From 2d5e77cb3d0e8dfd57b5bd4ad3f5177322a04ade Mon Sep 17 00:00:00 2001
From: Sean McManus <seanmcm@microsoft.com>
Date: Mon, 3 Aug 2026 09:02:42 -0700
Subject: [PATCH 01/12] Update IntelliSense loc strings for PR 757614. (#14607)

* Update IntelliSense loc strings for PR 757614.
---
 Extension/bin/messages/cs/messages.json    | 3 ++-
 Extension/bin/messages/de/messages.json    | 3 ++-
 Extension/bin/messages/es/messages.json    | 3 ++-
 Extension/bin/messages/fr/messages.json    | 3 ++-
 Extension/bin/messages/it/messages.json    | 3 ++-
 Extension/bin/messages/ja/messages.json    | 3 ++-
 Extension/bin/messages/ko/messages.json    | 3 ++-
 Extension/bin/messages/pl/messages.json    | 3 ++-
 Extension/bin/messages/pt-br/messages.json | 3 ++-
 Extension/bin/messages/ru/messages.json    | 3 ++-
 Extension/bin/messages/tr/messages.json    | 3 ++-
 Extension/bin/messages/zh-cn/messages.json | 3 ++-
 Extension/bin/messages/zh-tw/messages.json | 3 ++-
 13 files changed, 26 insertions(+), 13 deletions(-)

diff --git a/Extension/bin/messages/cs/messages.json b/Extension/bin/messages/cs/messages.json
index 702a811b6..b11cca8d3 100644
--- a/Extension/bin/messages/cs/messages.json
+++ b/Extension/bin/messages/cs/messages.json
@@ -3747,5 +3747,6 @@
     "„static“ je zde nestandardní",
     "%nd byl dříve deklarován bez explicitního základu výčtu",
     "Chybějící typename je tady nestandardní.",
-    "Zkrácená syntaxe šablony funkce není standardní pro vodítka dedukce"
+    "Zkrácená syntaxe šablony funkce není standardní pro vodítka dedukce",
+    "too many nested user-defined conversions (possible cycle of converting routines)"
 ]
diff --git a/Extension/bin/messages/de/messages.json b/Extension/bin/messages/de/messages.json
index 66c00b194..0a223a4dd 100644
--- a/Extension/bin/messages/de/messages.json
+++ b/Extension/bin/messages/de/messages.json
@@ -3747,5 +3747,6 @@
     "„static“ entspricht hier nicht dem Standard",
     "%nd wurde zuvor ohne explizite Enumerationsbasis deklariert",
     "Fehlender „typename“ entspricht hier nicht dem Standard.",
-    "Die abgekürzte Funktionsvorlagensyntax entspricht nicht dem Standard für Deduktionsleitfäden."
+    "Die abgekürzte Funktionsvorlagensyntax entspricht nicht dem Standard für Deduktionsleitfäden.",
+    "too many nested user-defined conversions (possible cycle of converting routines)"
 ]
diff --git a/Extension/bin/messages/es/messages.json b/Extension/bin/messages/es/messages.json
index 6351f2902..27dc71056 100644
--- a/Extension/bin/messages/es/messages.json
+++ b/Extension/bin/messages/es/messages.json
@@ -3747,5 +3747,6 @@
     "\"static\" no es estándar aquí",
     "%nd se declaró previamente sin una base explícita de enumeración",
     "falta 'typename' no estándar aquí",
-    "La sintaxis abreviada de las plantillas de funciones no es estándar para las guías de deducción"
+    "La sintaxis abreviada de las plantillas de funciones no es estándar para las guías de deducción",
+    "too many nested user-defined conversions (possible cycle of converting routines)"
 ]
diff --git a/Extension/bin/messages/fr/messages.json b/Extension/bin/messages/fr/messages.json
index 554718926..7266ac552 100644
--- a/Extension/bin/messages/fr/messages.json
+++ b/Extension/bin/messages/fr/messages.json
@@ -3747,5 +3747,6 @@
     "« static » n’est pas standard ici",
     "%nd a été déclaré précédemment sans base d’énumération explicite",
     "le mot-clé « typename » manquant n’est pas standard ici",
-    "la syntaxe abrégée du modèle de fonction n’est pas standard pour les guides de déduction"
+    "la syntaxe abrégée du modèle de fonction n’est pas standard pour les guides de déduction",
+    "too many nested user-defined conversions (possible cycle of converting routines)"
 ]
diff --git a/Extension/bin/messages/it/messages.json b/Extension/bin/messages/it/messages.json
index c6ec55540..edfb4984c 100644
--- a/Extension/bin/messages/it/messages.json
+++ b/Extension/bin/messages/it/messages.json
@@ -3747,5 +3747,6 @@
     "'static' non è standard qui",
     "%nd era stato dichiarato in precedenza senza una base di enumerazione esplicita",
     "manca 'typename' che qui non è standard",
-    "la sintassi abbreviata del modello di funzione non è standard per le guide alla deduzione"
+    "la sintassi abbreviata del modello di funzione non è standard per le guide alla deduzione",
+    "too many nested user-defined conversions (possible cycle of converting routines)"
 ]
diff --git a/Extension/bin/messages/ja/messages.json b/Extension/bin/messages/ja/messages.json
index a38aa4ef4..1019dacff 100644
--- a/Extension/bin/messages/ja/messages.json
+++ b/Extension/bin/messages/ja/messages.json
@@ -3747,5 +3747,6 @@
     "'static' はここでは非標準です",
     "%nd は、明示的な列挙型ベースなしで以前に宣言されました",
     "見つからない 'typename' はここでは非標準です",
-    "省略形の関数テンプレート構文は、推論ガイドでは非標準です"
+    "省略形の関数テンプレート構文は、推論ガイドでは非標準です",
+    "too many nested user-defined conversions (possible cycle of converting routines)"
 ]
diff --git a/Extension/bin/messages/ko/messages.json b/Extension/bin/messages/ko/messages.json
index a1c3c4266..1386339c4 100644
--- a/Extension/bin/messages/ko/messages.json
+++ b/Extension/bin/messages/ko/messages.json
@@ -3747,5 +3747,6 @@
     "여기서 'static'은 표준이 아닙니다.",
     "%nd은(는) 이전에 명시적 열거형 기반 없이 선언되었습니다.",
     "여기서 누락된 'typename'이 표준이 아닙니다.",
-    "약식 함수 템플릿 구문은 추론 가이드에 대한 표준이 아닙니다."
+    "약식 함수 템플릿 구문은 추론 가이드에 대한 표준이 아닙니다.",
+    "too many nested user-defined conversions (possible cycle of converting routines)"
 ]
diff --git a/Extension/bin/messages/pl/messages.json b/Extension/bin/messages/pl/messages.json
index b23fa19a0..bb48c1abf 100644
--- a/Extension/bin/messages/pl/messages.json
+++ b/Extension/bin/messages/pl/messages.json
@@ -3747,5 +3747,6 @@
     "„static” jest tutaj niestandardowy",
     "funkcja %nd została poprzednio zadeklarowana bez jawnej bazy wyliczenia",
     "brak elementu „typename” jest tutaj niestandardowe",
-    "skrócona składnia szablonu funkcji jest niestandardowa dla przewodników dedukcji"
+    "skrócona składnia szablonu funkcji jest niestandardowa dla przewodników dedukcji",
+    "too many nested user-defined conversions (possible cycle of converting routines)"
 ]
diff --git a/Extension/bin/messages/pt-br/messages.json b/Extension/bin/messages/pt-br/messages.json
index 6df58e7c3..31f7d5d42 100644
--- a/Extension/bin/messages/pt-br/messages.json
+++ b/Extension/bin/messages/pt-br/messages.json
@@ -3747,5 +3747,6 @@
     "\"static\" não é padrão aqui",
     "%nd foi declarado anteriormente sem uma base de enumeração explícita",
     "\"typename\" ausente não é padrão aqui",
-    "a sintaxe abreviada de template de função é não padrão para guias de dedução"
+    "a sintaxe abreviada de template de função é não padrão para guias de dedução",
+    "too many nested user-defined conversions (possible cycle of converting routines)"
 ]
diff --git a/Extension/bin/messages/ru/messages.json b/Extension/bin/messages/ru/messages.json
index f7f74449b..b1325ec5b 100644
--- a/Extension/bin/messages/ru/messages.json
+++ b/Extension/bin/messages/ru/messages.json
@@ -3747,5 +3747,6 @@
     "\"static\" является здесь нестандартным",
     "%nd ранее был объявлен без явной базы перечисления",
     "отсутствие typename здесь является нестандартным",
-    "сокращенный синтаксис шаблона функции не является стандартным для правил дедукции"
+    "сокращенный синтаксис шаблона функции не является стандартным для правил дедукции",
+    "too many nested user-defined conversions (possible cycle of converting routines)"
 ]
diff --git a/Extension/bin/messages/tr/messages.json b/Extension/bin/messages/tr/messages.json
index a12691580..a5b8ed3b3 100644
--- a/Extension/bin/messages/tr/messages.json
+++ b/Extension/bin/messages/tr/messages.json
@@ -3747,5 +3747,6 @@
     "'static' burada standart dışıdır",
     "%nd daha önce açık bir sabit liste tabanı olmadan tanımlanmıştı",
     "eksik 'typename' burada standart dışı",
-    "kısaltılmış işlev şablonu sözdizimi çıkarsama kılavuzları için standart değil"
+    "kısaltılmış işlev şablonu sözdizimi çıkarsama kılavuzları için standart değil",
+    "too many nested user-defined conversions (possible cycle of converting routines)"
 ]
diff --git a/Extension/bin/messages/zh-cn/messages.json b/Extension/bin/messages/zh-cn/messages.json
index ffb8859a0..17d1a6400 100644
--- a/Extension/bin/messages/zh-cn/messages.json
+++ b/Extension/bin/messages/zh-cn/messages.json
@@ -3747,5 +3747,6 @@
     "此处使用 \"static\" 不符合标准",
     "之前声明 %nd 时未指定显式枚举基类型",
     "此处缺少 'typename' 属于非标准用法",
-    "缩写函数模板语法对于推导指南是不标准的"
+    "缩写函数模板语法对于推导指南是不标准的",
+    "too many nested user-defined conversions (possible cycle of converting routines)"
 ]
diff --git a/Extension/bin/messages/zh-tw/messages.json b/Extension/bin/messages/zh-tw/messages.json
index 8b6bdd208..9fd99a4db 100644
--- a/Extension/bin/messages/zh-tw/messages.json
+++ b/Extension/bin/messages/zh-tw/messages.json
@@ -3747,5 +3747,6 @@
     "此處使用的 'static' 非標準",
     "%nd 先前宣告時未明確指定的列舉基底",
     "此處缺少 'typename' 非標準用法",
-    "簡化函式範本語法在推導指南中並非標準用法"
+    "簡化函式範本語法在推導指南中並非標準用法",
+    "too many nested user-defined conversions (possible cycle of converting routines)"
 ]

