Fix VS Code extension CLI invocation failures on PowerShell and paths with spaces#386
Conversation
## Description Adds the Svg library as a dependency, and detects svg files on manifest update-assets command, converting to a Bitmap to generate the new assets. ## Usage Example ```bash winapp manifest update-assets .\image.svg ``` ## Type of Change - ✨ New feature ## Checklist <!-- Delete the ones that do not apply to your changes --> - [X] New tests added for new functionality (if applicable) - [X] Tested locally on Windows - [ ] Main [README.md](../README.md) updated (if applicable) - [ ] [docs/usage.md](../docs/usage.md) updated (if CLI commands changed) - [ ] [Language-specific guides](../docs/guides) updated (if applicable) - [ ] [Sample projects updated](../samples) to reflect changes (if applicable) ## AI Description <!-- ai-description-start --> This PR adds support for SVG files in the asset generation process of the winapp CLI. It includes the Svg.Skia library as a dependency and allows the `manifest update-assets` command to convert SVG files into bitmap images when generating assets. This enhancement simplifies the process for developers looking to utilize SVG graphics in their applications. Usage example: ```bash winapp manifest update-assets .\image.svg ``` <!-- ai-description-end --> --------- Co-authored-by: Nikola Metulev <nmetulev@users.noreply.github.com> Co-authored-by: Nikola Metulev <711864+nmetulev@users.noreply.github.com>
…/dark them variants (#355) Expand manifest update-assets — full MRT asset coverage, ICO output, SVG direct rendering, light theme support Closes #321, closes #327 ## Summary Building on the SVG input support added in #326, this PR makes winapp manifest update-assets generate the complete set of assets that Windows (MRT) expects, adds ICO output, and introduces --light-image for light theme variants. ## What changed ### Expanded asset generation - 14 target sizes (was 5) for app icon: 16, 20, 24, 30, 32, 36, 40, 48, 60, 64, 72, 80, 96, 256 — both plated and unplated variants - 5 scale factors (was 2) for all assets: 100%, 125%, 150%, 200%, 400% - app.ico generated automatically — multi-resolution ICO (16, 24, 32, 48, 256) using PNG-encoded frames ### --light-image <path> option - Generates _altform-lightunplated variants for app icon targetsize assets - Generates _altform-colorful_theme-light variants for scale assets (tiles, store logo) - Accepts the same image as the main source (for apps with a single icon) or a separate light-optimized image ### SVG direct rendering - Introduced ImageSource abstraction that keeps SVG as vector data (SKPicture) through the entire pipeline - Each asset is rendered via SkiaSharp at the exact target size — no intermediate 1024px rasterization step - Raster inputs (PNG/JPG/ICO/BMP) continue using GDI+ bicubic scaling ### New naming convention for new projects - winapp init / manifest generate now use Microsoft's recommended names: AppList, MedTile, WideTile, StoreLogo - Existing projects keep their current names — update-assets reads names from the manifest - Dimension lookup in ManifestService recognizes both old and new naming ## Type of Change <!-- Keep the applicable line(s), delete the rest --> - ✨ New feature ## Checklist <!-- Delete the ones that do not apply to your changes --> - [x] New tests added for new functionality (if applicable) - [x] Tested locally on Windows - [x] Main [README.md](../README.md) updated (if applicable) - [x] [docs/usage.md](../docs/usage.md) updated (if CLI commands changed) - [x] Agent skill templates updated in `docs/fragments/skills/` (if CLI commands/workflows changed) --------- Co-authored-by: Nikola Metulev <711864+nmetulev@users.noreply.github.com>
## Description skiasharp was missing from msix package and generating assets from svg was broken
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.3 to 3.4.2. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/WebReflection/flatted/commit/3bf09091c3562e17a0647bc06710dd6097079cf7"><code>3bf0909</code></a> 3.4.2</li> <li><a href="https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802"><code>885ddcc</code></a> fix CWE-1321</li> <li><a href="https://github.com/WebReflection/flatted/commit/0bdba705d130f00892b1b8fcc80cf4cdea0631e3"><code>0bdba70</code></a> added flatted-view to the benchmark</li> <li><a href="https://github.com/WebReflection/flatted/commit/2a02dce7c641dec31194c67663f9b0b12e62da20"><code>2a02dce</code></a> 3.4.1</li> <li><a href="https://github.com/WebReflection/flatted/commit/fba4e8f2e113665da275b19cd0f695f3d98e9416"><code>fba4e8f</code></a> Merge pull request <a href="https://redirect.github.com/WebReflection/flatted/issues/89">#89</a> from WebReflection/python-fix</li> <li><a href="https://github.com/WebReflection/flatted/commit/5fe86485e6df7f7f34a07a2a85498bd3e17384e7"><code>5fe8648</code></a> added "when in Rome" also a test for PHP</li> <li><a href="https://github.com/WebReflection/flatted/commit/53517adbefe724fe472b2f9ebcdb01910d0ae3f0"><code>53517ad</code></a> some minor improvement</li> <li><a href="https://github.com/WebReflection/flatted/commit/b3e2a0c387bf446435fec45ad7f05299f012346f"><code>b3e2a0c</code></a> Fixing recursion issue in Python too</li> <li><a href="https://github.com/WebReflection/flatted/commit/c4b46dbcbf782326e54ea1b65d3ebb1dc7a23fad"><code>c4b46db</code></a> Add SECURITY.md for security policy and reporting</li> <li><a href="https://github.com/WebReflection/flatted/commit/f86d071e0f70de5a7d8200198824a3f07fc9c988"><code>f86d071</code></a> Create dependabot.yml for version updates</li> <li>Additional commits viewable in <a href="https://github.com/WebReflection/flatted/compare/v3.3.3...v3.4.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/winappCli/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Description update-assets now checks for existing ico files to replace --------- Co-authored-by: Nikola Metulev <711864+nmetulev@users.noreply.github.com>
Bumps [picomatch](https://github.com/micromatch/picomatch) from 4.0.3 to 4.0.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/releases">picomatch's releases</a>.</em></p> <blockquote> <h2>4.0.4</h2> <p>This is a security release fixing several security relevant issues.</p> <h2>What's Changed</h2> <ul> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4">https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/micromatch/picomatch/commit/e5474fc1a4d7991870058170407dda8a42be5334"><code>e5474fc</code></a> Publish 4.0.4</li> <li><a href="https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903"><code>4516eb5</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d"><code>5eceecd</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/0db7dd70651ca7c8265601c0442a996ed32e3238"><code>0db7dd7</code></a> Run benchmark again against latest minimatch version (<a href="https://redirect.github.com/micromatch/picomatch/issues/161">#161</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/95003777eb1c60dec09495a8231fa2ba4054d76a"><code>9500377</code></a> docs: clarify what brace expansion syntax is and isn't supported (<a href="https://redirect.github.com/micromatch/picomatch/issues/134">#134</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/2661f23eca86c8b4a2b14815b9b2b3b74bd5a171"><code>2661f23</code></a> fix typo in globstars.js test name (<a href="https://redirect.github.com/micromatch/picomatch/issues/138">#138</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/1798b07e9df59500b9cf567294d44d559032f4c7"><code>1798b07</code></a> docs: fix <code>makeRe</code> example (<a href="https://redirect.github.com/micromatch/picomatch/issues/143">#143</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/9d76bc57a03b7f57cc4ca516c8071daf632bafd8"><code>9d76bc5</code></a> chore: undocument removed options (<a href="https://redirect.github.com/micromatch/picomatch/issues/146">#146</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/e4d718bbfb47e4f030ab2612b5b04a9297fe272d"><code>e4d718b</code></a> Remove unused time-require (<a href="https://redirect.github.com/micromatch/picomatch/issues/160">#160</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/38dffeb16221cc8eb8981524fb6895dd2aaaba76"><code>38dffeb</code></a> chore(deps): pin dependencies (<a href="https://redirect.github.com/micromatch/picomatch/issues/158">#158</a>)</li> <li>Additional commits viewable in <a href="https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/winappCli/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nikola Metulev <nmetulev@users.noreply.github.com>
