chore(deps): rolling dependency update

[socket-pr-bot]

Rolling dependency update

One long-lived PR, rebuilt from main on every run so it stays
mergeable. Each run appends its dependency delta below, newest first.

2026-09-22 — run · 11 updated

package	from	to
@anthropic-ai/claude-code	2.1.251	2.1.272
@socketregistry/packageurl-js	1.5.2	1.5.3
@socketregistry/packageurl-js-stable	npm:@socketregistry/packageurl-js@1.5.2	npm:@socketregistry/packageurl-js@1.5.3
@types/vscode	1.134.0	1.137.0
brace-expansion	5.0.9	5.0.12
impeccable	3.6.0	3.6.1
magic-string	1.3.1	1.4.1
rolldown-plugin-dts	0.28.4	0.28.5
typebox	1.3.30	1.3.31
vite	8.2.2	8.3.0
yaml	2.9.0	2.9.1

commits

• chore(deps): apply weekly update fixes

2026-09-21 — run · no dependency changes

No dependency ranges changed in this run.

commits

• chore(deps): apply weekly update fixes

2026-09-20 — run · no dependency changes

No dependency ranges changed in this run.

commits

• chore(deps): apply weekly update fixes

2026-09-19 — run · no dependency changes

No dependency ranges changed in this run.

commits

• chore(deps): apply weekly update fixes

2026-09-18 — run · no dependency changes

No dependency ranges changed in this run.

commits

• chore(deps): apply weekly update fixes

---

Note

Low Risk
Toolchain and lockfile pin updates only; no extension runtime or security-sensitive application logic changes.

Overview
Bumps the pinned Node version from 26.8.1 to 26.8.2 in .node-version.

package.json devEngines.packageManager is no longer a single pnpm entry; it is now an array that enforces both npm (^11.19.0 || >=12.0.2) and pnpm (^11.25.0 || >=12.3.4), each with onFail: "error". The existing engines.npm / engines.pnpm ranges are unchanged.

pnpm-lock.yaml updates the bundled pnpm toolchain from 12.4.2 to 12.4.1 (including all @pnpm/exe.* platform packages).

^{Reviewed by Cursor Bugbot for commit 9caa7dc. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​vscode@​1.134.0 ⏵ 1.137.0			+1	+2
	yaml@​2.9.0 ⏵ 2.9.1	+1
	@​socketregistry/​packageurl-js@​1.5.2 ⏵ 1.5.3				+3
	impeccable@​3.6.0 ⏵ 3.6.1			+1
	typebox@​1.3.30 ⏵ 1.3.31			+1
	magic-string@​1.2.3 ⏵ 1.4.1			+1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​vscode@​1.134.0 ⏵ 1.137.0			+1	+2
	yaml@​2.9.0 ⏵ 2.9.1	+1			+6
	@​socketregistry/​packageurl-js@​1.5.2 ⏵ 1.5.3
	magic-string@​1.2.3 ⏵ 1.4.1			+1
	impeccable@​3.6.0 ⏵ 3.6.1	+1		+1	+1
	typebox@​1.3.30 ⏵ 1.3.31	+1		+1

View full report