From cd22e17227346ecdf02dc0fa6ba8e7718aef7ab6 Mon Sep 17 00:00:00 2001
From: Sean McManus <seanmcm@microsoft.com>
Date: Mon, 3 Aug 2026 11:04:59 -0700
Subject: [PATCH 02/12] Restore repo-tracked files after copying test binaries
 (#14632)

The install/copy-binaries script rm -rf's and re-copies the installed extension's bin, debugAdapters, and LLVM folders. A few files under bin are checked into the repo (bin/cpp.hint and bin/messages/**/messages.json); the copy overwrote them with the installed extension's versions (differing line endings and/or content), leaving spurious local modifications that had to be reverted by hand. Restore any tracked files the copy changed so only the untracked binaries remain, and gitignore the generated bin/binaryVersion.json marker.

Co-authored-by: Colen Garoutte-Carson <49173979+Colengms@users.noreply.github.com>
---
 Extension/.gitignore                        |  1 +
 Extension/.scripts/copyExtensionBinaries.ts | 31 ++++++++++++++++++++-
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/Extension/.gitignore b/Extension/.gitignore
index a2f6b3612..bc791bd25 100644
--- a/Extension/.gitignore
+++ b/Extension/.gitignore
@@ -10,6 +10,7 @@ server
 debugAdapters
 LLVM
 bin/assert_dialog.sh
+bin/binaryVersion.json
 bin/cpptools*
 bin/edge_cli
 bin/isense_driver
diff --git a/Extension/.scripts/copyExtensionBinaries.ts b/Extension/.scripts/copyExtensionBinaries.ts
index 23c9b13e0..107f3a74c 100644
--- a/Extension/.scripts/copyExtensionBinaries.ts
+++ b/Extension/.scripts/copyExtensionBinaries.ts
@@ -7,7 +7,7 @@ import { cp, readdir, rm, stat } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
 import { verbose } from '../src/Utility/Text/streams';
-import { $args, $root, green, heading, note } from './common';
+import { $args, $root, Git, green, heading, note, warn } from './common';
 
 const extensionPrefix = 'ms-vscode.cpptools-';
 const foldersToCopy = ['bin', 'debugAdapters', 'LLVM'] as const;
@@ -125,6 +125,33 @@ async function findLatestInstalledExtension(providedPath?: string): Promise<stri
     return installed[0].path;
 }
 
