@vscode/vsce 3.9.3-5 → 3.9.3-6

package/README.md

@@ -15,14 +15,7 @@ Read the [**Documentation**](https://code.visualstudio.com/api/working-with-exte
 
 ### Linux
 
-In order to save credentials safely, this project uses [`keytar`](https://www.npmjs.com/package/keytar) which uses `libsecret`, which you may need to install before publishing extensions. Setting the `VSCE_STORE=file` environment variable will revert back to the file credential store. Using the `VSCE_PAT` environment variable will also avoid using `keytar`.
-
-Depending on your distribution, you will need to run the following command:
-
-- Debian/Ubuntu: `sudo apt-get install libsecret-1-dev`
-- Alpine: `apk add libsecret`
-- Red Hat-based: `sudo yum install libsecret-devel`
-- Arch Linux: `sudo pacman -S libsecret`
+In order to save credentials safely, this project uses [`@napi-rs/keyring`](https://www.npmjs.com/package/@napi-rs/keyring), which uses the system Secret Service and falls back to the Linux kernel keyring. Setting the `VSCE_STORE=file` environment variable will revert back to the file credential store. Using the `VSCE_PAT` environment variable will also avoid using the system credential store.
 
 ## Usage
 

package/out/package.js

@@ -67,8 +67,8 @@ const nls_1 = require("./nls");
 const util = __importStar(require("./util"));
 const glob_1 = require("glob");
 const minimatch_1 = require("minimatch");
-const markdown_it_1 = __importDefault(require("markdown-it"));
-const cheerio = __importStar(require("cheerio"));
+const parse5_1 = require("parse5");
+const marked_1 = require("marked");
 const url = __importStar(require("url"));
 const mime_1 = __importDefault(require("mime"));
 const semver = __importStar(require("semver"));
@@ -627,11 +627,33 @@ class MarkdownProcessor extends BaseProcessor {
                 contents = contents.replace(markdownIssueRegex, issueReplace);
             }
         }
-        const html = (0, markdown_it_1.default)({ html: true }).render(contents);
-        const $ = cheerio.load(html);
+        const html = marked_1.marked.parse(contents, { async: false });
+        const document = (0, parse5_1.parse)(html);
+        const images = [];
+        let hasSvg = false;
+        const nodes = [document];
+        while (nodes.length > 0) {
+            const node = nodes.pop();
+            if ('tagName' in node) {
+                if (node.tagName === 'img') {
+                    images.push(node);
+                }
+                else if (node.tagName === 'svg') {
+                    hasSvg = true;
+                }
+            }
+            const children = 'content' in node
+                ? node.content.childNodes
+                : 'childNodes' in node
+                    ? node.childNodes
+                    : [];
+            for (let index = children.length - 1; index >= 0; index--) {
+                nodes.push(children[index]);
+            }
+        }
         if (this.rewriteRelativeLinks) {
-            $('img').each((_, img) => {
-                const rawSrc = $(img).attr('src');
+            for (const image of images) {
+                const rawSrc = image.attrs.find(attribute => attribute.name === 'src')?.value;
                 if (!rawSrc) {
                     throw new Error(`Images in ${this.name} must have a source.`);
                 }
@@ -652,11 +674,11 @@ class MarkdownProcessor extends BaseProcessor {
                 if (/\.svg$/i.test(srcUrl.pathname) && !isHostTrusted(srcUrl)) {
                     throw new Error(`SVGs are restricted in ${this.name}; please use other file image formats, such as PNG: ${src}`);
                 }
-            });
+            }
         }
-        $('svg').each(() => {
+        if (hasSvg) {
             throw new Error(`SVG tags are not allowed in ${this.name}.`);
-        });
+        }
         return {
             path: file.path,
             contents: Buffer.from(contents, 'utf8'),

