build(deps-dev): Bump the dev-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the dev-dependencies group with 7 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.3	2.5.12
tsx	4.23.0	4.23.13
@types/vscode	1.125.0	1.136.0
esbuild	0.28.1	0.28.2
vscode-languageserver-protocol	3.17.5	3.18.3
vscode-languageserver-textdocument	1.0.12	1.0.14
vue-tsc	3.3.9	3.3.11

Updates @biomejs/biome from 2.5.3 to 2.5.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.12

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

• #11585 c5c8315 Thanks @​Netail! - Fixed #11475: noUnresolvedImports no longer reports Bun runtime built-in modules (bun, bun:bundle, bun:ffi, bun:jsc, bun:sqlite, bun:test).

... (truncated)

Commits

• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• 1fc42ed feat(lint/js): add noThisOutsideOfClass (#11596)
• 6c7fd27 feat(lint/js/vue): add noVueDeprecatedScopedSlots (#11593)
• f4e5ebb feat(lint): add useModernMathApis (#11581)
• 54f3a2e feat(lint/js): add useFlatMathMinMax (#11508)
• 1d6210b feat(lint/js): add noUnmodifiedLoopCondition (#11491)
• 2d55931 feat(js_analyze): added a React naming convention rule (#11554)
• ee69e0e fix(schema): domains (#11565)
• f5d7896 feat(lint/js): add noInvalidFileInputAccept (#11497)
• Additional commits viewable in compare view

Updates tsx from 4.23.0 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

... (truncated)

Commits

• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• Additional commits viewable in compare view

Updates @types/vscode from 1.125.0 to 1.136.0

Commits

• See full diff in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates vscode-languageserver-protocol from 3.17.5 to 3.18.3

Release notes

Sourced from vscode-languageserver-protocol's releases.

release/protocol/3.18.3

No release notes provided.

release/types/3.18.3

Changes:

• #1840: Disable Azure Artifacts package publishing
• #1839: Add configurable language server stream handlers
• #1835: Preserve diagnostic pull state after quick document reopen
• #1823: feat(server): support document ranges formatting
• #1829: Increase notebook diagnostics test timeout on macOS
• #1834: Update dependencies
• #1831: Bump brace-expansion from 5.0.7 to 5.0.9 in /client
• #1830: Bump brace-expansion from 5.0.6 to 5.0.9 in /client-node-tests
• #1833: Bump js-yaml from 4.2.0 to 4.3.1
• #1832: Bump fast-uri from 3.1.4 to 3.1.5

• #1828: Bump @​vscode/test-electron to 3.1.0
• #1826: Bump fast-uri from 3.1.2 to 3.1.4
• #1824: Bump brace-expansion from 5.0.6 to 5.0.7 in /client
• #1822: Fix Registration options
• #1820: Correctly type URIs in file operations and clarify comments
• #1818: Remove proposed tag references from documentation
• #1817: Merge latest release into main
• #1816: Update dependency versions in lock files
• #1815: Fix validation setting in TypeScript configuration

This list of changes was auto generated.

release/protocol/3.18.2

No release notes provided.

release/protocol/3.18.1

Changes:

• #1796: Make TextDocumentContentFeature a supported capability
• #1795: textDocumentContent capability/feature is still behind a proposed gate even though in 3.18 it's not flagged as proposed anymore
• #1794: Fix partial result type for textDocument/diagnostic request
• #1792: Update @​vscode/test-electron to version 3.0.0
• #1791: Refine notification assertions in delayOpenNotifications tests
• #1790: Update inline value documentation and clean up dependencies
• #1788: Update dependency versions in lock files
• #1787: Merge 3.18 release into main
• #1786: Shorten test dir path

... (truncated)

Commits

• f92abd0 3.18.3 release
• 5fa1a2a Fix Registration options (#1822)
• a760573 Correctly type URIs in file operations and clarify comments (#1820)
• 8cb66c8 Remove proposed tag references from documentation (#1818)
• 0da5527 Merge latest release into main (#1817)
• ba098d3 Update metaModel version to 3.18.0 (#1809)
• edd4c12 Merge 3.18.1 release into main (#1805)
• 14dbe29 Fix partial result type for textDocument/diagnostic request (#1794)
• e4e7d97 Update inline value documentation and clean up dependencies (#1790)
• 3c7721e Update dependency versions in lock files (#1788)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for vscode-languageserver-protocol since your current version.

