Update semver to fix security vulnerability

Update semver Update @vscode/vsce Regenerate yarn.lock
eclipse · Mar 21, 2024 · d034222 · d034222
1 parent 10d1a23
commit d034222
Show file tree

Hide file tree

Showing 4 changed files with 561 additions and 565 deletions.
diff --git a/cli/CHANGELOG.md b/cli/CHANGELOG.md
@@ -2,6 +2,19 @@
 
 This change log covers only the command line interface (CLI) of Open VSX.
 
+### v0.9.0 (Next)
+
+#### Breaking Changes
+
+- The minimum version of Node.js required is now `18` because of the newer `@vscode/vsce`
+
+#### Dependencies
+
+- Upgrade `@vscode/vsce` from `2.19.0` to `2.24.0` ([#878](https://github.com/eclipse/openvsx/pull/878))
+- Upgrade `semver` from `7.5.2` to `7.6.0` ([#878](https://github.com/eclipse/openvsx/pull/878))
+
+---
+
 ### v0.8.4 (Mar. 2023)
 
 #### Dependencies

diff --git a/cli/package.json b/cli/package.json
@@ -1,6 +1,6 @@
 {
     "name": "ovsx",
-    "version": "0.8.4",
+    "version": "0.9.0",
     "description": "Command line interface for Eclipse Open VSX",
     "keywords": [
         "cli",
@@ -31,22 +31,22 @@
     "types": "lib/index",
     "bin": "lib/ovsx",
     "engines": {
-        "node": ">= 14"
+        "node": ">= 18"
     },
     "dependencies": {
-        "@vscode/vsce": "^2.19.0",
+        "@vscode/vsce": "^2.24.0",
         "commander": "^6.1.0",
         "follow-redirects": "^1.14.6",
         "is-ci": "^2.0.0",
         "leven": "^3.1.0",
-        "semver": "^7.5.2",
+        "semver": "^7.6.0",
         "tmp": "^0.2.1"
     },
     "devDependencies": {
         "@types/follow-redirects": "^1.13.1",
         "@types/is-ci": "^2.0.0",
         "@types/node": "^10.17.60",
-        "@types/semver": "^7.3.9",
+        "@types/semver": "^7.5.8",
         "@types/tmp": "^0.1.0",
         "@typescript-eslint/eslint-plugin": "^5.44.0",
         "@typescript-eslint/parser": "^5.44.0",

diff --git a/cli/src/ovsx b/cli/src/ovsx
@@ -2,8 +2,8 @@
 
 const semver = require('semver');
 
-if (semver.lt(process.versions.node, '14.0.0')) {
-    console.error('ovsx requires at least NodeJS version 14. Check your installed version with `node --version`.');
+if (semver.lt(process.versions.node, '18.0.0')) {
+    console.error('ovsx requires at least NodeJS version 18. Check your installed version with `node --version`.');
     process.exit(1);
 }