Fix cross-spawn vulnerability

cli/.gitignore

@@ -8,4 +8,5 @@
 /lib/
 node_modules/
 yarn-error.log
-/scripts/downloads
+/scripts/downloads
+/src/version.ts

cli/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 This change log covers only the command line interface (CLI) of Open VSX.
 
+### v0.10.1 (Nov. 2024)
+
+#### Dependencies
+
+- Upgrade `@vscode/vsce` from `3.1.0` to `3.2.1` ([#1047](https://github.com/eclipse/openvsx/pull/1047))
+
+---
+
 ### v0.10.0 (Oct. 2024)
 
 #### New Features

cli/configs/eslintrc.mjs

@@ -0,0 +1,94 @@
+import typescriptEslint from "@typescript-eslint/eslint-plugin";
+import tsParser from "@typescript-eslint/parser";
+import stylistic from '@stylistic/eslint-plugin'
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import js from "@eslint/js";
+import { FlatCompat } from "@eslint/eslintrc";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const compat = new FlatCompat({
+    baseDirectory: __dirname,
+    recommendedConfig: js.configs.recommended,
+    allConfig: js.configs.all
+});
+
+export default [...compat.extends(
+    "eslint:recommended",
+    "plugin:@typescript-eslint/eslint-recommended",
+    "plugin:@typescript-eslint/recommended",
+), {
+    files: ["**/*.ts"],
+    plugins: {
+        "@typescript-eslint": typescriptEslint,
+        "@stylistic": stylistic
+    },
+
+    languageOptions: {
+        parser: tsParser,
+    },
+
+    rules: {
+        "@typescript-eslint/ban-types": "off",
+        "@/brace-style": ["warn", "1tbs"],
+
+        "@/comma-spacing": ["warn", {
+            before: false,
+            after: true,
+        }],
+
+        "@/func-call-spacing": ["warn", "never"],
+
+        "@/keyword-spacing": ["warn", {
+            before: true,
+            after: true,
+        }],
+
+        "@typescript-eslint/no-empty-function": "off",
+        "@typescript-eslint/no-empty-interface": "off",
+        "@typescript-eslint/no-explicit-any": "off",
+        "@typescript-eslint/no-inferrable-types": "off",
+        "@typescript-eslint/no-namespace": "off",
+        "@typescript-eslint/no-non-null-assertion": "off",
+        "@typescript-eslint/no-unused-vars": "off",
+        "@typescript-eslint/no-var-requires": "off",
+        "@/semi": ["error", "always"],
+        "@stylistic/type-annotation-spacing": "warn",
+        "array-bracket-spacing": ["warn", "never"],
+
+        "arrow-spacing": ["warn", {
+            before: true,
+            after: true,
+        }],
+
+        "computed-property-spacing": ["warn", "never"],
+        "jsx-quotes": ["error", "prefer-single"],
+
+        "key-spacing": ["warn", {
+            beforeColon: false,
+            afterColon: true,
+        }],
+
+        "linebreak-style": ["warn", "unix"],
+        "new-parens": "error",
+        "no-trailing-spaces": "warn",
+        "no-whitespace-before-property": "warn",
+        "object-curly-spacing": ["warn", "always"],
+
+        "semi-spacing": ["warn", {
+            before: false,
+            after: true,
+        }],
+
+        "space-before-blocks": ["warn", "always"],
+        "space-in-parens": ["warn", "never"],
+        "space-infix-ops": "warn",
+        "space-unary-ops": "warn",
+
+        "switch-colon-spacing": ["warn", {
+            before: false,
+            after: true,
+        }],
+    },
+}];

cli/package.json

@@ -1,6 +1,6 @@
 {
     "name": "ovsx",
-    "version": "0.10.0",
+    "version": "0.10.1",
     "description": "Command line interface for Eclipse Open VSX",
     "keywords": [
         "cli",
@@ -34,7 +34,7 @@
         "node": ">= 20"
     },
     "dependencies": {
-        "@vscode/vsce": "^3.1.0",
+        "@vscode/vsce": "^3.2.1",
         "commander": "^6.2.1",
         "follow-redirects": "^1.14.6",
         "is-ci": "^2.0.0",
@@ -44,25 +44,29 @@
         "yauzl": "^3.1.3"
     },
     "devDependencies": {
+        "@eslint/eslintrc": "^3.2.0",
+        "@eslint/js": "^9.15.0",
+        "@stylistic/eslint-plugin": "^2.11.0",
         "@types/follow-redirects": "^1.13.1",
         "@types/is-ci": "^2.0.0",
         "@types/node": "^20.14.8",
         "@types/semver": "^7.5.8",
         "@types/tmp": "^0.2.2",
         "@types/yauzl": "^2.10.3",
-        "@typescript-eslint/eslint-plugin": "^5.44.0",
-        "@typescript-eslint/parser": "^5.44.0",
-        "eslint": "^8.28.0",
+        "@typescript-eslint/eslint-plugin": "^8.15.0",
+        "@typescript-eslint/parser": "^8.15.0",
+        "eslint": "^9.15.0",
         "limiter": "^2.1.0",
-        "rimraf": "^3.0.2",
+        "rimraf": "^6.0.1",
         "typescript": "^4.3.2"
     },
     "scripts": {
         "clean": "rimraf lib",
+        "prebuild": "node -p \"'export const LIB_VERSION = ' + JSON.stringify(require('./package.json').version) + ';'\" > src/version.ts",
         "build": "tsc -p ./tsconfig.json && yarn run lint && cp src/ovsx lib/ovsx",
         "watch": "tsc -w -p ./tsconfig.json",
-        "lint": "eslint -c ./configs/eslintrc.json --ext .ts src",
-        "prepare": "yarn run clean && yarn run build",
+        "lint": "eslint -c ./configs/eslintrc.mjs src",
+        "prepare": "yarn run clean && yarn run prebuild && yarn run build",
         "publish:next": "yarn npm publish --tag next",
         "publish:latest": "yarn npm publish --tag latest",
         "load-extensions": "node scripts/load-test-extensions.js"

cli/src/main.ts

@@ -17,16 +17,15 @@ import { handleError } from './util';
 import { getExtension } from './get';
 import login from './login';
 import logout from './logout';
-
-const pkg = require('../package.json');
+import { LIB_VERSION } from './version';
 
 module.exports = function (argv: string[]): void {
     const program = new commander.Command();
     program.usage('<command> [options]')
         .option('-r, --registryUrl <url>', 'Use the registry API at this base URL.')
         .option('-p, --pat <token>', 'Personal access token.')
         .option('--debug', 'Include debug information on error')
-        .version(pkg.version, '-V, --version', 'Print the Eclipse Open VSX CLI version');
+        .version(LIB_VERSION, '-V, --version', 'Print the Eclipse Open VSX CLI version');
 
     const createNamespaceCmd = program.command('create-namespace <name>');
     createNamespaceCmd.description('Create a new namespace')