chore: promote development to main (2026-08-31)

.github/renovate.json

@@ -66,6 +66,13 @@
       "matchPackageNames": ["eslint"],
       "matchUpdateTypes": ["major"],
       "enabled": false
+    },
+    {
+      "description": "Don't bump engines.vscode on its own. scripts/wfb_dep_update.sh keeps it locked to @types/vscode, which lags the VS Code release train (e.g. no @types/vscode@1.135.0 yet), and vsce refuses to package when engines.vscode is ahead of @types/vscode. The engine moves up on the next update-script run once @types/vscode catches up.",
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["engines"],
+      "matchPackageNames": ["vscode"],
+      "enabled": false
     }
   ]
 }

.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
-          node-version: 24.19.0
+          node-version: 24.20.0
           cache: 'npm'
 
       - name: Install dependencies
@@ -72,14 +72,22 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
-          node-version: 24.19.0
+          node-version: 24.20.0
           cache: 'npm'
 
       - name: Install dependencies
         run: npm ci
 
       - name: Install Xvfb
-        run: sudo apt-get update && sudo apt-get install -y xvfb
+        # Drop the Microsoft/Azure-CLI apt repos before updating: they are not
+        # needed here and their intermittent 403s on packages.microsoft.com
+        # otherwise fail `apt-get update` (exit 100) under `bash -e`.
+        run: |
+          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list \
+                     /etc/apt/sources.list.d/azure-cli.list \
+                     /etc/apt/sources.list.d/azure-cli.sources
+          sudo apt-get update
+          sudo apt-get install -y xvfb
 
       - name: Run e2e tests
         run: xvfb-run -a npm run test:e2e

.github/workflows/codeql.yml

@@ -31,11 +31,11 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+      - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           languages: javascript-typescript
           queries: security-and-quality
 
-      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+      - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           category: /language:javascript-typescript

.github/workflows/promote-dev-to-main.yml

@@ -7,7 +7,7 @@ name: Promote development to main
 
 on:
   schedule:
-    - cron: '30 12 * * 1' # Mondays ~12:30 UTC, off the top of the hour
+    - cron: '30 09 * * 1' # Mondays ~12:30 UTC, off the top of the hour
   workflow_dispatch:
     inputs:
       reason:

.github/workflows/release-please.yml

@@ -74,7 +74,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
-          node-version: 24.19.0
+          node-version: 24.20.0
           cache: 'npm'
 
       - name: Install dependencies