build: bump the deps-minor-update group across 1 directory with 8 updates

[dependabot]

Bumps the deps-minor-update group with 8 updates in the / directory:

Package	From	To
@vscode/extension-telemetry	1.5.1	1.5.2
adm-zip	0.5.16	0.5.17
applicationinsights	3.14.0	3.15.0
axios	1.13.6	1.16.1
compressing	2.1.0	2.1.1
jimp	1.6.0	1.6.1
lodash	4.17.23	4.18.1
sanitize-filename	1.6.3	1.6.4

Updates @vscode/extension-telemetry from 1.5.1 to 1.5.2

Release notes

Sourced from @​vscode/extension-telemetry's releases.

v1.5.2

Changes:

• #245: Update and explicitly list direct dependencies
• #243: npm update brace-expansion
• #242: Bump flatted from 3.4.1 to 3.4.2
• #241: chore: migrate to ESLint 9 with flat config
• #240: Bump minimatch from 3.1.2 to 3.1.5

This list of changes was auto generated.

Commits

• e33243f Merge pull request #245 from microsoft/updateAndAddExplicitDependencies
• 5c7de26 Update version.
• 2e31d47 Update and explicitly list all dependencies.
• 31e45f2 npm update brace-expansion (#243)
• 5d142e3 Bump flatted from 3.4.1 to 3.4.2 (#242)
• 7d1752f Merge pull request #241 from microsoft/copilot/migrate-to-eslint-9
• 8131abe chore: migrate to ESLint 9 with flat config
• 71d0bac Initial plan
• 9e42092 Merge pull request #240 from microsoft/dependabot/npm_and_yarn/minimatch-3.1.5
• 66b07a3 Bump minimatch from 3.1.2 to 3.1.5
• See full diff in compare view

Updates adm-zip from 0.5.16 to 0.5.17

Release notes

Sourced from adm-zip's releases.

v0.5.17

What's Changed

• entryHeader time setter more tolerant by @​thomasheritage in cthackers/adm-zip#540
• Add check for local desc flag in crc check by @​issacgerges in cthackers/adm-zip#543
• Create only if the directory does not exist by @​DennisHill in cthackers/adm-zip#557
• Fix issue with absolute paths by @​kwolfy in cthackers/adm-zip#559

New Contributors

• @​thomasheritage made their first contribution in cthackers/adm-zip#540
• @​issacgerges made their first contribution in cthackers/adm-zip#543
• @​DennisHill made their first contribution in cthackers/adm-zip#557
• @​kwolfy made their first contribution in cthackers/adm-zip#559

Full Changelog: cthackers/adm-zip@v0.5.16...v0.5.17

Commits

• 094d08c Incremented package version
• 23c5e1d Added readUInt64LE test
• 2818b03 Downgraded rimraf version to maintain node compatibility
• 7c77752 Fixed readUInt64LE
• 220f817 Updated vulnerable dependencies
• c8c20fd Merge pull request #559 from kwolfy/master
• 840bfdf Merge pull request #557 from DennisHill/DennisHill-patch-1
• fdf64a4 fix issue with absolute paths
• 6f0af5b Create only if the directory does not exist
• 1cd32f7 Merge pull request #543 from issacgerges/master
• Additional commits viewable in compare view

Updates applicationinsights from 3.14.0 to 3.15.0

Changelog

Sourced from applicationinsights's changelog.

3.15.0 (2026-05-13)

Breaking Changes

• Minimum supported Node.js version is now 20.0.0. Node.js 18 is end-of-life (April 2025) and the underlying @azure/monitor-opentelemetry / @azure/monitor-opentelemetry-exporter dependencies require Node >= 20.

Other Changes

• Updated @​azure/monitor-opentelemetry and @​azure/monitor-opentelemetry-exporter.
• Resolve vulnerabilities in dependencies.

Bug Fixes

• Fix memory leak caused by process event listener accumulation when useAzureMonitor() is called multiple times. (#1415)

Commits

• See full diff in compare view

Updates axios from 1.13.6 to 1.16.1

Release notes

Sourced from axios's releases.

v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

🔒 Security Fixes

• Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)
• Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)
• CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

🐛 Bug Fixes

• Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)
• Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)
• XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)
• Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)
• Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)
• URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

🔧 Maintenance & Chores

• Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)
• composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)
• AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)
• Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)
• Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)
• Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​hpinmetaverse (#10836)
• @​tommyhgunz14 (#7413)
• @​abhu85 (#10829)
• @​divyanshuraj1095 (#10853)
• @​sagodi97 (#10856)
• @​rkdfx (#10868)
• @​Liuwei1125 (#10866)

Full Changelog

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

🔒 Security Fixes

• Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)
• Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)
• CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

🐛 Bug Fixes

• Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)
• Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)
• XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)
• Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)
• Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)
• URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

🔧 Maintenance & Chores

• Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)
• composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)
• AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)
• Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)
• Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)
• Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​hpinmetaverse (#10836)
• @​tommyhgunz14 (#7413)
• @​abhu85 (#10829)
• @​divyanshuraj1095 (#10853)
• @​sagodi97 (#10856)
• @​rkdfx (#10868)
• @​Liuwei1125 (#10866)