package/out/publish.js

@@ -40,21 +40,28 @@ exports.publish = publish;
 exports.unpublish = unpublish;
 exports.getPAT = getPAT;
 const fs = __importStar(require("fs"));
-const util_1 = require("util");
 const semver = __importStar(require("semver"));
 const GalleryInterfaces_1 = require("azure-devops-node-api/interfaces/GalleryInterfaces");
 const package_1 = require("./package");
-const tmp = __importStar(require("tmp"));
 const store_1 = require("./store");
-const util_2 = require("./util");
+const util_1 = require("./util");
 const zip_1 = require("./zip");
 const validation_1 = require("./validation");
 const form_data_1 = __importDefault(require("form-data"));
 const path_1 = require("path");
+const os_1 = require("os");
 const cockatiel_1 = require("cockatiel");
 const auth_1 = require("./auth");
 const oidc_1 = require("./oidc");
-const tmpName = (0, util_1.promisify)(tmp.tmpName);
+async function withTemporaryPackage(fn) {
+    const directory = await fs.promises.mkdtemp((0, path_1.join)((0, os_1.tmpdir)(), 'vsce-'));
+    try {
+        return await fn((0, path_1.join)(directory, 'extension.vsix'));
+    }
+    finally {
+        await fs.promises.rm(directory, { recursive: true, force: true });
+    }
+}
 async function publish(options = {}) {
     validateAuthenticationOptions(options);
     if (options.packagePath) {
@@ -108,38 +115,40 @@ async function publish(options = {}) {
     else {
         const cwd = options.cwd || process.cwd();
         const manifest = await (0, package_1.readManifest)(cwd);
-        (0, util_2.patchOptionsWithManifest)(options, manifest);
+        (0, util_1.patchOptionsWithManifest)(options, manifest);
         // Validate marketplace requirements before prepublish to avoid unnecessary work
         validateManifestForPublishing(manifest, options);
         await (0, package_1.prepublish)(cwd, manifest, options.useYarn);
         await (0, package_1.versionBump)(options);
         if (options.targets) {
             for (const target of options.targets) {
-                const packagePath = await tmpName();
-                const packageResult = await (0, package_1.pack)({ ...options, target, packagePath });
-                const manifestValidated = validateManifestForPublishing(packageResult.manifest, options);
-                const sigzipPath = options.signTool ? await (0, package_1.signPackage)(packagePath, options.signTool) : undefined;
-                await _publish(packagePath, sigzipPath, manifestValidated, { ...options, target });
+                await withTemporaryPackage(async (packagePath) => {
+                    const packageResult = await (0, package_1.pack)({ ...options, target, packagePath });
+                    const manifestValidated = validateManifestForPublishing(packageResult.manifest, options);
+                    const sigzipPath = options.signTool ? await (0, package_1.signPackage)(packagePath, options.signTool) : undefined;
+                    await _publish(packagePath, sigzipPath, manifestValidated, { ...options, target });
+                });
             }
         }
         else {
-            const packagePath = await tmpName();
-            const packageResult = await (0, package_1.pack)({ ...options, packagePath });
-            const manifestValidated = validateManifestForPublishing(packageResult.manifest, options);
-            const sigzipPath = options.signTool ? await (0, package_1.signPackage)(packagePath, options.signTool) : undefined;
-            await _publish(packagePath, sigzipPath, manifestValidated, options);
+            await withTemporaryPackage(async (packagePath) => {
+                const packageResult = await (0, package_1.pack)({ ...options, packagePath });
+                const manifestValidated = validateManifestForPublishing(packageResult.manifest, options);
