fix(deps): remove direct lru-cache dependency - #1926
Conversation
Bumps [lru-cache](https://github.com/isaacs/node-lru-cache) from 7.18.3 to 11.5.2. - [Changelog](https://github.com/isaacs/node-lru-cache/blob/main/CHANGELOG.md) - [Commits](isaacs/node-lru-cache@v7.18.3...v11.5.2) --- updated-dependencies: - dependency-name: lru-cache dependency-version: 11.5.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Replace the narrow 32-entry cache usage with a local bounded LRU map so the extension retains VS Code 1.88 runtime compatibility. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Changyong Gong (chagong)
changed the title
|
Decision: NOT_MERGED Dependabot PR Manager resultRepository: Safety assessment: The Dependabot starting commit and Copilot remediation head Final state: Head Actions taken: Performed a read-only target, commit-identity, provenance, diff, review-thread, required-check, complete-check, and base-ancestry audit. No rebase, rerun, remediation, approval, or merge was attempted. Head SHA remained unchanged. Reason: Human-authored merge commit Next action: Manually review the unverified merge commit and failed Azure checks, then update the branch through an auditable operation before rerunning management. Workflow run: https://github.com/chagong/JavaForge/actions/runs/34448998621 |
The attempted
lru-cache7.18.3 to 11.5.2 update is replaced by removal of the direct runtime dependency.lru-cachev11 requires Node 20, while this extension supports VS Code 1.88 (Node 18), and v9+ also removed the constructor import used here. The extension only needed a 32-entry cache withgetandset, so this change preserves that behavior with a focused bounded LRU map, removes the obsolete type package and notices, and adds regression coverage for eviction order.