+/**
+ * A few files inside the copied folders are checked into the repo (for example bin/cpp.hint and
+ * bin/messages/**). The copy overwrites them with the installed extension's versions, which can differ
+ * in line endings or content and then show up as spurious local modifications. Restore any tracked files
+ * that the copy changed so only the untracked binaries remain in the working tree.
+ */
+async function restoreTrackedFiles(): Promise<void> {
+    const modified = await Git('ls-files', '--modified', '--', ...foldersToCopy);
+    if (modified.code) {
+        warn(`Unable to determine which tracked files to restore: ${modified.error.all().join('\n')}`);
+        return;
+    }
+
+    const files = modified.stdio.all().map(line => line.trim()).filter(line => line.length > 0);
+    if (!files.length) {
+        return;
+    }
+
+    const restored = await Git('checkout', '--', ...files);
+    if (restored.code) {
+        warn(`Unable to restore tracked files after copy: ${restored.error.all().join('\n')}`);
+        return;
+    }
+
+    note(`Restored ${files.length} tracked ${files.length === 1 ? 'file' : 'files'} overwritten by the copy.`);
+}
+
 export async function main(sourcePath = $args[0]): Promise<string | undefined> {
     console.log(heading('Copy installed extension binaries'));
 
@@ -142,6 +169,8 @@ export async function main(sourcePath = $args[0]): Promise<string | undefined> {
 
     note(`Copied installed binaries into ${$root}`);
 
+    await restoreTrackedFiles();
+
     const installedVersion = tryParseVersion(basename(installedExtensionPath));
     return installedVersion?.join('.');
 }

From 2d2383618304adb34de558f311da2495254c9946 Mon Sep 17 00:00:00 2001
From: Sean McManus <seanmcm@microsoft.com>
Date: Mon, 3 Aug 2026 13:02:28 -0700
Subject: [PATCH 03/12] Bump brace-expansion to latest patched versions
 (1.1.18, 2.1.4, 5.0.9) (#14633)

---
 .github/actions/package-lock.json | 18 +++++++++---------
 Extension/ThirdPartyNotices.txt   |  4 ++--
 Extension/yarn.lock               | 18 +++++++++---------
 ExtensionPack/package-lock.json   |  8 ++++----
 Themes/package-lock.json          |  8 ++++----
 5 files changed, 28 insertions(+), 28 deletions(-)

diff --git a/.github/actions/package-lock.json b/.github/actions/package-lock.json
index 3a051021a..ed777a837 100644
--- a/.github/actions/package-lock.json
+++ b/.github/actions/package-lock.json
@@ -2872,9 +2872,9 @@
       "optional": true
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.16",
-      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-1.1.16.tgz",
-      "integrity": "sha1-cj06MMBVjCJavJ/Eeac+FOJsPC8=",
+      "version": "1.1.18",
+      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha1-POdNiYhRNr4VNTQfjD1EJcKaXKs=",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3923,9 +3923,9 @@
       }
     },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.1.2",
-      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-2.1.2.tgz",
-      "integrity": "sha1-C7oicf631Fiw0xrRNiWqpHVEMeI=",
+      "version": "2.1.4",
+      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha1-WJ2rEcABjQNmvmTNi/Esjb7MgyY=",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4551,9 +4551,9 @@
       }
     },
     "node_modules/mocha/node_modules/brace-expansion": {
-      "version": "2.1.2",
-      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-2.1.2.tgz",
-      "integrity": "sha1-C7oicf631Fiw0xrRNiWqpHVEMeI=",
+      "version": "2.1.4",
+      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha1-WJ2rEcABjQNmvmTNi/Esjb7MgyY=",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/Extension/ThirdPartyNotices.txt b/Extension/ThirdPartyNotices.txt
index 7854b5b43..c39e33537 100644
--- a/Extension/ThirdPartyNotices.txt
+++ b/Extension/ThirdPartyNotices.txt
@@ -1487,7 +1487,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ---------------------------------------------------------
 
-brace-expansion 1.1.16 - MIT
+brace-expansion 1.1.18 - MIT
 https://github.com/juliangruber/brace-expansion
 
 Copyright (c) 2013 Julian Gruber <julian@juliangruber.com>
@@ -1519,7 +1519,7 @@ SOFTWARE.
 
 ---------------------------------------------------------
 
-brace-expansion 2.1.2 - MIT
+brace-expansion 2.1.4 - MIT
 https://github.com/juliangruber/brace-expansion
 
 Copyright (c) 2013 Julian Gruber <julian@juliangruber.com>
diff --git a/Extension/yarn.lock b/Extension/yarn.lock
index 9fa5674fe..c08fa76be 100644
--- a/Extension/yarn.lock
+++ b/Extension/yarn.lock
@@ -1737,24 +1737,24 @@ boundary@^2.0.0:
   integrity sha1-FpyLHw1Ezywlk4lnoyjzfgpOXvw=
 
 brace-expansion@^1.1.7:
-  version "1.1.16"
-  resolved "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-1.1.16.tgz#723d3a30c0558c225abc9fc479a73e14e26c3c2f"
-  integrity sha1-cj06MMBVjCJavJ/Eeac+FOJsPC8=
+  version "1.1.18"
+  resolved "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-1.1.18.tgz#3ce74d89885136be1535341f8c3d4425c29a5cab"
+  integrity sha1-POdNiYhRNr4VNTQfjD1EJcKaXKs=
   dependencies:
     balanced-match "^1.0.0"
     concat-map "0.0.1"
 
 brace-expansion@^2.0.1:
-  version "2.1.2"
-  resolved "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-2.1.2.tgz#0bba2271feb7d458b0d31ad13625aaa4754431e2"
-  integrity sha1-C7oicf631Fiw0xrRNiWqpHVEMeI=
+  version "2.1.4"
+  resolved "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-2.1.4.tgz#589dab11c0018d0366be64cd8bf12c8dbecc8326"
+  integrity sha1-WJ2rEcABjQNmvmTNi/Esjb7MgyY=
   dependencies:
     balanced-match "^1.0.0"
 