+                const sigzipPath = options.signTool ? await (0, package_1.signPackage)(packagePath, options.signTool) : undefined;
+                await _publish(packagePath, sigzipPath, manifestValidated, options);
+            });
         }
     }
 }
 async function _publish(packagePath, sigzipPath, manifest, options) {
     const pat = await getPAT(manifest.publisher, options);
-    const api = await (0, util_2.getGalleryAPI)(pat);
+    const api = await (0, util_1.getGalleryAPI)(pat);
     const packageStream = fs.createReadStream(packagePath);
     const name = `${manifest.publisher}.${manifest.name}`;
     const description = options.target
         ? `${name} (${options.target}) v${manifest.version}`
         : `${name} v${manifest.version}`;
-    util_2.log.info(`Publishing '${description}'...`);
+    util_1.log.info(`Publishing '${description}'...`);
     let extension = null;
     try {
         try {
@@ -155,7 +164,7 @@ async function _publish(packagePath, sigzipPath, manifest, options) {
                 (v.targetPlatform === options.target));
             if (versionExists) {
                 if (options.skipDuplicate) {
-                    util_2.log.done(`Version ${manifest.version} is already published. Skipping publish.`);
+                    util_1.log.done(`Version ${manifest.version} is already published. Skipping publish.`);
                     return;
                 }
                 else {
@@ -172,7 +181,7 @@ async function _publish(packagePath, sigzipPath, manifest, options) {
                 catch (err) {
                     if (err.statusCode === 409) {
                         if (options.skipDuplicate) {
-                            util_2.log.done(`Version ${manifest.version} is already published. Skipping publish.`);
+                            util_1.log.done(`Version ${manifest.version} is already published. Skipping publish.`);
                             return;
                         }
                         else {
@@ -204,9 +213,9 @@ async function _publish(packagePath, sigzipPath, manifest, options) {
         }
         throw err;
     }
-    util_2.log.info(`Extension URL (might take a few minutes): ${(0, util_2.getPublishedUrl)(name)}`);
-    util_2.log.info(`Hub URL: ${(0, util_2.getHubUrl)(manifest.publisher, manifest.name)}`);
-    util_2.log.done(`Published ${description}.`);
+    util_1.log.info(`Extension URL (might take a few minutes): ${(0, util_1.getPublishedUrl)(name)}`);
+    util_1.log.info(`Hub URL: ${(0, util_1.getHubUrl)(manifest.publisher, manifest.name)}`);
+    util_1.log.done(`Published ${description}.`);
 }
 async function _publishSignedPackage(api, packageName, packageStream, sigzipName, sigzipStream, manifest) {
     const extensionType = 'Visual Studio Code';
@@ -239,15 +248,15 @@ async function unpublish(options = {}) {
     }
     const fullName = `${publisher}.${name}`;
     if (!options.force) {
-        const answer = await (0, util_2.read)(`This will delete ALL published versions! Please type '${fullName}' to confirm: `);
+        const answer = await (0, util_1.read)(`This will delete ALL published versions! Please type '${fullName}' to confirm: `);
         if (answer !== fullName) {
             throw new Error('Aborted');
         }
     }
     const pat = await getPAT(publisher, options);
-    const api = await (0, util_2.getGalleryAPI)(pat);
+    const api = await (0, util_1.getGalleryAPI)(pat);
     await api.deleteExtension(publisher, name);
-    util_2.log.done(`Deleted extension: ${fullName}!`);
+    util_1.log.done(`Deleted extension: ${fullName}!`);
 }
 function validateManifestForPublishing(manifest, options) {
     if (manifest.enableProposedApi && !options.allowAllProposedApis && !options.noVerify) {

