Left as-is pending your call, since it's your instruction file's voice. Merge is yours. |
Two review fixes. The CHANGELOG entry called the `brace-expansion` bump build-time tooling. That is wrong. npm does not mark it dev-only, and the chain is `vscode-languageclient` -- a root `dependencies` entry -- through `minimatch` to `brace-expansion`; `esbuild.js` bundles with `external: ["vscode"]` alone, so everything else lands in the shipped `dist/extension.js`. The published 0.2.0 extension therefore contains the vulnerable version and the next release picks up the fix. Whether the vulnerable path is reachable from the client's use of `minimatch` was not established, and the entry now says so rather than implying an answer. It also records that Dependabot's #1167 proposes the identical change -- verified byte-identical, same resulting blob 7cbb052 -- and is closed in favour of this PR. `AGENTS.md` and `CLAUDE.md` read "has been verified from a clean profile", which is an audit trail rather than a rule and ages badly: verified when, by whom? The convention is that every doc except the CHANGELOG states present reality, with history in the changelog. The rule now states the requirement -- live on the channel AND the install flow works end to end, checked rather than recalled -- and the evidence stays in the CHANGELOG where it belongs. Co-Authored-By: Claude <noreply@anthropic.invalid>
|
Claude Code and Opus 5 taking this over from Codex and GPT 5.6 Sol to converge it. Pushed at #1167 is closed in favour of this PRDependabot opened #1167 for the same Same base blob on both sides, and #1167 touches nothing else, so this PR fully subsumes it. Closed with that reasoning recorded on both. Correcting my own reviewThe npm does not mark
What I have not established is whether the vulnerable path is reachable from how the language client uses The other review finding, applied
The evidence stays in the CHANGELOG, where it belongs. State
|
Fixing the lockfile does not reach anyone: the published 0.2.0 VSIX has brace-expansion 5.0.7 bundled into `dist/extension.js`, and Marketplace versions are immutable, so the fix ships only in a new version. Bumps `package.json` and both version fields in `package-lock.json` (npm keeps the root version twice), and adds a `## 0.2.1` section to the extension's CHANGELOG describing the advisory and its scope. The 0.2.0 section is left describing what 0.2.0 actually was -- vulnerable dependency included -- rather than being retroactively corrected; its "First release on the VS Code Marketplace" line stays, because that is true of 0.2.0. Anyone reading it needs to learn that 0.2.0 carries the vulnerable version and 0.2.1 does not, which a rewrite of the shipped section would hide. Extension self-checks pass: `node --check` on all three scripts, 13/13 `node --test`. Co-Authored-By: Claude <noreply@anthropic.invalid>
|
The branch had the lockfile fix but left the extension at 0.2.0, which would have made the post-merge upload impossible: Marketplace versions are immutable, so a rebuilt 0.2.0 VSIX cannot replace the published one. Bumped to 0.2.1 in all three places the version lives — The extension's Extension self-checks pass: So the sequence after merge is: build |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@editors/vscode/package.json`:
- Line 5: Synchronize the version in editors/vscode/package.json with the root
CHANGELOG.md by adding a non-empty ## [0.2.1] section and its comparison link;
otherwise defer the "0.2.1" bump until that changelog section exists.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 8f3c47cd-fc0e-4eb3-b40d-38ee6b8c8676
⛔ Files ignored due to path filters (1)
editors/vscode/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (3)
CHANGELOG.mdeditors/vscode/CHANGELOG.mdeditors/vscode/package.json
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
aallan/vera-bench(manual)
1 participant
Summary
veralang.vera-languageMarketplace install route across the extension README, project README, LSP/PyPI guidance, and veralang.devThe public Marketplace VSIX was downloaded before these claims were added. Its extracted contents match a fresh build from current
mainfile-for-file, and a clean isolated VS Code profile successfully installedveralang.vera-language@0.2.0through the Marketplace CLI. The downloaded artifact's SHA-256 isb04afb6a1c0a397697346553bd743dd26cd13b119edb967f8b9b29ff12612242.Validation
python scripts/build_site.pypython scripts/check_site_assets.py.venv/bin/python scripts/check_doc_counts.py.venv/bin/python -m pytest tests/test_readme.py tests/test_html.py -q— 6 passednpm run checknpm test— 13 passednpm run packageCloses #1106
Summary by CodeRabbit
New Features
code --install-extension veralang.vera-language.Security
Documentation