Updates vscode-languageserver-textdocument from 1.0.12 to 1.0.14

Release notes

Sourced from vscode-languageserver-textdocument's releases.

release/textDocument/1.0.13

Changes:

Bugs:

• #752: Edits are applied twice

Others:

• #1775: Update dependencies and improve compatibility
• #1774: Bump qs from 6.15.0 to 6.15.2
• #1773: Implement TextDocumentSnapshot for delay open notifications
• #1772: Prevent pulling diagnostics on untitled documents
• #1770: Update documentation and fix lint errors
• #1767: Inline value documentation improvements
• #1769: Fix glob pattern documentation

• #1768: Make document color requests consistent with the specification
• #1766: Add optional MarkupContent support to diagnostics
• #1751: forgetDocument is crashing the extension host
• #1765: Fixes #1751: Prevent crash in forgetDocument when disposed
• #1752: fix: random pipe path length extends limit on macos
• #1764: Fixes double application of edits during renaming
• #1762: Bump brace-expansion from 5.0.3 to 5.0.6 in /client
• #1763: Bump brace-expansion from 5.0.5 to 5.0.6 in /client-node-tests
• #1761: Inline Linux/macOS process-tree termination in client dispose path
• #1760: Remove uuid dependency and use crypto's randomUUID
• #1759: Bump fast-uri from 3.1.0 to 3.1.2
• #1753: Bump follow-redirects from 1.15.11 to 1.16.0
• #1747: Migrate to ESLint 9
• #1746: Bump brace-expansion from 5.0.3 to 5.0.5 in /client-node-tests
• #1744: Bump picomatch from 2.3.1 to 2.3.2 in /client
• #1745: Bump picomatch from 2.3.1 to 2.3.2
• #1742: Bump flatted from 3.2.7 to 3.4.2
• #1733: Update metamodel
• #1736: Merge release into main
• #1735: Merge updated lock files into release branch

This list of changes was auto generated.

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for vscode-languageserver-textdocument since your current version.

Updates vue-tsc from 3.3.9 to 3.3.11

Release notes

Sourced from vue-tsc's releases.

v3.3.11

language-core

• fix: generate full fragment props for type checking (#6155) - Thanks to @​serkodev!

language-service

• fix: invalidate tag and prop casing detection after template changes (#6172) - Thanks to @​serkodev!
• refactor: make name casing detection reactive (#6173) - Thanks to @​KazariEX!

component-meta

• fix: invalidate module resolution caches when deleting files (#6163) - Thanks to @​serkodev!

tsc

• fix: make extension retry errors serializable across IPC (#6162) - Thanks to @​KazariEX!

vscode

• feat: allow disabling the welcome page (#6165) - Thanks to @​pierreedbrg!

Our Sponsors ❤️

... (truncated)

Changelog

Sourced from vue-tsc's changelog.

3.3.11 (2026-08-21)

language-core

• fix: generate full fragment props for type checking (#6155) - Thanks to @​serkodev!

language-service

• fix: invalidate tag and prop casing detection after template changes (#6172) - Thanks to @​serkodev!
• refactor: make name casing detection reactive (#6173) - Thanks to @​KazariEX!

component-meta

• fix: invalidate module resolution caches when deleting files (#6163) - Thanks to @​serkodev!

tsc

• fix: make extension retry errors serializable across IPC (#6162) - Thanks to @​KazariEX!

vscode

• feat: allow disabling the welcome page (#6165) - Thanks to @​pierreedbrg!

3.3.10 (2026-08-15)

language-core

• fix: ignore trailing whitespace after generic parameter commas - Thanks to @​KazariEX!
• fix: resolve v-for item type over generic sources (#6141) - Thanks to @​serkodev!
• fix: do not extract SFC blocks across inline Markdown code (#6145) - Thanks to @​lazerg!

language-service

• fix: serialize template data provider access across concurrent requests (#6154) - Thanks to @​serkodev!

tsc

• fix: support different extension sets across project references (#6146) - Thanks to @​lazerg!

typescript-plugin

• fix: resolve requests against the owning project (#6152) - Thanks to @​serkodev!

vscode

• feat: patch typescript.js via --require to support read-only file systems (#6149) - Thanks to @​serkodev!
• fix: isolate custom TypeScript plugin paths between profiles (#6148) - Thanks to @​serkodev!

Commits

• f521b39 v3.3.11 (#6174)
• 05ab009 fix(tsc): replace symbol retryToken with error to allow IPC serialization (...
• fd6dada fix(language-core): generate full fragment props for typecheck (#6155)
• 977995f v3.3.10 (#6160)
• cb65247 fix(tsc): support different extension sets across project references (#6146)
• See full diff in compare view

[github-actions]

⏱️ Benchmark (median ms, informational — not a gate)