package/out/secretLint.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -8,7 +41,8 @@ exports.lintText = lintText;
 exports.getRuleNameFromRuleId = getRuleNameFromRuleId;
 exports.prettyPrintLintResult = prettyPrintLintResult;
 const chalk_1 = __importDefault(require("chalk"));
-const secret_lint_types_1 = require("./typings/secret-lint-types");
+const path = __importStar(require("path"));
+const url_1 = require("url");
 const util_1 = require("./util");
 const secretsScanningRules = [
     {
@@ -45,11 +79,8 @@ const dotEnvRules = [
         id: "@secretlint/secretlint-rule-no-dotenv"
     }
 ];
-// Helper function to dynamically import the createEngine function
 async function getEngine(scanSecrets, scanDotEnv) {
-    // Use a raw dynamic import that will not be transformed
-    // This is necessary because @secretlint/node is an ESM module
-    const secretlintModule = await eval('import("@secretlint/node")');
+    const { createEngine } = require("@secretlint/node");
     const rules = [];
     if (scanSecrets) {
         rules.push(...secretsScanningRules);
@@ -59,11 +90,11 @@ async function getEngine(scanSecrets, scanDotEnv) {
     }
     const lintOptions = {
         configFileJSON: { rules: rules },
-        formatter: "@secretlint/secretlint-formatter-sarif", // checkstyle, compact, jslint-xml, junit, pretty-error, stylish, tap, unix, json, mask-result, table
+        formatter: "json",
         color: true,
         maskSecrets: false
     };
-    const engine = await secretlintModule.createEngine(lintOptions);
+    const engine = await createEngine(lintOptions);
     return engine;
 }
 async function lintFiles(filePaths, scanSecrets, scanDotEnv) {
@@ -96,49 +127,78 @@ async function lintText(content, fileName, scanSecrets, scanDotEnv) {
     return parseResult(engineResult);
 }
 function parseResult(result) {
-    const output = secret_lint_types_1.Convert.toSecretLintOutput(result.output);
-    const results = output.runs.at(0)?.results ?? [];
+    const output = JSON.parse(result.output);
+    if (!Array.isArray(output) || !output.every(isSecretLintFileResult)) {
+        throw new Error("Unexpected output from secretlint");
+    }
+    const results = output.flatMap(fileResult => fileResult.messages.map((message) => ({
+        message: message.message,
+        ruleId: message.ruleParentId ? `${message.ruleParentId} > ${message.ruleId}` : message.ruleId,
+        level: message.severity === "info" ? "note" : message.severity,
+        filePath: process.env.SARIF_URI_ABSOLUTE
+            ? (0, url_1.pathToFileURL)(fileResult.filePath).toString()
+            : path.relative(process.cwd(), fileResult.filePath),
+        startLine: fixLine(message.loc.start.line),
+        startColumn: fixColumn(message.loc.start.column),
+        endLine: fixLine(message.loc.end.line),
+        endColumn: fixColumn(message.loc.end.column)
+    })));
     return { ok: result.ok, results };
 }
+function isSecretLintFileResult(value) {
+    return isRecord(value)
+        && typeof value.filePath === "string"
+        && Array.isArray(value.messages)
+        && value.messages.every(isSecretLintMessage);
+}
+function isSecretLintMessage(value) {
+    return isRecord(value)
+        && typeof value.message === "string"
+        && typeof value.ruleId === "string"
+        && (value.ruleParentId === undefined || typeof value.ruleParentId === "string")
+        && isRecord(value.loc)
+        && isSecretLintPosition(value.loc.start)
+        && isSecretLintPosition(value.loc.end)
+        && (value.severity === "error" || value.severity === "warning" || value.severity === "info");
+}
+function isSecretLintPosition(value) {
+    return isRecord(value)
+        && (value.line === null || typeof value.line === "number")
+        && (value.column === null || typeof value.column === "number");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function fixLine(value) {
+    return value === null ? undefined : value === 0 ? 1 : value;
+}
+function fixColumn(value) {
+    return value === null ? undefined : value === 0 ? 1 : value + 1;
+}
 function getRuleNameFromRuleId(ruleId) {
     const parts = ruleId.split('-rule-');
     return parts[parts.length - 1];
 }
 function prettyPrintLintResult(result) {
-    if (!result.message.text) {
-        return JSON.stringify(result);
-    }
-    const text = result.message.text;
-    const titleColor = result.level === undefined || result.level === secret_lint_types_1.Level.Error ? chalk_1.default.bold.red : chalk_1.default.bold.yellow;
+    const text = result.message;
+    const titleColor = result.level === "error" ? chalk_1.default.bold.red : chalk_1.default.bold.yellow;
     const title = text.length > 54 ? text.slice(0, 50) + '...' : text;
-    const ruleName = result.ruleId ? getRuleNameFromRuleId(result.ruleId) : 'unknown';
+    const ruleName = getRuleNameFromRuleId(result.ruleId);
     let output = `\t${titleColor(title)} [${ruleName}]\n`;
-    if (result.locations) {
-        result.locations.forEach(location => {
-            output += `\t${prettyPrintLocation(location)}\n`;
-        });
-    }
+    output += `\t${prettyPrintLocation(result)}\n`;
     return output;
 }
-function prettyPrintLocation(location) {
-    if (!location.physicalLocation) {
-        return JSON.stringify(location);
-    }
-    const uri = location.physicalLocation.artifactLocation?.uri;
-    if (!uri) {
-        return JSON.stringify(location);
-    }
-    let output = uri;
-    const region = location.physicalLocation.region;
-    const regionStringified = region ? prettyPrintRegion(region) : undefined;
+function prettyPrintLocation(result) {
+    let output = result.filePath;
+    const regionStringified = prettyPrintRegion(result);
     if (regionStringified) {
         output += `#${regionStringified}`;
     }
     return output;
 }
-function prettyPrintRegion(region) {
-    const startPosition = prettyPrintPosition(region.startLine, region.startColumn);
-    const endPosition = prettyPrintPosition(region.endLine, region.endColumn);
+function prettyPrintRegion(result) {
+    const startPosition = prettyPrintPosition(result.startLine, result.startColumn);
+    const endPosition = prettyPrintPosition(result.endLine, result.endColumn);
     if (!startPosition) {
         return undefined;
     }