 brace-expansion@^5.0.2:
-  version "5.0.8"
-  resolved "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-5.0.8.tgz#135ad0d8d808eb18eb5e0ec9a21f3a0b92ef18cf"
-  integrity sha1-E1rQ2NgI6xjrXg7Joh86C5LvGM8=
+  version "5.0.9"
+  resolved "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-5.0.9.tgz#7c72438809b5fa5babf54199a1f1c281a6984fcf"
+  integrity sha1-fHJDiAm1+lur9UGZofHCgaaYT88=
   dependencies:
     balanced-match "^4.0.2"
 
diff --git a/ExtensionPack/package-lock.json b/ExtensionPack/package-lock.json
index 3e72450f0..2c893b7db 100644
--- a/ExtensionPack/package-lock.json
+++ b/ExtensionPack/package-lock.json
@@ -948,16 +948,16 @@
             "license": "BSD-2-Clause"
         },
         "node_modules/brace-expansion": {
-            "version": "5.0.8",
-            "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-5.0.8.tgz",
-            "integrity": "sha1-E1rQ2NgI6xjrXg7Joh86C5LvGM8=",
+            "version": "5.0.9",
+            "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-5.0.9.tgz",
+            "integrity": "sha1-fHJDiAm1+lur9UGZofHCgaaYT88=",
             "dev": true,
             "license": "MIT",
             "dependencies": {
                 "balanced-match": "^4.0.2"
             },
             "engines": {
-                "node": "18 || 20 || >=22"
+                "node": "20 || >=22"
             }
         },
         "node_modules/braces": {
diff --git a/Themes/package-lock.json b/Themes/package-lock.json
index 29dbd8ba4..77244bf71 100644
--- a/Themes/package-lock.json
+++ b/Themes/package-lock.json
@@ -948,16 +948,16 @@
       "license": "BSD-2-Clause"
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.8",
-      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-5.0.8.tgz",
-      "integrity": "sha1-E1rQ2NgI6xjrXg7Joh86C5LvGM8=",
+      "version": "5.0.9",
+      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha1-fHJDiAm1+lur9UGZofHCgaaYT88=",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/braces": {

From 74ca0fe21a8de503e2caece979aa158d522c8535 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 14:38:54 -0700
Subject: [PATCH 04/12] Bump undici from 7.28.0 to 7.29.0 in /Themes (#14634)

Bumps [undici](https://github.com/nodejs/undici) from 7.28.0 to 7.29.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v7.28.0...v7.29.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Themes/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Themes/package-lock.json b/Themes/package-lock.json
index 77244bf71..9e41bb0be 100644
--- a/Themes/package-lock.json
+++ b/Themes/package-lock.json
@@ -3642,9 +3642,9 @@
       "license": "MIT"
     },
     "node_modules/undici": {
-      "version": "7.28.0",
-      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/undici/-/undici-7.28.0.tgz",
-      "integrity": "sha1-l9ZFZBmLKFvCgfDo4pWX49Ef5+w=",
+      "version": "7.29.0",
+      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/undici/-/undici-7.29.0.tgz",
+      "integrity": "sha1-rg9vYuBuBXqcu3srX94rt095G48=",
       "dev": true,
       "license": "MIT",
       "engines": {

From c12be38b72f83e93954926203fadd7698fa75865 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 4 Aug 2026 09:27:43 -0700
Subject: [PATCH 05/12] Bump undici from 7.28.0 to 7.29.0 in /Extension
 (#14637)

Bumps [undici](https://github.com/nodejs/undici) from 7.28.0 to 7.29.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v7.28.0...v7.29.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Extension/package.json | 2 +-
 Extension/yarn.lock    | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Extension/package.json b/Extension/package.json
index dc6d5a98a..170721c44 100644
--- a/Extension/package.json
+++ b/Extension/package.json
@@ -7264,7 +7264,7 @@
         "@azure/msal-browser": "^4.29.1",
         "flatted": "^3.4.1",
         "uuid": "^11.1.1",
-        "undici": "^7.28.0",
+        "undici": "^7.29.0",
         "fast-uri": "^3.1.4"
     }
 }
diff --git a/Extension/yarn.lock b/Extension/yarn.lock
index c08fa76be..fda9ee2ab 100644
--- a/Extension/yarn.lock
+++ b/Extension/yarn.lock
@@ -6242,9 +6242,9 @@ undici-types@~7.18.0:
   integrity sha1-KTV6iee3ykrvO/D9P9DNc4hCKek=
 
 undici@^7.19.0, undici@^7.28.0:
-  version "7.28.0"
-  resolved "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/undici/-/undici-7.28.0.tgz#97d64564198b285bc281f0e8e29597e3d11fe7ec"
-  integrity sha1-l9ZFZBmLKFvCgfDo4pWX49Ef5+w=
+  version "7.29.0"
+  resolved "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/undici/-/undici-7.29.0.tgz#ae0f6f62e06e057a9cbb7b2b5fde2bb74f791b8f"
+  integrity sha1-rg9vYuBuBXqcu3srX94rt095G48=
 
 unicorn-magic@^0.1.0:
   version "0.1.0"

From 5fd0548c004d18e8dcaff3253eec59961e6156ec Mon Sep 17 00:00:00 2001
From: luo2430 <127001012+luo2430@users.noreply.github.com>
Date: Wed, 5 Aug 2026 00:56:38 +0800
Subject: [PATCH 06/12] Fix .vscodeignore missing .gitignore in themes
 extension (#14636)

* Fix .vscodeignore missing .gitignore in themes extension

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Sean McManus <seanmcm@microsoft.com>
---
 Themes/.vscodeignore | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Themes/.vscodeignore b/Themes/.vscodeignore
index de7ebe82f..5b46d9ca3 100644
--- a/Themes/.vscodeignore
+++ b/Themes/.vscodeignore
@@ -1,5 +1,7 @@
 # ignore vscode settings for extension development
 .vscode/**
 
-# ignore package lock
-package-lock.json
\ No newline at end of file
+# ignore development files
+.gitignore
+.npmrc
+package-lock.json

From c238b1de0b2022d0c0a3bf2801ee5925c62bc42e Mon Sep 17 00:00:00 2001
From: Microsoft Open Source Security Bot <oss-security-bot@microsoft.com>
Date: Tue, 4 Aug 2026 09:58:57 -0700
Subject: [PATCH 07/12] Pin GitHub Actions to full-length commit SHAs (#14635)

