Bump @vscode/vsce from 3.9.2 to 4.0.0

[dependabot]

Bumps @vscode/vsce from 3.9.2 to 4.0.0.

Release notes

Sourced from @​vscode/vsce's releases.

v4.0.0

Changes:

• #1329: Offer prompted migration of legacy PAT credentials
• #1325: Remove leven dependency
• #1324: Replace form-data with Node streams
• #1326: Fix MSAL declaration build failure
• #1323: Relock deps and mirror to package.json
• #1314: Replace chalk with Node styling
• #1312: Remove parse-semver dependency
• #1313: Reduce secretlint dependency tree
• #1315: chore(deps): bump the github-actions group with 2 updates
• #1306: Pin GitHub Actions to full-length commit SHAs

• #1309: Replace glob with tinyglobby
• #1308: Raise Node.js baseline to 22
• #1305: Update and replace many dependencies
• #1298: chore(deps): bump js-yaml from 4.2.0 to 4.3.1
• #1297: Hide OIDC option from publish help
• #1296: Remove redundant secretlint dependency
• #1295: chore(deps): bump fast-uri from 3.1.4 to 3.1.5
• #1294: chore(deps): bump brace-expansion
• #1293: chore(deps): bump fast-uri from 3.1.2 to 3.1.4
• #1292: chore(deps): bump linkify-it from 5.0.1 to 5.0.2
• #1291: auth: support OIDC trusted publishing
• #1289: chore(deps): bump js-yaml and @​textlint/linter-formatter
• #1288: chore(deps): bump form-data from 4.0.4 to 4.0.6
• #1287: chore(deps): bump markdown-it from 14.1.1 to 14.2.0
• #1284: chore(deps): bump tmp from 0.2.6 to 0.2.7

This list of changes was auto generated.

v3.9.3-12

Changes:

• #1329: Offer prompted migration of legacy PAT credentials
• #1325: Remove leven dependency
• #1324: Replace form-data with Node streams
• #1326: Fix MSAL declaration build failure
• #1323: Relock deps and mirror to package.json
• #1314: Replace chalk with Node styling
• #1312: Remove parse-semver dependency

This list of changes was auto generated.

... (truncated)

Commits

• 9f25124 Merge pull request #1329 from microsoft/benibenj/migrate-legacy-pat-storage
• 7d84e92 Offer prompted migration of legacy PAT credentials
• 75cae44 Merge pull request #1325 from jakebailey/remove-leven
• ae9f2b7 Merge pull request #1324 from jakebailey/remove-form-data
• fa08d59 Capture both output streams in the CLI tests
• 3fb79d8 Fix multipart stream lifecycle issues
• bee68cf Extract command suggestion helper and test it
• b40452e Merge pull request #1326 from microsoft/benibenj/agents/validate-package-lock...
• d2cd4d4 Keep PR CI workflow unchanged
• fa0fdf7 Fix MSAL declaration build failure
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Akanksha Jain (jainakanksha-msft)]

Copilot This PR was opened by Dependabot. Please take it the rest of the way before it's ready for human review:

1. Impact analysis — review the PR diff/description to identify what changed, including the package name and old → new version, then check where that dependency is actually used in the codebase, or whether it is unused, and summarize the potential impact.
2. Fix build/conflict issues — run npm ci --legacy-peer-deps, npm run build, and npm run lint; resolve any merge conflicts, build errors, or lint errors that surface.
3. Tests — add or update tests under tests/** to cover the changed usage, and make sure they meaningfully validate the change (not just re-assert the version bump).
4. Run the suite — run the relevant npm run test:* script(s) for the affected area (e.g. test:blob, test:queue, test:table) and keep fixing until they pass.
5. Changelog — Add a changelog entry only for changes that an Azurite user, operator, SDK developer, or extension user could reasonably observe. Exclude internal maintenance, testing, CI/CD, linting, and development dependency updates unless they result in a user-visible behaviour, compatibility, performance, or security improvement.
6. Comments — review any existing PR comments and review threads, including resolved/hidden ones, and address anything actionable.
7. Self-rate — rate this work 1-10 against: correctness, test coverage, changelog accuracy, build/lint health, and comment resolution.
8. Iterate — if it's not a 10, keep improving until it is before finishing.
9. Summary — your final response must use the following structure exactly (no free-form paragraph summary).