Full Changelog

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

... (truncated)

Commits

• 1337d6b chore(release): prepare release 1.16.1 (#10877)
• 858a790 fix: remove all caches (#10882)
• 34adfd9 revert: "fix: support URL object as config.url input (#10866)" (#10874)
• 847d89b fix: support URL object as config.url input (#10866)
• 4094886 fix(progress): guard malformed XHR upload events (#10868)
• 44f0c5b chore: change sponsorship link and add Twicsy advertisement (#10869)
• 64e1095 chore: update PR and issue template to use h2 (#10865)
• 3e6b4e1 fix: error unexpected token in fetch JS compatibility issue with Webpack 4 (#...
• c4453ba fix: add the ability to add additional sponsors to the process sponsors scrip...
• caa00a9 fix: https data in cleartext to proxy (#10858)
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates compressing from 2.1.0 to 2.1.1

Release notes

Sourced from compressing's releases.

v2.1.1

2.1.1 (2026-04-13)

• fix: prevent symlink path traversal via pre-existing symlinks during tar extraction (9c885e5)
• chore: map npm package links to npmx.dev (#134) (fba303c), closes #134

---

This release is also available on:

• npm package (@​latest dist-tag)

Changelog

Sourced from compressing's changelog.

2.1.1 (2026-04-13)

• fix: prevent symlink path traversal via pre-existing symlinks during tar extraction (9c885e5)
• chore: map npm package links to npmx.dev (#134) (fba303c), closes #134

Commits

• 0a77278 Release 2.1.1
• 9c885e5 fix: prevent symlink path traversal via pre-existing symlinks during tar extr...
• fba303c chore: map npm package links to npmx.dev (#134)
• See full diff in compare view

Updates jimp from 1.6.0 to 1.6.1

Release notes

Sourced from jimp's releases.

v1.6.1

🎉 This release contains work from new contributors! 🎉

Thanks for all your work!

❤️ Denys Kashkovskyi (@​Kashkovsky)

❤️ Viki (@​vikiboss)

🐛 Bug Fix

• fix docs imports (@​hipstersmoothie)
• @jimp/core, @jimp/plugin-quantize, @jimp/wasm-avif, @jimp/wasm-jpeg, @jimp/wasm-png, @jimp/wasm-webp
  • Update file-type from ^16 to ^21.3.3 in @​jimp/core #1400 (@​Kashkovsky @​hipstersmoothie)

⚠️ Pushed to main

• @jimp/core
  • Doc updates (closes #1342) (@​hipstersmoothie)

📝 Documentation

• docs: correct GitHub repo link #1340 (@​vikiboss)

Authors: 3

• Andrew Lisowski (@​hipstersmoothie)
• Denys Kashkovskyi (@​Kashkovsky)
• Viki (@​vikiboss)

Changelog

Sourced from jimp's changelog.

v1.6.1 (Tue Apr 07 2026)

🎉 This release contains work from new contributors! 🎉

Thanks for all your work!

❤️ Denys Kashkovskyi (@​Kashkovsky)

❤️ Viki (@​vikiboss)

🐛 Bug Fix

• fix docs imports (@​hipstersmoothie)
• @jimp/core, @jimp/plugin-quantize, @jimp/wasm-avif, @jimp/wasm-jpeg, @jimp/wasm-png, @jimp/wasm-webp
  • Update file-type from ^16 to ^21.3.3 in @​jimp/core #1400 (@​Kashkovsky @​hipstersmoothie)

⚠️ Pushed to main

• @jimp/core
  • Doc updates (closes #1342) (@​hipstersmoothie)

📝 Documentation

• docs: correct GitHub repo link #1340 (@​vikiboss)

Authors: 3

• Andrew Lisowski (@​hipstersmoothie)
• Denys Kashkovskyi (@​Kashkovsky)
• Viki (@​vikiboss)

---

v1.5.0 (Mon Sep 09 2024)

Release Notes

Add support for image decoder options (#1336)

Can now have options for the underlying image codecs

---

🚀 Enhancement

• @jimp/core, @jimp/types, @jimp/js-bmp, @jimp/js-jpeg, @jimp/js-png
  • Add support for image decoder options #1336 (@​hipstersmoothie)

... (truncated)

Commits

• 7e6a956 Bump version to: v1.6.1 [skip ci]
• cf9ed93 Update contributors [skip ci]
• 7851672 Update CHANGELOG.md [skip ci]
• e1bfa93 Update file-type from ^16 to ^21.3.3 in @​jimp/core (#1400)
• b6b0e41 fix docs imports
• c943994 docs: correct GitHub repo link (#1340)
• f3e6b9e Doc updates (closes #1342)
• See full diff in compare view

Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates sanitize-filename from 1.6.3 to 1.6.4

Commits

• 6e51552 1.6.4
• 9848644 Do not use vulnerable regex
• 209c39b Bump brace-expansion from 1.1.6 to 1.1.11 (#54)
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
applicationinsights	[>= 3.6.a, < 3.7]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[github-actions]

	Messages
✅	Your PR title & description are valid

_{Generated 2. 6. 2026 1:41:01 GMT+2 for 408e1a9}