Co-authored-by: Sean McManus <seanmcm@microsoft.com>
---
 .github/dependabot.yml                                | 11 +++++++++++
 .github/workflows/bug-debugger.yml                    |  2 +-
 .github/workflows/by-design-closer-debugger .yml      |  2 +-
 .github/workflows/by-design-closer.yml                |  2 +-
 .github/workflows/codeql.yml                          |  6 +++---
 .github/workflows/duplicate-closer.yml                |  2 +-
 .github/workflows/enhancement-closer-no-milestone.yml |  2 +-
 .github/workflows/enhancement-closer-triage.yml       |  2 +-
 .github/workflows/enhancement-reopener.yml            |  2 +-
 .github/workflows/external-closer-debugger.yml        |  2 +-
 .../workflows/feature-request-closer-no-milestone.yml |  2 +-
 .github/workflows/feature-request-closer-triage.yml   |  2 +-
 .github/workflows/feature-request-debugger.yml        |  2 +-
 .github/workflows/feature-request-reopener.yml        |  2 +-
 .github/workflows/investigate-closer-debugger.yml     |  2 +-
 .../workflows/investigate-costing-closer-debugger.yml |  2 +-
 .github/workflows/job-compile-and-test.yml            | 10 +++++-----
 .github/workflows/locker.yml                          |  2 +-
 .../workflows/more-info-needed-closer-debugger.yml    |  2 +-
 .github/workflows/more-info-needed-closer.yml         |  2 +-
 .github/workflows/question-closer-debugger.yml        |  2 +-
 .github/workflows/question-closer.yml                 |  2 +-
 22 files changed, 38 insertions(+), 27 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..2c48305b7
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/bug-debugger.yml b/.github/workflows/bug-debugger.yml
index bcafecc0f..ea2629aaa 100644
--- a/.github/workflows/bug-debugger.yml
+++ b/.github/workflows/bug-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Add Comment
diff --git a/.github/workflows/by-design-closer-debugger .yml b/.github/workflows/by-design-closer-debugger .yml
index f03586b37..7ba928489 100644
--- a/.github/workflows/by-design-closer-debugger .yml	
+++ b/.github/workflows/by-design-closer-debugger .yml	
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/by-design-closer.yml b/.github/workflows/by-design-closer.yml
index 0fe17b3d3..30b5fa0a9 100644
--- a/.github/workflows/by-design-closer.yml
+++ b/.github/workflows/by-design-closer.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index cb836d8b9..2ba0947c3 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -59,11 +59,11 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -91,7 +91,7 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5
       with:
         category: "/language:${{matrix.language}}"
 
diff --git a/.github/workflows/duplicate-closer.yml b/.github/workflows/duplicate-closer.yml
index 29c41d85d..b5cfca076 100644
--- a/.github/workflows/duplicate-closer.yml
+++ b/.github/workflows/duplicate-closer.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/enhancement-closer-no-milestone.yml b/.github/workflows/enhancement-closer-no-milestone.yml
index a24e19937..bd48cd252 100644
--- a/.github/workflows/enhancement-closer-no-milestone.yml
+++ b/.github/workflows/enhancement-closer-no-milestone.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/enhancement-closer-triage.yml b/.github/workflows/enhancement-closer-triage.yml
index 30d8230a9..ea4794708 100644
--- a/.github/workflows/enhancement-closer-triage.yml
+++ b/.github/workflows/enhancement-closer-triage.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/enhancement-reopener.yml b/.github/workflows/enhancement-reopener.yml
index b10666057..db583c6ee 100644
--- a/.github/workflows/enhancement-reopener.yml
+++ b/.github/workflows/enhancement-reopener.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Run Reopener
diff --git a/.github/workflows/external-closer-debugger.yml b/.github/workflows/external-closer-debugger.yml
index dc5f35fa1..b83bf13df 100644
--- a/.github/workflows/external-closer-debugger.yml
+++ b/.github/workflows/external-closer-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/feature-request-closer-no-milestone.yml b/.github/workflows/feature-request-closer-no-milestone.yml
index 5312c0756..da987537a 100644
--- a/.github/workflows/feature-request-closer-no-milestone.yml
+++ b/.github/workflows/feature-request-closer-no-milestone.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/feature-request-closer-triage.yml b/.github/workflows/feature-request-closer-triage.yml
index 4ddab0ed6..ebfb85b23 100644
--- a/.github/workflows/feature-request-closer-triage.yml
+++ b/.github/workflows/feature-request-closer-triage.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/feature-request-debugger.yml b/.github/workflows/feature-request-debugger.yml
index 5202d0c53..869051dcb 100644
--- a/.github/workflows/feature-request-debugger.yml
+++ b/.github/workflows/feature-request-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Add Comment
diff --git a/.github/workflows/feature-request-reopener.yml b/.github/workflows/feature-request-reopener.yml
index a060e2d13..cba126b67 100644
--- a/.github/workflows/feature-request-reopener.yml
+++ b/.github/workflows/feature-request-reopener.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Run Reopener
diff --git a/.github/workflows/investigate-closer-debugger.yml b/.github/workflows/investigate-closer-debugger.yml
index d3b823ae9..e98caa1ca 100644
--- a/.github/workflows/investigate-closer-debugger.yml
+++ b/.github/workflows/investigate-closer-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/investigate-costing-closer-debugger.yml b/.github/workflows/investigate-costing-closer-debugger.yml
index 7b68f50f4..0b1c16a7d 100644
--- a/.github/workflows/investigate-costing-closer-debugger.yml
+++ b/.github/workflows/investigate-costing-closer-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/job-compile-and-test.yml b/.github/workflows/job-compile-and-test.yml
index cf96f22e0..e5911a5df 100644
--- a/.github/workflows/job-compile-and-test.yml
+++ b/.github/workflows/job-compile-and-test.yml
@@ -25,12 +25,12 @@ jobs:
     runs-on: ${{ inputs.runner-env }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.checkout-ref }}
 
       - name: Use Node.js 24
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 24
 
@@ -80,21 +80,21 @@ jobs:
 
       - name: Run languageServer integration tests (linux/macOS)
         if: ${{ inputs.platform == 'mac' || inputs.platform == 'linux' }}
-        uses: coactions/setup-xvfb@v1
+        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1
         with:
           run: yarn test --scenario=SingleRootProject
           working-directory: Extension
 