Bumps and [picomatch](https://github.com/micromatch/picomatch). These dependencies needed to be updated together. Updates `picomatch` from 2.3.1 to 2.3.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/releases">picomatch's releases</a>.</em></p> <blockquote> <h2>2.3.2</h2> <p>This is a security release fixing several security relevant issues.</p> <h2>What's Changed</h2> <ul> <li>fix: exception when glob pattern contains constructor by <a href="https://github.com/Jason3S"><code>@Jason3S</code></a> in <a href="https://redirect.github.com/micromatch/picomatch/pull/144">micromatch/picomatch#144</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2">https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md">picomatch's changelog</a>.</em></p> <blockquote> <h1>Release history</h1> <p><strong>All notable changes to this project will be documented in this file.</strong></p> <p>The format is based on <a href="http://keepachangelog.com/en/1.0.0/">Keep a Changelog</a> and this project adheres to <a href="http://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p> <!-- raw HTML omitted --> <ul> <li>Changelogs are for humans, not machines.</li> <li>There should be an entry for every single version.</li> <li>The same types of changes should be grouped.</li> <li>Versions and sections should be linkable.</li> <li>The latest version comes first.</li> <li>The release date of each versions is displayed.</li> <li>Mention whether you follow Semantic Versioning.</li> </ul> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <p>Changelog entries are classified using the following labels <em>(from <a href="http://keepachangelog.com/">keep-a-changelog</a></em>):</p> <ul> <li><code>Added</code> for new features.</li> <li><code>Changed</code> for changes in existing functionality.</li> <li><code>Deprecated</code> for soon-to-be removed features.</li> <li><code>Removed</code> for now removed features.</li> <li><code>Fixed</code> for any bug fixes.</li> <li><code>Security</code> in case of vulnerabilities.</li> </ul> <!-- raw HTML omitted --> <h2>4.0.0 (2024-02-07)</h2> <h3>Fixes</h3> <ul> <li>Fix bad text values in parse <a href="https://redirect.github.com/micromatch/picomatch/issues/126">#126</a>, thanks to <a href="https://github.com/connor4312"><code>@connor4312</code></a></li> </ul> <h3>Changed</h3> <ul> <li>Remove process global to work outside of node <a href="https://redirect.github.com/micromatch/picomatch/issues/129">#129</a>, thanks to <a href="https://github.com/styfle"><code>@styfle</code></a></li> <li>Add sideEffects to package.json <a href="https://redirect.github.com/micromatch/picomatch/issues/128">#128</a>, thanks to <a href="https://github.com/frandiox"><code>@frandiox</code></a></li> <li>Removed <code>os</code>, make compatible browser environment. See <a href="https://redirect.github.com/micromatch/picomatch/issues/124">#124</a>, thanks to <a href="https://github.com/gwsbhqt"><code>@gwsbhqt</code></a></li> </ul> <h2>3.0.1</h2> <h3>Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/micromatch/picomatch/commit/81cba8d4b767cab3cb29d26eb4f691eed75b73b2"><code>81cba8d</code></a> Publish 2.3.2</li> <li><a href="https://github.com/micromatch/picomatch/commit/fc1f6b69006e9435caf8fb40d8aff378bc0b7bce"><code>fc1f6b6</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/eec17aee5428a7249e9ca5adbb8a0d28fa29619b"><code>eec17ae</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/78f8ca4362d9e66cadea97b93e292f10096452ed"><code>78f8ca4</code></a> Merge pull request <a href="https://redirect.github.com/micromatch/picomatch/issues/156">#156</a> from micromatch/backport-144</li> <li><a href="https://github.com/micromatch/picomatch/commit/3f4f10eaa65bf3a52e8f2999674cd27e11fa3c9b"><code>3f4f10e</code></a> Merge pull request <a href="https://redirect.github.com/micromatch/picomatch/issues/144">#144</a> from Jason3S/jdent-object-properties</li> <li>See full diff in <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2">compare view</a></li> </ul> </details> <br /> Updates `picomatch` from 4.0.3 to 4.0.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/releases">picomatch's releases</a>.</em></p> <blockquote> <h2>2.3.2</h2> <p>This is a security release fixing several security relevant issues.</p> <h2>What's Changed</h2> <ul> <li>fix: exception when glob pattern contains constructor by <a href="https://github.com/Jason3S"><code>@Jason3S</code></a> in <a href="https://redirect.github.com/micromatch/picomatch/pull/144">micromatch/picomatch#144</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2">https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md">picomatch's changelog</a>.</em></p> <blockquote> <h1>Release history</h1> <p><strong>All notable changes to this project will be documented in this file.</strong></p> <p>The format is based on <a href="http://keepachangelog.com/en/1.0.0/">Keep a Changelog</a> and this project adheres to <a href="http://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p> <!