package/out/store.js

@@ -101,7 +101,7 @@ exports.FileStore = FileStore;
 FileStore.DefaultPath = path.join((0, os_1.homedir)(), '.vsce');
 class KeytarStore {
     static async open(serviceName = 'vscode-vsce') {
-        const keytar = await import('keytar').then(module => module.default);
+        const keytar = require('@napi-rs/keyring/keytar.js');
         const creds = await keytar.findCredentials(serviceName);
         return new KeytarStore(keytar, serviceName, creds.map(({ account, password }) => ({ name: account, pat: password })));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vscode/vsce",
-	"version": "3.9.3-5",
+	"version": "3.9.3-6",
 	"description": "VS Code Extensions Manager",
 	"repository": {
 		"type": "git",
@@ -36,18 +36,17 @@
 		"watch:test": "npm run test -- --watch"
 	},
 	"engines": {
-		"node": ">= 20"
+		"node": ">= 20.19"
 	},
 	"dependencies": {
 		"@azure/identity": "^4.1.0",
+		"@napi-rs/keyring": "^1.3.0",
 		"@secretlint/node": "^10.1.2",
-		"@secretlint/secretlint-formatter-sarif": "^10.1.2",
 		"@secretlint/secretlint-rule-no-dotenv": "^10.1.2",
 		"@secretlint/secretlint-rule-preset-recommend": "^10.1.2",
 		"@vscode/vsce-sign": "^2.0.0",
 		"azure-devops-node-api": "^12.5.0",
 		"chalk": "^4.1.2",
-		"cheerio": "^1.0.0-rc.9",
 		"cockatiel": "^3.1.2",
 		"commander": "^12.1.0",
 		"form-data": "^4.0.0",
@@ -55,13 +54,13 @@
 		"hosted-git-info": "^4.0.2",
 		"jsonc-parser": "^3.2.0",
 		"leven": "^3.1.0",
-		"markdown-it": "^14.1.0",
+		"marked": "^18.0.10",
 		"mime": "^1.3.4",
 		"minimatch": "^10.2.2",
 		"parse-semver": "^1.1.1",
+		"parse5": "^8.0.1",
 		"read": "^1.0.7",
 		"semver": "^7.5.2",
-		"tmp": "^0.2.3",
 		"typed-rest-client": "^1.8.4",
 		"url-join": "^4.0.1",
 		"xml2js": "^0.5.0",
@@ -70,28 +69,20 @@
 	},
 	"devDependencies": {
 		"@microsoft/api-extractor": "^7.33.7",
-		"@types/cheerio": "^0.22.29",
-		"@types/glob": "^8.1.0",
 		"@types/hosted-git-info": "^3.0.2",
-		"@types/markdown-it": "^0.0.2",
 		"@types/mime": "^1",
 		"@types/mocha": "^7.0.2",
 		"@types/node": "^20.0.0",
 		"@types/read": "^0.0.28",
 		"@types/semver": "^6.0.0",
-		"@types/tmp": "^0.2.2",
 		"@types/url-join": "^4.0.1",
 		"@types/xml2js": "^0.4.4",
 		"@types/yauzl": "^2.9.2",
 		"@types/yazl": "^2.4.2",
 		"mocha": "^11.1.0",
-		"source-map-support": "^0.4.2",
 		"ts-node": "^10.9.1",
 		"typescript": "~5.9.0"
 	},
-	"optionalDependencies": {
-		"keytar": "^7.7.0"
-	},
 	"mocha": {
 		"require": [
 			"ts-node/register"