       - name: Run E2E IntelliSense features tests (linux/macOS)
         if: ${{ inputs.platform == 'mac' || inputs.platform == 'linux' }}
-        uses: coactions/setup-xvfb@v1
+        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1
         with:
           run: yarn test --scenario=MultirootDeadlockTest
           working-directory: Extension
 
       - name: Run RunWithoutDebugging tests (linux/macOS)
         if: ${{ inputs.platform == 'mac' || inputs.platform == 'linux' }}
-        uses: coactions/setup-xvfb@v1
+        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1
         with:
           run: yarn test --scenario=RunWithoutDebugging --scenario-arg=skipExternalConsole
           working-directory: Extension
diff --git a/.github/workflows/locker.yml b/.github/workflows/locker.yml
index 79d843630..d157e0077 100644
--- a/.github/workflows/locker.yml
+++ b/.github/workflows/locker.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Run Locker
diff --git a/.github/workflows/more-info-needed-closer-debugger.yml b/.github/workflows/more-info-needed-closer-debugger.yml
index 87ae5cd38..a670a648e 100644
--- a/.github/workflows/more-info-needed-closer-debugger.yml
+++ b/.github/workflows/more-info-needed-closer-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/more-info-needed-closer.yml b/.github/workflows/more-info-needed-closer.yml
index 1d2016775..b11bcd588 100644
--- a/.github/workflows/more-info-needed-closer.yml
+++ b/.github/workflows/more-info-needed-closer.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/question-closer-debugger.yml b/.github/workflows/question-closer-debugger.yml
index 75616ceb3..16f566cc5 100644
--- a/.github/workflows/question-closer-debugger.yml
+++ b/.github/workflows/question-closer-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/question-closer.yml b/.github/workflows/question-closer.yml
index ebcdb99be..d665a05b4 100644
--- a/.github/workflows/question-closer.yml
+++ b/.github/workflows/question-closer.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

From 36e17520eaf694ba009aac70aaa43e6f9b9fa9a4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 4 Aug 2026 10:37:31 -0700
Subject: [PATCH 08/12] Bump the github-actions group with 4 updates (#14639)

Bumps the github-actions group with 4 updates: [actions/checkout](https://github.com/actions/checkout), [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [actions/setup-node](https://github.com/actions/setup-node).


Updates `actions/checkout` from 5.1.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09...3d3c42e5aac5ba805825da76410c181273ba90b1)

Updates `github/codeql-action/init` from 3.37.5 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e60ea984bd3baa95954f2856bcf24f9eaba46637...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)

Updates `github/codeql-action/analyze` from 3.37.5 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e60ea984bd3baa95954f2856bcf24f9eaba46637...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)

Updates `actions/setup-node` from 4.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...820762786026740c76f36085b0efc47a31fe5020)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/bug-debugger.yml                        | 2 +-
 .github/workflows/by-design-closer-debugger .yml          | 2 +-
 .github/workflows/by-design-closer.yml                    | 2 +-
 .github/workflows/codeql.yml                              | 6 +++---
 .github/workflows/duplicate-closer.yml                    | 2 +-
 .github/workflows/enhancement-closer-no-milestone.yml     | 2 +-
 .github/workflows/enhancement-closer-triage.yml           | 2 +-
 .github/workflows/enhancement-reopener.yml                | 2 +-
 .github/workflows/external-closer-debugger.yml            | 2 +-
 .github/workflows/feature-request-closer-no-milestone.yml | 2 +-
 .github/workflows/feature-request-closer-triage.yml       | 2 +-
 .github/workflows/feature-request-debugger.yml            | 2 +-
 .github/workflows/feature-request-reopener.yml            | 2 +-
 .github/workflows/investigate-closer-debugger.yml         | 2 +-
 .github/workflows/investigate-costing-closer-debugger.yml | 2 +-
 .github/workflows/job-compile-and-test.yml                | 4 ++--
 .github/workflows/locker.yml                              | 2 +-
 .github/workflows/more-info-needed-closer-debugger.yml    | 2 +-
 .github/workflows/more-info-needed-closer.yml             | 2 +-
 .github/workflows/question-closer-debugger.yml            | 2 +-
 .github/workflows/question-closer.yml                     | 2 +-
 21 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/bug-debugger.yml b/.github/workflows/bug-debugger.yml
index ea2629aaa..b2f7e382b 100644
--- a/.github/workflows/bug-debugger.yml
+++ b/.github/workflows/bug-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Add Comment
diff --git a/.github/workflows/by-design-closer-debugger .yml b/.github/workflows/by-design-closer-debugger .yml
index 7ba928489..888d3a548 100644
--- a/.github/workflows/by-design-closer-debugger .yml	
+++ b/.github/workflows/by-design-closer-debugger .yml	
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/by-design-closer.yml b/.github/workflows/by-design-closer.yml
index 30b5fa0a9..2334dedb3 100644
--- a/.github/workflows/by-design-closer.yml
+++ b/.github/workflows/by-design-closer.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 2ba0947c3..859eb7565 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -59,11 +59,11 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5
+      uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -91,7 +91,7 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5
+      uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       with:
         category: "/language:${{matrix.language}}"
 