-- raw HTML omitted --> <ul> <li>Changelogs are for humans, not machines.</li> <li>There should be an entry for every single version.</li> <li>The same types of changes should be grouped.</li> <li>Versions and sections should be linkable.</li> <li>The latest version comes first.</li> <li>The release date of each versions is displayed.</li> <li>Mention whether you follow Semantic Versioning.</li> </ul> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <p>Changelog entries are classified using the following labels <em>(from <a href="http://keepachangelog.com/">keep-a-changelog</a></em>):</p> <ul> <li><code>Added</code> for new features.</li> <li><code>Changed</code> for changes in existing functionality.</li> <li><code>Deprecated</code> for soon-to-be removed features.</li> <li><code>Removed</code> for now removed features.</li> <li><code>Fixed</code> for any bug fixes.</li> <li><code>Security</code> in case of vulnerabilities.</li> </ul> <!-- raw HTML omitted --> <h2>4.0.0 (2024-02-07)</h2> <h3>Fixes</h3> <ul> <li>Fix bad text values in parse <a href="https://redirect.github.com/micromatch/picomatch/issues/126">#126</a>, thanks to <a href="https://github.com/connor4312"><code>@connor4312</code></a></li> </ul> <h3>Changed</h3> <ul> <li>Remove process global to work outside of node <a href="https://redirect.github.com/micromatch/picomatch/issues/129">#129</a>, thanks to <a href="https://github.com/styfle"><code>@styfle</code></a></li> <li>Add sideEffects to package.json <a href="https://redirect.github.com/micromatch/picomatch/issues/128">#128</a>, thanks to <a href="https://github.com/frandiox"><code>@frandiox</code></a></li> <li>Removed <code>os</code>, make compatible browser environment. See <a href="https://redirect.github.com/micromatch/picomatch/issues/124">#124</a>, thanks to <a href="https://github.com/gwsbhqt"><code>@gwsbhqt</code></a></li> </ul> <h2>3.0.1</h2> <h3>Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/micromatch/picomatch/commit/81cba8d4b767cab3cb29d26eb4f691eed75b73b2"><code>81cba8d</code></a> Publish 2.3.2</li> <li><a href="https://github.com/micromatch/picomatch/commit/fc1f6b69006e9435caf8fb40d8aff378bc0b7bce"><code>fc1f6b6</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/eec17aee5428a7249e9ca5adbb8a0d28fa29619b"><code>eec17ae</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/78f8ca4362d9e66cadea97b93e292f10096452ed"><code>78f8ca4</code></a> Merge pull request <a href="https://redirect.github.com/micromatch/picomatch/issues/156">#156</a> from micromatch/backport-144</li> <li><a href="https://github.com/micromatch/picomatch/commit/3f4f10eaa65bf3a52e8f2999674cd27e11fa3c9b"><code>3f4f10e</code></a> Merge pull request <a href="https://redirect.github.com/micromatch/picomatch/issues/144">#144</a> from Jason3S/jdent-object-properties</li> <li>See full diff in <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/winappCli/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Updating dependencies --------- Co-authored-by: Chiara Mooney <34109996+chiaramooney@users.noreply.github.com>
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/releases">picomatch's releases</a>.</em></p> <blockquote> <h2>2.3.2</h2> <p>This is a security release fixing several security relevant issues.</p> <h2>What's Changed</h2> <ul> <li>fix: exception when glob pattern contains constructor by <a href="https://github.com/Jason3S"><code>@Jason3S</code></a> in <a href="https://redirect.github.com/micromatch/picomatch/pull/144">micromatch/picomatch#144</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2">https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md">picomatch's changelog</a>.</em></p> <blockquote> <h1>Release history</h1> <p><strong>All notable changes to this project will be documented in this file.</strong></p> <p>The format is based on <a href="http://keepachangelog.com/en/1.0.0/">Keep a Changelog</a> and this project adheres to <a href="http://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p> <!-- raw HTML omitted --> <ul> <li>Changelogs are for humans, not machines.</li> <li>There should be an entry for every single version.</li> <li>The same types of changes should be grouped.</li> <li>Versions and sections should be linkable.</li> <li>The latest version comes first.</li> <li>The release date of each versions is displayed.</li> <li>Mention whether you follow Semantic Versioning.</li> </ul> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <p>Changelog entries are classified using the following labels <em>(from <a href="http://keepachangelog.com/">keep-a-changelog</a></em>):</p> <ul> <li><code>Added</code> for new features.