[dependabot]

Bumps @vscode/vsce from 4.0.0 to 4.1.0.

Release notes

Sourced from @​vscode/vsce's releases.

v4.1.0

Changes:

• #1348: cli: Show OIDC publishing in help
• #1346: Set npm minimum release age and apply audit fixes
• #1345: publish: send X-Market-CI-Provider header with Marketplace requests
• #1342: chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 in the github-actions group
• #1335: chore(deps-dev): bump fast-uri from 3.1.6 to 3.1.8
• #1338: chore(deps): bump brace-expansion
• #1337: oidc: align token exchange with the Marketplace contract
• #1332: Update qs transitive dependency to 6.16.0

This list of changes was auto generated.

v4.0.1-6

Changes:

• #1348: cli: Show OIDC publishing in help

This list of changes was auto generated.

v4.0.1-5

Changes:

• #1346: Set npm minimum release age and apply audit fixes
• #1345: publish: send X-Market-CI-Provider header with Marketplace requests

This list of changes was auto generated.

v4.0.1-4

Changes:

• #1342: chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 in the github-actions group

This list of changes was auto generated.

v4.0.1-3

Changes:

• #1335: chore(deps-dev): bump fast-uri from 3.1.6 to 3.1.8

... (truncated)

Commits

• 33c66df Show OIDC publishing in help (#1348)
• cc5321a Set npm minimum release age and apply audit fixes (#1346)
• 402a12c Merge pull request #1345 from microsoft/benibenj/agents/ci-provider-header-lo...
• b84c665 Send CI provider header with Marketplace requests
• aeed595 chore(deps): bump actions/setup-node (#1342)
• 04811a9 chore(deps-dev): bump fast-uri from 3.1.6 to 3.1.8 (#1335)
• 19b4ca9 chore(deps): bump brace-expansion (#1338)
• 0765451 Merge pull request #1337 from microsoft/benibenj/agents/oidc-vsce-endpoint-up...
• c960f2e Update OIDC exchange to the final Marketplace contract
• c1eebf3 Update qs transitive dependency to 6.16.0 (#1332)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[Akanksha Jain (jainakanksha-msft)]

Copilot This PR was opened by Dependabot. Please take it the rest of the way before it's ready for human review:

1. Impact analysis — review the PR diff/description to identify what changed, including the package name and old → new version, then check where that dependency is actually used in the codebase, or whether it is unused, and summarize the potential impact.
2. Fix build/conflict issues — run npm ci --legacy-peer-deps, npm run build, and npm run lint; resolve any merge conflicts, build errors, or lint errors that surface.
3. Tests — add or update tests under tests/** to cover the changed usage, and make sure they meaningfully validate the change (not just re-assert the version bump).
4. Run the suite — run the relevant npm run test:* script(s) for the affected area (e.g. test:blob, test:queue, test:table) and keep fixing until they pass.
5. Changelog — Add a changelog entry only for changes that an Azurite user, operator, SDK developer, or extension user could reasonably observe. Exclude internal maintenance, testing, CI/CD, linting, and development dependency updates unless they result in a user-visible behaviour, compatibility, performance, or security improvement.
6. Comments — review any existing PR comments and review threads, including resolved/hidden ones, and address anything actionable.
7. Self-rate — rate this work 1-10 against: correctness, test coverage, changelog accuracy, build/lint health, and comment resolution.
8. Iterate — if it's not a 10, keep improving until it is before finishing.
9. Summary — your final response must use the following structure exactly (no free-form paragraph summary).

Impact analysis

• Package:
• Old version:
• New version:
• Change Impact:

Build/Conflict Issues

• Commands:
• Result:

Tests

• Added:
• Updated:
• Result:

Run the Suite

• Commands:
• Status:

Changelog

• Entry:
• Location:

Comments

• Reviewed:
• Actions:

Self-Rate

• Score:
• Reasoning:

Summary

• Why this matters:
• Risk of not taking change:

[Copilot]

Copilot This PR was opened by Dependabot. Please take it the rest of the way before it's ready for human review:

1. Impact analysis — review the PR diff/description to identify what changed, i...

Impact review confirms this is a lockfile-only dev-tool update: @vscode/vsce 4.0.0 → 4.1.0 is used by vscode:pack/vscode:publish and VSIX packaging tests, not the storage runtime. npm ci --legacy-peer-deps, npm run build, npm run lint, and local VSIX creation passed; npm run test:upgrade:vsix then stopped at the external VS Code download (update.code.visualstudio.com DNS ENOTFOUND). Existing PR Table and Queue jobs passed at the time checked; the validation matrix remains in progress. No product behavior changed, so no additional tests or changelog entry are warranted. No review threads were open.