diff --git a/.github/workflows/duplicate-closer.yml b/.github/workflows/duplicate-closer.yml
index b5cfca076..9811a82b9 100644
--- a/.github/workflows/duplicate-closer.yml
+++ b/.github/workflows/duplicate-closer.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/enhancement-closer-no-milestone.yml b/.github/workflows/enhancement-closer-no-milestone.yml
index bd48cd252..6399f5915 100644
--- a/.github/workflows/enhancement-closer-no-milestone.yml
+++ b/.github/workflows/enhancement-closer-no-milestone.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/enhancement-closer-triage.yml b/.github/workflows/enhancement-closer-triage.yml
index ea4794708..36d531b2a 100644
--- a/.github/workflows/enhancement-closer-triage.yml
+++ b/.github/workflows/enhancement-closer-triage.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/enhancement-reopener.yml b/.github/workflows/enhancement-reopener.yml
index db583c6ee..d14db1046 100644
--- a/.github/workflows/enhancement-reopener.yml
+++ b/.github/workflows/enhancement-reopener.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Run Reopener
diff --git a/.github/workflows/external-closer-debugger.yml b/.github/workflows/external-closer-debugger.yml
index b83bf13df..057ba636c 100644
--- a/.github/workflows/external-closer-debugger.yml
+++ b/.github/workflows/external-closer-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/feature-request-closer-no-milestone.yml b/.github/workflows/feature-request-closer-no-milestone.yml
index da987537a..ea228c638 100644
--- a/.github/workflows/feature-request-closer-no-milestone.yml
+++ b/.github/workflows/feature-request-closer-no-milestone.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/feature-request-closer-triage.yml b/.github/workflows/feature-request-closer-triage.yml
index ebfb85b23..8c831f1f8 100644
--- a/.github/workflows/feature-request-closer-triage.yml
+++ b/.github/workflows/feature-request-closer-triage.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/feature-request-debugger.yml b/.github/workflows/feature-request-debugger.yml
index 869051dcb..edccd38aa 100644
--- a/.github/workflows/feature-request-debugger.yml
+++ b/.github/workflows/feature-request-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Add Comment
diff --git a/.github/workflows/feature-request-reopener.yml b/.github/workflows/feature-request-reopener.yml
index cba126b67..b98633b2f 100644
--- a/.github/workflows/feature-request-reopener.yml
+++ b/.github/workflows/feature-request-reopener.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Run Reopener
diff --git a/.github/workflows/investigate-closer-debugger.yml b/.github/workflows/investigate-closer-debugger.yml
index e98caa1ca..2b0a0fa10 100644
--- a/.github/workflows/investigate-closer-debugger.yml
+++ b/.github/workflows/investigate-closer-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/investigate-costing-closer-debugger.yml b/.github/workflows/investigate-costing-closer-debugger.yml
index 0b1c16a7d..d585a9c1d 100644
--- a/.github/workflows/investigate-costing-closer-debugger.yml
+++ b/.github/workflows/investigate-costing-closer-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/job-compile-and-test.yml b/.github/workflows/job-compile-and-test.yml
index e5911a5df..18299aa63 100644
--- a/.github/workflows/job-compile-and-test.yml
+++ b/.github/workflows/job-compile-and-test.yml
@@ -25,12 +25,12 @@ jobs:
     runs-on: ${{ inputs.runner-env }}
 
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.checkout-ref }}
 
       - name: Use Node.js 24
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
 
diff --git a/.github/workflows/locker.yml b/.github/workflows/locker.yml
index d157e0077..30abd082e 100644
--- a/.github/workflows/locker.yml
+++ b/.github/workflows/locker.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Run Locker
diff --git a/.github/workflows/more-info-needed-closer-debugger.yml b/.github/workflows/more-info-needed-closer-debugger.yml
index a670a648e..183c76068 100644
--- a/.github/workflows/more-info-needed-closer-debugger.yml
+++ b/.github/workflows/more-info-needed-closer-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/more-info-needed-closer.yml b/.github/workflows/more-info-needed-closer.yml
index b11bcd588..f9e6a080a 100644
--- a/.github/workflows/more-info-needed-closer.yml
+++ b/.github/workflows/more-info-needed-closer.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/question-closer-debugger.yml b/.github/workflows/question-closer-debugger.yml
index 16f566cc5..44bbf8fa1 100644
--- a/.github/workflows/question-closer-debugger.yml
+++ b/.github/workflows/question-closer-debugger.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer
diff --git a/.github/workflows/question-closer.yml b/.github/workflows/question-closer.yml
index d665a05b4..86df2b0ea 100644
--- a/.github/workflows/question-closer.yml
+++ b/.github/workflows/question-closer.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

From 646df4df6eefec182b03521f035dacf6d8b6ca2f Mon Sep 17 00:00:00 2001
From: Sean McManus <seanmcm@microsoft.com>
Date: Tue, 4 Aug 2026 11:57:57 -0700
Subject: [PATCH 09/12] Update Node.js developer prerequisites (#14641)

---
 Documentation/Building the Extension.md | 2 +-
 Extension/readme.developer.md           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Documentation/Building the Extension.md b/Documentation/Building the Extension.md
index 86b43a4d7..9cb3abb3e 100644
--- a/Documentation/Building the Extension.md	
+++ b/Documentation/Building the Extension.md	
@@ -5,7 +5,7 @@ These steps will allow you to debug the TypeScript code that is part of the Micr
 Prerequisite steps:
   * Clone the release branch of [this](https://github.com/Microsoft/vscode-cpptools) repository.
       * git clone -b release https://github.com/Microsoft/vscode-cpptools
-  * Install [node](https://nodejs.org).
+  * Install the [required Node.js version](../Extension/readme.developer.md#required-tools).
   * Install [yarn](https://yarnpkg.com).
   * From a command line, run the following commands from the **Extension** folder in the root of the repository:
       * `yarn install` will install the dependencies needed to build the extension.
diff --git a/Extension/readme.developer.md b/Extension/readme.developer.md
index 5a7d4c3b3..a145707ec 100644
--- a/Extension/readme.developer.md
+++ b/Extension/readme.developer.md
@@ -35,7 +35,7 @@
 
 ### Required Tools 
 
-* [Node.js](https://nodejs.org/en/download/) v16.*
+* [Node.js](https://nodejs.org/en/download/) 24.x
 * npm (comes with Node.js)
 
 ### Setting up the repository

From f2480fd88205ad0f749bb589e70e26cec66e5959 Mon Sep 17 00:00:00 2001
From: Sean McManus <seanmcm@microsoft.com>
Date: Tue, 4 Aug 2026 13:04:29 -0700
Subject: [PATCH 10/12] Update dependencies to address security advisories
 (#14640)

---
 .github/actions/package-lock.json | 12 ++++++------
 Extension/package.json            |  2 +-
 Extension/yarn.lock               | 10 +++++-----
 ExtensionPack/package-lock.json   |  6 +++---
 4 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/actions/package-lock.json b/.github/actions/package-lock.json
index ed777a837..93dfbb535 100644
--- a/.github/actions/package-lock.json
+++ b/.github/actions/package-lock.json
@@ -4181,9 +4181,9 @@
       "license": "ISC"
     },
     "node_modules/ip-address": {
-      "version": "10.2.0",
-      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/ip-address/-/ip-address-10.2.0.tgz",
-      "integrity": "sha1-gF/BeLIMUYvUyFSLJP4wiS1/MgY=",
+      "version": "10.3.1",
+      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/ip-address/-/ip-address-10.3.1.tgz",
+      "integrity": "sha1-kp+WKdFyT34bdIXOiXUvNnUzahA=",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5463,9 +5463,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.27.0",
-      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/undici/-/undici-6.27.0.tgz",
-      "integrity": "sha1-Qfnkj3xaQNJzdsqurYyan8e8qcQ=",
+      "version": "6.28.0",
+      "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/undici/-/undici-6.28.0.tgz",
+      "integrity": "sha1-nw44V0T+9QIdZZbFvM14P2EZPBw=",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"
diff --git a/Extension/package.json b/Extension/package.json
index 170721c44..4e739aaab 100644
--- a/Extension/package.json
+++ b/Extension/package.json
@@ -7258,7 +7258,7 @@
         "which": "^2.0.2"
     },
     "resolutions": {
-        "postcss": "^8.5.18",
+        "postcss": "^8.5.23",
         "gulp-typescript/**/glob-parent": "^5.1.2",
         "serialize-javascript": "^7.0.5",
         "@azure/msal-browser": "^4.29.1",
diff --git a/Extension/yarn.lock b/Extension/yarn.lock
index fda9ee2ab..533277b2b 100644
--- a/Extension/yarn.lock
+++ b/Extension/yarn.lock
@@ -4996,10 +4996,10 @@ possible-typed-array-names@^1.0.0:
   resolved "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz#93e3582bc0e5426586d9d07b79ee40fc841de4ae"
   integrity sha1-k+NYK8DlQmWG2dB7ee5A/IQd5K4=
 