</li> <li><code>Changed</code> for changes in existing functionality.</li> <li><code>Deprecated</code> for soon-to-be removed features.</li> <li><code>Removed</code> for now removed features.</li> <li><code>Fixed</code> for any bug fixes.</li> <li><code>Security</code> in case of vulnerabilities.</li> </ul> <!-- raw HTML omitted --> <h2>4.0.0 (2024-02-07)</h2> <h3>Fixes</h3> <ul> <li>Fix bad text values in parse <a href="https://redirect.github.com/micromatch/picomatch/issues/126">#126</a>, thanks to <a href="https://github.com/connor4312"><code>@connor4312</code></a></li> </ul> <h3>Changed</h3> <ul> <li>Remove process global to work outside of node <a href="https://redirect.github.com/micromatch/picomatch/issues/129">#129</a>, thanks to <a href="https://github.com/styfle"><code>@styfle</code></a></li> <li>Add sideEffects to package.json <a href="https://redirect.github.com/micromatch/picomatch/issues/128">#128</a>, thanks to <a href="https://github.com/frandiox"><code>@frandiox</code></a></li> <li>Removed <code>os</code>, make compatible browser environment. See <a href="https://redirect.github.com/micromatch/picomatch/issues/124">#124</a>, thanks to <a href="https://github.com/gwsbhqt"><code>@gwsbhqt</code></a></li> </ul> <h2>3.0.1</h2> <h3>Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/micromatch/picomatch/commit/81cba8d4b767cab3cb29d26eb4f691eed75b73b2"><code>81cba8d</code></a> Publish 2.3.2</li> <li><a href="https://github.com/micromatch/picomatch/commit/fc1f6b69006e9435caf8fb40d8aff378bc0b7bce"><code>fc1f6b6</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/eec17aee5428a7249e9ca5adbb8a0d28fa29619b"><code>eec17ae</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/78f8ca4362d9e66cadea97b93e292f10096452ed"><code>78f8ca4</code></a> Merge pull request <a href="https://redirect.github.com/micromatch/picomatch/issues/156">#156</a> from micromatch/backport-144</li> <li><a href="https://github.com/micromatch/picomatch/commit/3f4f10eaa65bf3a52e8f2999674cd27e11fa3c9b"><code>3f4f10e</code></a> Merge pull request <a href="https://redirect.github.com/micromatch/picomatch/issues/144">#144</a> from Jason3S/jdent-object-properties</li> <li>See full diff in <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/winappCli/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Auto-generated version bump after releasing v0.2.1. This PR bumps the patch version in `version.json` from `0.2.1` to `0.2.2` so that prerelease builds pick up the new version number. --------- Co-authored-by: Nikola Metulev <711864+nmetulev@users.noreply.github.com>
## Description Fixes issues with github copilot plugins and agents not showing up when installed with `copilot plugin install microsoft/winappcli` ## Related Issue Fixes: #365 ## Type of Change <!-- Keep the applicable line(s), delete the rest --> - 🐛 Bug fix --------- Co-authored-by: Nikola Metulev <711864+nmetulev@users.noreply.github.com>
Changes: * Update init input steps to match CLI prompting * Switch manifest code snippet from diff to xml
…376) Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.8.11 to 0.8.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/xmldom/xmldom/releases"><code>@xmldom/xmldom</code>'s releases</a>.</em></p> <blockquote> <h2>0.8.12</h2> <p><a href="https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12">Commits</a></p> <h3>Fixed</h3> <ul> <li>preserve trailing whitespace in ProcessingInstruction data <a href="https://redirect.github.com/xmldom/xmldom/pull/962"><code>[#962](https://github.com/xmldom/xmldom/issues/962)</code></a> / <a href="https://redirect.github.com/xmldom/xmldom/issues/42"><code>[#42](https://github.com/xmldom/xmldom/issues/42)</code></a></li> <li>Security: <code>createCDATASection</code> now throws <code>InvalidCharacterError</code> when <code>data</code> contains <code>"]]>"</code>, as required by the <a href="https://dom.spec.whatwg.org/#dom-document-createcdatasection">WHATWG DOM spec</a>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li> <li>Security: <code>XMLSerializer</code> now splits CDATASection nodes whose data contains <code>"]]>"</code> into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (<code>appendData</code>, <code>replaceData</code>, <code>.data =</code>, <code>.textContent =</code>). <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li> </ul> <p>Code that passes a string containing <code>"]]>"</code> to <code>createCDATASection</code> and relied on the previously unsafe behavior will now receive <code>InvalidCharacterError</code>. Use a mutation method such as <code>appendData</code> if you intentionally need <code>"]]>"</code> in a CDATASection node's data.