Impact analysis

• Package:
• Old version:
• New version:
• Change Impact:

Build/Conflict Issues

• Commands:
• Result:

Tests

• Added:
• Updated:
• Result:

Run the Suite

• Commands:
• Status:

Changelog

• Entry:
• Location:

Comments

• Reviewed:
• Actions:

Self-Rate

• Score:
• Reasoning:

Summary

• Why this matters:
• Risk of not taking change:

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved issues were identified, and the Node.js requirement matches the repository baseline.

Review effort: Lite
Findings: None

What changed in this PR

Updates the VS Code packaging tool @vscode/vsce from 3.9.2 to 4.0.0.

Changes:

• Bumps the VSCE development dependency.
• Refreshes the lockfile and transitive dependencies.

File	Description
package.json	Updates the VSCE development dependency.
package-lock.json	Locks VSCE 4.0.0 and its dependency tree.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot This PR was opened by Dependabot. Please take it the rest of the way before it's ready for human review:

1. Impact analysis — review the PR diff/description to identify what changed, i...

Done in e6e65ed — see the full breakdown below.

Impact analysis

• Package: @vscode/vsce
• Old version: 3.9.2
• New version: 4.0.0
• Change Impact: @vscode/vsce is a devDependency only, used to package/publish the VS Code extension (vscode:pack/vscode:publish scripts and tests/upgrade/vsixLifecycle/resolveVsixToTest.ts for VSIX lifecycle tests). It is not shipped in the Azurite runtime, so there is no impact on Blob/Queue/Table service behavior. vsce 4.0.0 dropped its transitive cheerio/markdown-it dependencies (replaced with marked/parse5), which orphaned the undici and markdown-it entries in the repo's overrides block.

Build/Conflict Issues

• Commands: npm ci --legacy-peer-deps, npm run build, npm run lint
• Result: No merge conflicts. Build and lint pass cleanly.

Tests

• Added: None (no new test needed; existing tests/packageScripts.test.ts already asserts every override resolves to a lockfile entry, which is the exact contract this bump broke)
• Updated: None
• Result: npm run test:package-scripts failed with "undici is overridden but does not resolve anywhere in package-lock.json" until the orphaned undici/markdown-it overrides were removed from package.json; now all 8 assertions pass.

Run the Suite

• Commands: npm run test:package-scripts; manually verified npx vsce package --out ... still produces a valid VSIX
• Status: All passing.

Changelog

• Entry: None added
• Location: N/A — dev-dependency/tooling-only change with no user-visible behavior, compatibility, performance, or security impact.

Comments

• Reviewed: The Copilot code review comment (approval, no findings) and this instruction comment.
• Actions: Fixed the orphaned overrides entries surfaced by test:package-scripts; ran build/lint/tests; verified vsce packaging still works; confirmed no changelog entry is warranted.

Self-Rate

• Score: 9
• Reasoning: Build/lint/tests all pass, the actual functional dependency (packaging via vsce) was manually verified to work, and the diff is minimal and scoped. Docked one point because the full VSIX lifecycle test suite (test:upgrade:vsix, which needs a VS Code driver/network access) wasn't run in this sandbox — only the underlying vsce package step was manually verified.

Summary

• Why this matters: Keeps the extension packaging toolchain current and removes dead override configuration that would otherwise silently mask future dependency issues.
• Risk of not taking change: Low — vsce is dev-only, but leaving stale overrides entries would leave test:package-scripts red and could hide real override drift in future dependency updates.

[Copilot]

Copilot review overview

🔵 Needs a closer look

This major packaging-tool upgrade was not locally tested and warrants human validation.

Review effort: Lite
Findings: None

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved issues were identified, and the dependency metadata is consistent.

Review effort: Lite
Findings: None