From fc1208640eba5abe49cc1380d424f9c1a56608d8 Mon Sep 17 00:00:00 2001 From: wenytang-ms Date: Wed, 29 Jul 2026 10:20:51 +0800 Subject: [PATCH 1/2] build: hold dependencies back to versions the CFS feed can serve CI restores packages from the Central Feed Service, which withholds upstream npm versions until they are roughly a week old, answering 404 for both the packument entry and the tarball. The nightly build broke because the lockfile referenced versions that were still inside that window. Roll webpack, postcss and sass (devDependencies) and fs-extra (a runtime dependency) back to the newest releases the feed can currently serve. All 311 locked versions were verified against the feed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ac225268-483d-4498-a08f-fe79a87d4d2e --- package-lock.json | 65 ++++++++++++++++++++++++++++++++++------------- package.json | 8 +++--- 2 files changed, 51 insertions(+), 22 deletions(-) diff --git a/package-lock.json b/package-lock.json index dac464fd..5fdc82b8 100644 --- a/package-lock.json +++ b/package-lock.json @@ -18,7 +18,7 @@ "compare-versions": "^6.1.1", "expand-home-dir": "0.0.3", "expand-tilde": "^2.0.2", - "fs-extra": "^11.4.0", + "fs-extra": "^11.3.6", "hdr-histogram-js": "^3.0.1", "highlight.js": "11.11.1", "jdk-utils": "^0.7.0", @@ -48,16 +48,16 @@ "bytes": "^3.1.2", "css-loader": "^7.1.2", "file-loader": "^6.2.0", - "postcss": "^8.5.24", + "postcss": "^8.5.21", "postcss-loader": "^8.2.0", "process": "0.11.10", - "sass": "^1.102.0", + "sass": "^1.101.3", "sass-loader": "^17.0.0", "style-loader": "^3.3.1", "ts-loader": "^9.6.2", "tslint": "^6.1.3", "typescript": "^5.9.3", - "webpack": "^5.109.1", + "webpack": "^5.108.4", "webpack-cli": "^7.2.1" }, "engines": { @@ -1037,6 +1037,19 @@ "node": ">=0.4.0" } }, + "node_modules/acorn-import-phases": { + "version": "1.0.4", + "resolved": "https://registry.npmjs.org/acorn-import-phases/-/acorn-import-phases-1.0.4.tgz", + "integrity": "sha512-wKmbr/DDiIXzEOiWrTTUcDm24kQ2vGfZQvM2fwg2vXqR5uW6aapr7ObPtj1th32b9u90/Pf4AItvdTh42fBmVQ==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=10.13.0" + }, + "peerDependencies": { + "acorn": "^8.14.0" + } + }, "node_modules/agent-base": { "version": "6.0.2", "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz", @@ -2012,9 +2025,9 @@ } }, "node_modules/fs-extra": { - "version": "11.4.0", - "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.4.0.tgz", - "integrity": "sha512-EQsFzMUJkCKGr1ePqlYADkIUmHW1s3ZXr5Yqy6wbGrfUCphpl2maM/kyOIRA2HpP3AaFQTZXD4ldjek+nccddA==", + "version": "11.3.6", + "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.6.tgz", + "integrity": "sha512-w8ZNZr2mKIc7qeNaQ9AVPT1+iFaI+Avd4xudVOvdDJ8VytREi1Ft5Ih7hd9jjehod8vAM5GMsfQ/TpPf4EyoEA==", "license": "MIT", "dependencies": { "graceful-fs": "^4.2.0", @@ -2562,6 +2575,20 @@ "@types/trusted-types": "^2.0.2" } }, + "node_modules/loader-runner": { + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/loader-runner/-/loader-runner-4.3.2.tgz", + "integrity": "sha512-DFEqQ3ihfS9blba08cLfYf1NRAIEm+dDjic073DRDc3/JspI/8wYmtDsHwd3+4hwvdxSK7PGaElfTmm0awWJ4w==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=6.11.5" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + } + }, "node_modules/loader-utils": { "version": "2.0.4", "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz", @@ -3004,9 +3031,9 @@ } }, "node_modules/postcss": { - "version": "8.5.24", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.24.tgz", - "integrity": "sha512-8RyVklq0owXUTa4xlpzu4l9AaVKIdQvAcOHZWaMh98HgySsUtxRVf/chRe3dsSLqb6i40BzGRzEUddRaI+9TSw==", + "version": "8.5.21", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.21.tgz", + "integrity": "sha512-v4sDNP3fdNiWMfabO7OwOQdOX8TiQSztKyT1Wj0w+j7LDallJThJRBBBmzVGyYj0crMh7jlV4zepPkiNu9UwDQ==", "dev": true, "funding": [ { @@ -3335,9 +3362,9 @@ } }, "node_modules/sass": { - "version": "1.102.0", - "resolved": "https://registry.npmjs.org/sass/-/sass-1.102.0.tgz", - "integrity": "sha512-NSOyTnaQF7rTAEOtI2fwb386vL+akyiQLBZu8Na7hXCb+umJy0GAqlcMIaqACZ6Z1VgTBS4K9PG6B3IdjHGJsw==", + "version": "1.101.3", + "resolved": "https://registry.npmjs.org/sass/-/sass-1.101.3.tgz", + "integrity": "sha512-Z1lLHhtAII+dyLNIQB6JQTZMy7sDxk3f5NzbINRc9ks1P0HCGvSuKev0wUhULFpLSaHBIMZrcTs9WDQUZerrgA==", "dev": true, "license": "MIT", "dependencies": { @@ -3893,9 +3920,9 @@ } }, "node_modules/webpack": { - "version": "5.109.1", - "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.109.1.tgz", - "integrity": "sha512-Q4XQscWSLNQSaMFsIWUZ+IVpvwLqD+MvjIuSQC1hG8m1ZMK78VAsNMhTjD3icJelypp6aM5Hq8BZNEX3sc1PJw==", + "version": "5.108.4", + "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.108.4.tgz", + "integrity": "sha512-yur8LyJoeiWh47dErD+Ok7vlbmDsJ3UbbRPAoxbGJ54WpE2y5yVo5G/inUzujnYgw3tPmBRdn+G7PoxXaYC33w==", "dev": true, "license": "MIT", "dependencies": { @@ -3905,20 +3932,22 @@ "@webassemblyjs/wasm-edit": "^1.14.1", "@webassemblyjs/wasm-parser": "^1.14.1", "acorn": "^8.16.0", + "acorn-import-phases": "^1.0.3", "browserslist": "^4.28.1", "chrome-trace-event": "^1.0.2", - "enhanced-resolve": "^5.24.2", + "enhanced-resolve": "^5.22.2", "es-module-lexer": "^2.1.0", "eslint-scope": "5.1.1", "events": "^3.2.0", "graceful-fs": "^4.2.11", + "loader-runner": "^4.3.2", "mime-db": "^1.54.0", "minimizer-webpack-plugin": "^5.6.1", "neo-async": "^2.6.2", "schema-utils": "^4.3.3", "tapable": "^2.3.0", "watchpack": "^2.5.2", - "webpack-sources": "^3.5.1" + "webpack-sources": "^3.5.0" }, "bin": { "webpack": "bin/webpack.js" diff --git a/package.json b/package.json index 9981b313..86a0d7f5 100644 --- a/package.json +++ b/package.json @@ -357,16 +357,16 @@ "bytes": "^3.1.2", "css-loader": "^7.1.2", "file-loader": "^6.2.0", - "postcss": "^8.5.24", + "postcss": "^8.5.21", "postcss-loader": "^8.2.0", "process": "0.11.10", - "sass": "^1.102.0", + "sass": "^1.101.3", "sass-loader": "^17.0.0", "style-loader": "^3.3.1", "ts-loader": "^9.6.2", "tslint": "^6.1.3", "typescript": "^5.9.3", - "webpack": "^5.109.1", + "webpack": "^5.108.4", "webpack-cli": "^7.2.1" }, "extensionPack": [ @@ -387,7 +387,7 @@ "compare-versions": "^6.1.1", "expand-home-dir": "0.0.3", "expand-tilde": "^2.0.2", - "fs-extra": "^11.4.0", + "fs-extra": "^11.3.6", "hdr-histogram-js": "^3.0.1", "highlight.js": "11.11.1", "jdk-utils": "^0.7.0", From 9d6565d28586c36be2c15dc03fbbc9a810f45b3b Mon Sep 17 00:00:00 2001 From: wenytang-ms Date: Wed, 29 Jul 2026 10:20:51 +0800 Subject: [PATCH 2/2] build: raise Dependabot cooldown to 10 days for CFS compatibility The Central Feed Service withholds upstream npm versions until they are roughly a week old. Measured against the vscjava feed, the newest servable version was 6.807 days old while the oldest withheld one was 6.738 days old, and withheld versions return 404 for both the packument entry and the tarball, so pinning an exact version does not help. A 7 day cooldown clears that threshold by only a few hours. Use 10 days so the setting keeps working if the feed's ingestion lag drifts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ac225268-483d-4498-a08f-fe79a87d4d2e --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b4179835..8cc8a033 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,3 +9,11 @@ updates: directory: "/" # Location of package manifests schedule: interval: "daily" + # CI restores packages from the Central Feed Service, which withholds + # upstream versions until they are roughly a week old (measured at ~6.8 + # days; both the packument entry and the tarball return 404 before then). + # Dependabot's built-in cooldown is only 3 days, so bumps otherwise land in + # a window where the feed 404s and the build fails. 10 days leaves margin + # in case the feed's ingestion lag drifts. + cooldown: + default-days: 10