</p> <p>Thank you, <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>, <a href="https://github.com/stevenobiajulu"><code>@stevenobiajulu</code></a>, for your contributions</p> <p><a href="https://github.com/xmldom/xmldom/discussions/357">https://github.com/xmldom/xmldom/discussions/357</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md"><code>@xmldom/xmldom</code>'s changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12">0.8.12</a></h2> <h3>Fixed</h3> <ul> <li>preserve trailing whitespace in ProcessingInstruction data <a href="https://redirect.github.com/xmldom/xmldom/pull/962"><code>[#962](https://github.com/xmldom/xmldom/issues/962)</code></a> / <a href="https://redirect.github.com/xmldom/xmldom/issues/42"><code>[#42](https://github.com/xmldom/xmldom/issues/42)</code></a></li> <li>Security: <code>createCDATASection</code> now throws <code>InvalidCharacterError</code> when <code>data</code> contains <code>"]]>"</code>, as required by the <a href="https://dom.spec.whatwg.org/#dom-document-createcdatasection">WHATWG DOM spec</a>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li> <li>Security: <code>XMLSerializer</code> now splits CDATASection nodes whose data contains <code>"]]>"</code> into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (<code>appendData</code>, <code>replaceData</code>, <code>.data =</code>, <code>.textContent =</code>). <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li> </ul> <p>Code that passes a string containing <code>"]]>"</code> to <code>createCDATASection</code> and relied on the previously unsafe behavior will now receive <code>InvalidCharacterError</code>. Use a mutation method such as <code>appendData</code> if you intentionally need <code>"]]>"</code> in a CDATASection node's data.</p> <p>Thank you, <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>, <a href="https://github.com/stevenobiajulu"><code>@stevenobiajulu</code></a>, for your contributions</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xmldom/xmldom/commit/189cb78a83e81e1515880988a399e863a8be85ac"><code>189cb78</code></a> 0.8.12</li> <li><a href="https://github.com/xmldom/xmldom/commit/ed08df7572f4236d4fd88d16063c3fd8f59c7884"><code>ed08df7</code></a> fix: XML injection via unsafe CDATA serialization (GHSA-wh4c-j3r5-mjhp) (<a href="https://redirect.github.com/xmldom/xmldom/issues/968">#968</a>)</li> <li><a href="https://github.com/xmldom/xmldom/commit/a5b929ba008f067eeabb427c38de008e36a92796"><code>a5b929b</code></a> chore: clean up generated test artefacts before running ci-local</li> <li><a href="https://github.com/xmldom/xmldom/commit/4e37a205627a08eb64365b13c4e4cce5e86278cb"><code>4e37a20</code></a> ci: run format:check in lint job</li> <li><a href="https://github.com/xmldom/xmldom/commit/ac0ac7714f0e5a7bd7aff5c30f7733666cf03982"><code>ac0ac77</code></a> chore: ignore generated files when checking formatting</li> <li><a href="https://github.com/xmldom/xmldom/commit/968c8939438eec2eca1d003b333cd0fc4595c72d"><code>968c893</code></a> chore: add local CI script and format:check script</li> <li><a href="https://github.com/xmldom/xmldom/commit/ac40424adfa49429811095bcdaf6598255a81a39"><code>ac40424</code></a> fix: preserve trailing whitespace in ProcessingInstruction data (<a href="https://redirect.github.com/xmldom/xmldom/issues/962">#962</a>)</li> <li><a href="https://github.com/xmldom/xmldom/commit/cece7521a3c77da7a10f3fc66521e3e077c9974c"><code>cece752</code></a> chore: add .nvmrc pointing to node version 18</li> <li><a href="https://github.com/xmldom/xmldom/commit/cbf44d90a40703237d217598fa0bcd88770bfa0b"><code>cbf44d9</code></a> docs: improve links to changes in most recent release</li> <li>See full diff in <a href="https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~karfau">karfau</a>, a new releaser for <code>@xmldom/xmldom</code> since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/winappCli/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lodash/lodash/releases">lodash's releases</a>.