Bump the minor-and-patch group with 4 updates

[dependabot]

Bumps the minor-and-patch group with 4 updates: @types/vscode, pnpm, selfsigned and typescript-eslint.

Updates @types/vscode from 1.107.0 to 1.108.1

Commits

• See full diff in compare view

Updates pnpm from 10.26.2 to 10.28.0

Release notes

Sourced from pnpm's releases.

pnpm 10.28

Minor Changes

• Add support for a hook called beforePacking that can be used to customize the package.json contents at publish time #3816.
• In some cases, a filtered install (i.e. pnpm install --filter ...) was slower than running pnpm install without any filter arguments. This performance regression is now fixed. Filtered installs should be as fast or faster than a full install #10408.

Patch Changes

• Do not add a symlink to the project into the store's project registry if the store is in a subdirectory of the project #10411.
• It should be possible to declare the requiredScripts setting in pnpm-workspace.yaml #10261.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.28.0

Minor Changes

• Add support for a hook called beforePacking that can be used to customize the package.json contents at publish time #3816.
• In some cases, a filtered install (i.e. pnpm install --filter ...) was slower than running pnpm install without any filter arguments. This performance regression is now fixed. Filtered installs should be as fast or faster than a full install #10408.

Patch Changes

• Do not add a symlink to the project into the store's project registry if the store is in a subdirectory of the project #10411.
• It should be possible to declare the requiredScripts setting in pnpm-workspace.yaml #10261.

10.27.0

Minor Changes

• Adding trustPolicyIgnoreAfter allows you to ignore trust policy checks for packages published more than a specified time ago#10352.

• Added project registry for global virtual store prune support.

  Projects using the store are now registered via symlinks in {storeDir}/v10/projects/. This enables pnpm store prune to track which packages are still in use by active projects and safely remove unused packages from the global virtual store.

• Semi-breaking. Changed the location of unscoped packages in the virtual global store. They will now be stored under a directory named @ to maintain a uniform 4-level directory depth.

• Added mark-and-sweep garbage collection for global virtual store.

  pnpm store prune now removes unused packages from the global virtual store's links/ directory. The algorithm:

  1. Scans all registered projects for symlinks pointing to the store
  2. Walks transitive dependencies to mark reachable packages
  3. Removes any package directories not marked as reachable

  This includes support for workspace monorepos - all node_modules directories within a project (including those in workspace packages) are scanned.

Patch Changes

• Throw an error if the value of the tokenHelper or <url>:tokenHelper setting contains an environment variable.
• Git dependencies with build scripts should respect the dangerouslyAllowAllBuilds settings #10376.
• Skip the package manager check when running with --global and a project packageManager is configured, and warn that the check is skipped.
• pnpm store prune should not fail if the dlx cache directory has files, not only directories #10384
• Fixed a bug (#9759) where pnpm add would incorrectly modify a catalog entry in pnpm-workspace.yaml to its exact version.

Commits

• 91a241e chore(release): 10.28.0
• a9784fb revert: "chore: upgrade qs to 6.14.1 (#10389)"
• 787ed46 chore: upgrade qs to 6.14.1 (#10389)
• 6bdba72 chore(release): 10.27.0
• 512f188 fix: git dependencies respect dangerouslyAllowAllBuilds (#10387)
• c23bdf7 feat(cli): skip package manager check when using --global option (#10368)
• 3f2c5f4 feat: add trustPolicyIgnoreAfter (#10359)
• See full diff in compare view

Updates selfsigned from 5.4.0 to 5.5.0

Commits

• bb4c2a8 5.5.0
• fddc893 feat: patch global CryptoProvider to use Node.js crypto (#84)
• a47d039 add package-lock back
• b29a4e1 add CI as gh action
• See full diff in compare view

Updates typescript-eslint from 8.50.1 to 8.53.0

Release notes

Sourced from typescript-eslint's releases.

v8.53.0

8.53.0 (2026-01-12)

🚀 Features

• eslint-plugin: [no-unused-vars] add a fixer to remove unused imports (#11922)
• eslint-plugin: add rule [strict-void-return] (#9707)
• project-service: allow passing Partial<ts.server.ServerHost> to project service (#11932)

🩹 Fixes

• eslint-plugin: replace unclear "error typed" with more helpful description (#11704)
• eslint-plugin: [no-useless-default-assignment] fix false positive for parameters corresponding to a rest parameter (#11916)
• typescript-estree: forbid type-only import with both default and named specifiers (#11930)
• typescript-estree: fix syntax check for using declaration (#11910)
• typescript-estree: forbid invalid class implements (#11934)
• typescript-estree: forbid invalid "import equals" declaration (#11936)
• typescript-estree: forbid invalid extends and implements in interface declaration (#11935)

❤️ Thank You

• auvred @​auvred
• Brad Zacher @​bradzacher
• fisker Cheung @​fisker
• Josh Goldberg
• Josh Goldberg ✨
• Kirk Waiblinger
• Niki @​phaux
• Nikita
• SungHyun627 @​SungHyun627
• Will Harney @​wjhsf

You can read about our versioning strategy and releases on our website.

v8.52.0

8.52.0 (2026-01-05)

🚀 Features

• eslint-plugin-internal: [no-multiple-lines-of-errors] add rule (#11899)
• typescript-estree: add tseslint.com redirects for CLI outputs (#11895)

🩹 Fixes

• eslint-plugin: [no-useless-default-assignment] handle conditional initializer (#11908)
• eslint-plugin: [no-base-to-string] detect @@​toPrimitive and valueOf (#11901)

❤️ Thank You

• Josh Goldberg ✨

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.53.0 (2026-01-12)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

8.52.0 (2026-01-05)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

8.51.0 (2025-12-29)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

• 3021ede chore(release): publish 8.53.0
• 9ddd571 chore(release): publish 8.52.0
• 95c7c73 chore: update deps to latest minor/patch (#11921)
• e4c57f5 chore(release): publish 8.51.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.