-postcss@^7.0.16, postcss@^8.5.18:
-  version "8.5.22"
-  resolved "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/postcss/-/postcss-8.5.22.tgz#086a0d5685a715acf5950ebbcb1538faf3051697"
-  integrity sha1-CGoNVoWnFaz1lQ67yxU4+vMFFpc=
+postcss@^7.0.16, postcss@^8.5.23:
+  version "8.5.25"
+  resolved "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/postcss/-/postcss-8.5.25.tgz#5012a598eaaa897f21bbe8553be3cb7bd2bd78cb"
+  integrity sha1-UBKlmOqqiX8hu+hVO+PLe9K9eMs=
   dependencies:
     nanoid "^3.3.16"
     picocolors "^1.1.1"
@@ -6241,7 +6241,7 @@ undici-types@~7.18.0:
   resolved "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/undici-types/-/undici-types-7.18.2.tgz#29357a89e7b7ca4aef3bf0fd3fd0cd73884229e9"
   integrity sha1-KTV6iee3ykrvO/D9P9DNc4hCKek=
 
-undici@^7.19.0, undici@^7.28.0:
+undici@^7.19.0, undici@^7.29.0:
   version "7.29.0"
   resolved "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/undici/-/undici-7.29.0.tgz#ae0f6f62e06e057a9cbb7b2b5fde2bb74f791b8f"
   integrity sha1-rg9vYuBuBXqcu3srX94rt095G48=
diff --git a/ExtensionPack/package-lock.json b/ExtensionPack/package-lock.json
index 2c893b7db..f0898d1d2 100644
--- a/ExtensionPack/package-lock.json
+++ b/ExtensionPack/package-lock.json
@@ -3642,9 +3642,9 @@
             "license": "MIT"
         },
         "node_modules/undici": {
-            "version": "7.28.0",
-            "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/undici/-/undici-7.28.0.tgz",
-            "integrity": "sha1-l9ZFZBmLKFvCgfDo4pWX49Ef5+w=",
+            "version": "7.29.0",
+            "resolved": "https://pkgs.dev.azure.com/azure-public/VisualCpp/_packaging/cpp_PublicPackages/npm/registry/undici/-/undici-7.29.0.tgz",
+            "integrity": "sha1-rg9vYuBuBXqcu3srX94rt095G48=",
             "dev": true,
             "license": "MIT",
             "engines": {

From 130bb59612f6f13a89956b041d360323257a73e6 Mon Sep 17 00:00:00 2001
From: Sean McManus <seanmcm@microsoft.com>
Date: Tue, 4 Aug 2026 13:07:45 -0700
Subject: [PATCH 11/12] Fix `by-design-closer-debugger .yml` naming. (#14638)

---
 ...-design-closer-debugger .yml => by-design-closer-debugger.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename .github/workflows/{by-design-closer-debugger .yml => by-design-closer-debugger.yml} (100%)

diff --git a/.github/workflows/by-design-closer-debugger .yml b/.github/workflows/by-design-closer-debugger.yml
similarity index 100%
rename from .github/workflows/by-design-closer-debugger .yml
rename to .github/workflows/by-design-closer-debugger.yml

From b02a2f85a4c73df7557a094dd3d5a0200aebcbfd Mon Sep 17 00:00:00 2001
From: Sean McManus <seanmcm@microsoft.com>
Date: Tue, 4 Aug 2026 16:43:54 -0700
Subject: [PATCH 12/12] Update changelog for 1.33.6 (#14644)

* Update changelog for 1.33.6
---
 Extension/CHANGELOG.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Extension/CHANGELOG.md b/Extension/CHANGELOG.md
index c0e8bbe12..fa0dd4284 100644
--- a/Extension/CHANGELOG.md
+++ b/Extension/CHANGELOG.md
@@ -1,15 +1,17 @@
 # C/C++ for Visual Studio Code Changelog
 
-## Version 1.33.6: July 31, 2026
+## Version 1.33.6: August 4, 2026
 ### Bug Fixes
 * Fix a spurious recursive includes (`**`) debug console log warning for paths merged from `c_cpp_properties.json` when `C_Cpp.mergeConfigurations` is enabled. [#14125](https://github.com/microsoft/vscode-cpptools/issues/14125)
   * Thanks for the contribution. [@owevertonguedes (Weverton Guedes)](https://github.com/owevertonguedes) [PR #14620](https://github.com/microsoft/vscode-cpptools/pull/14620)
 * Fix custom configurations being discarded when `C_Cpp.mergeConfigurations` is enabled and a provider supplies the file `uri` as a `vscode.Uri`. [#14621](https://github.com/microsoft/vscode-cpptools/issues/14621)
   * Thanks for the contribution. [@owevertonguedes (Weverton Guedes)](https://github.com/owevertonguedes) [PR #14624](https://github.com/microsoft/vscode-cpptools/pull/14624)
+* Fix a tag parser crash when a UTF-8 string literal is concatenated with a narrow string literal containing an invalid multibyte sequence.
 * Fix potential browse database corruption when the same workspace is opened by multiple processes on Linux and macOS.
 * Fix a crash when reading files saved in certain multibyte encodings such as GB18030 or EUC-JP.
 * Fix an incorrect file path in an error message on Windows.
 * Other potential crash fixes.
+* Update dependencies.
 
 ## Version 1.33.5: July 28, 2026
 ### Bug Fixes