Plan	Stage	Current	Baseline	Δ
BALANCED	compile	243.65	27.69	+780% ⚠️
BALANCED	parse	8.64	6.52	+32% ⚠️
BALANCED	resolve	23.50	6.20	+279% ⚠️
BALANCED	toScene	194.42	8.02	+2323% ⚠️
BALANCED	renderSvg	3.17	2.99	+6%
BALANCED	lint	78.67	7.20	+993% ⚠️
BALANCED	describe	21.14	5.73	+269% ⚠️
BALANCED	circulation	0.00	—	—
BALANCED	occupancy	0.94	—	—
ROOM_HEAVY	compile	236.14	17.15	+1277% ⚠️
ROOM_HEAVY	parse	8.26	7.67	+8%
ROOM_HEAVY	resolve	1.52	4.46	-66%
ROOM_HEAVY	toScene	216.79	0.70	+30915% ⚠️
ROOM_HEAVY	renderSvg	2.26	2.78	-19%
ROOM_HEAVY	lint	221.98	2.39	+9176% ⚠️
ROOM_HEAVY	describe	76.53	28.73	+166% ⚠️
ROOM_HEAVY	circulation	0.00	—	—
ROOM_HEAVY	occupancy	0.10	—	—
OPENING_HEAVY	compile	156.57	51.90	+202% ⚠️
OPENING_HEAVY	parse	7.98	6.60	+21%
OPENING_HEAVY	resolve	49.04	10.19	+381% ⚠️
OPENING_HEAVY	toScene	93.85	22.04	+326% ⚠️
OPENING_HEAVY	renderSvg	2.33	2.86	-18%
OPENING_HEAVY	lint	4.83	3.98	+22%
OPENING_HEAVY	describe	1.14	0.67	+71% ⚠️
OPENING_HEAVY	circulation	0.00	—	—
OPENING_HEAVY	occupancy	0.02	—	—
STUDIO	compile	5.52	—	—
STUDIO	parse	0.38	—	—
STUDIO	resolve	0.24	—	—
STUDIO	toScene	2.81	—	—
STUDIO	renderSvg	0.16	—	—
STUDIO	lint	2.91	—	—
STUDIO	describe	1.95	—	—
STUDIO	circulation	1.64	—	—
STUDIO	occupancy	0.12	—	—
MUSEUM	compile	11.01	—	—
MUSEUM	parse	0.99	—	—
MUSEUM	resolve	0.75	—	—
MUSEUM	toScene	5.93	—	—
MUSEUM	renderSvg	0.61	—	—
MUSEUM	lint	88.57	—	—
MUSEUM	describe	71.78	—	—
MUSEUM	circulation	70.58	—	—
MUSEUM	occupancy	12.26	—	—

⚠️ One or more stages regressed past the warning threshold. Timings are runner-dependent — confirm locally before acting.

[ChanMeng666]

Diagnosed rather than left red, since an unexplained failing PR is the same hazard as an unexplained failing nightly — people learn to scroll past it.

Why this fails, exactly

FAIL editors/vscode/test/stdio.test.ts [ editors/vscode/test/stdio.test.ts ]
Error: Missing "./node.js" specifier in "vscode-languageserver-protocol" package
  Plugin: vite:import-analysis

It is a collection error, not an assertion — the module never loads. Cause:

• editors/vscode/test/stdio.test.ts:47 imports from vscode-languageserver-protocol/node.js.
• The pinned 3.17.5 has no exports field at all, so that deep subpath resolves freely.
• 3.18.x adds an exports map that does not list ./node.js, so the same import stops resolving.

So this is a real API-surface change in the dependency, not a flake and not a stale lockfile. Unblocking it means changing that one import to whatever 3.18 actually exposes (the main entry, or vscode-jsonrpc/node) and confirming the stdio round-trip still runs — stdio.test.ts is the gate that proves the built extension bundle speaks LSP over stdio, so it must not be weakened to go green.

A second thing in this group worth separating

@types/vscode ^1.75.0 → ^1.134.0 is a jump of ~60 minor versions while editors/vscode/package.json's engines.vscode stays ^1.75.0. Those two are a pair: the types would then advertise APIs the declared engine does not guarantee, and nothing in the build catches that — it surfaces as a runtime failure on an older VS Code. Either both move together, deliberately, or @types/vscode stays where the engine is.

Everything else in the group is uncontroversial

vue-tsc 3.3.9→3.3.11, esbuild 0.28.1→0.28.2, vscode-languageserver-textdocument 1.0.12→1.0.14. Note the extension's own esbuild is already on ^0.28.1, i.e. past the fixed 0.28.1 for the current advisories — the remaining esbuild finding in npm audit is tsup's 0.27.7 node, which tsup@8.5.1 cannot reach, and both of those advisories are against esbuild serve, which tsup never starts.

Context

Separately, the twelve transitive advisories this repo was carrying were cleared lockfile-only in b84e336; npm audit --omit=dev now reports 0 vulnerabilities, so nothing here is blocking a security fix. The residuals and the deferred vitest 5 decision are recorded in docs/backlog.md 3.1 with written triggers.

Left open on purpose: the group is worth taking, but it needs the two items above decided rather than merged through.