</em></p> <blockquote> <h2>4.18.1</h2> <h2>Bugs</h2> <p>Fixes a <code>ReferenceError</code> issue in <code>lodash</code> <code>lodash-es</code> <code>lodash-amd</code> and <code>lodash.template</code> when using the <code>template</code> and <code>fromPairs</code> functions from the modular builds. See <a href="https://redirect.github.com/lodash/lodash/issues/6167#issuecomment-4165269769">lodash/lodash#6167</a></p> <p>These defects were related to how lodash distributions are built from the main branch using <a href="https://github.com/lodash-archive/lodash-cli">https://github.com/lodash-archive/lodash-cli</a>. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.</p> <p>There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:</p> <ul> <li><code>lodash</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm">https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm</a></li> <li><code>lodash-es</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es">https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es</a></li> <li><code>lodash-amd</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd">https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd</a></li> <li><code>lodash.template</code><a href="https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages">https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages</a></li> </ul> <h2>4.18.0</h2> <h2>v4.18.0</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/lodash/lodash/compare/4.17.23...4.18.0">https://github.com/lodash/lodash/compare/4.17.23...4.18.0</a></p> <h3>Security</h3> <p><strong><code>_.unset</code> / <code>_.omit</code></strong>: Fixed prototype pollution via <code>constructor</code>/<code>prototype</code> path traversal (<a href="https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh">GHSA-f23m-r3pf-42rh</a>, <a href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b">fe8d32e</a>). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now <code>constructor</code> and <code>prototype</code> are blocked unconditionally as non-terminal path keys, matching <code>baseSet</code>. Calls that previously returned <code>true</code> and deleted the property now return <code>false</code> and leave the target untouched.</p> <p><strong><code>_.template</code></strong>: Fixed code injection via <code>imports</code> keys (<a href="https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc">GHSA-r5fr-rjxr-66jc</a>, CVE-2026-4800, <a href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6">879aaa9</a>). Fixes an incomplete patch for CVE-2021-23337. The <code>variable</code> option was validated against <code>reForbiddenIdentifierChars</code> but <code>importsKeys</code> was left unguarded, allowing code injection via the same <code>Function()</code> constructor sink. <code>imports</code> keys containing forbidden identifier characters now throw <code>"Invalid imports option passed into _.template"</code>.</p> <h3>Docs</h3> <ul> <li>Add security notice for <code>_.template</code> in threat model and API docs (<a href="https://redirect.github.com/lodash/lodash/pull/6099">#6099</a>)</li> <li>Document <code>lower > upper</code> behavior in <code>_.random</code> (<a href="https://redirect.github.com/lodash/lodash/pull/6115">#6115</a>)</li> <li>Fix quotes in <code>_.compact</code> jsdoc (<a href="https://redirect.github.com/lodash/lodash/pull/6090">#6090</a>)</li> </ul> <h3><code>lodash.*</code> modular packages</h3> <p><a href="https://redirect.github.com/lodash/lodash/pull/6157">Diff</a></p> <p>We have also regenerated and published a select number of the <code>lodash.*</code> modular packages.</p> <p>These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:</p> <ul> <li><a href="https://www.npmjs.com/package/lodash.orderby">lodash.orderby</a></li> <li><a href="https://www.npmjs.com/package/lodash.tonumber">lodash.tonumber</a></li> <li><a href="https://www.npmjs.com/package/lodash.trim">lodash.trim</a></li> <li><a href="https://www.npmjs.com/package/lodash.trimend">lodash.trimend</a></li> <li><a href="https://www.npmjs.com/package/lodash.sortedindexby">lodash.sortedindexby</a></li> <li><a href="https://www.npmjs.com/package/lodash.zipobjectdeep">lodash.zipobjectdeep</a></li> <li><a href="https://www.npmjs.com/package/lodash.unset">lodash.unset</a></li> <li><a href="https://www.npmjs.com/package/lodash.omit">lodash.omit</a></li> <li><a href="https://www.npmjs.com/package/lodash.template">lodash.template</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lodash/lodash/commit/cb0b9b9212521c08e3eafe7c8cb0af1b42b6649e"><code>cb0b9b9</code></a> release(patch): bump main to 4.18.1 (<a href="https://redirect.github.com/lodash/lodash/issues/6177">#6177</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/75535f57883b7225adb96de1cfc1cd4169cfcb51"><code>75535f5</code></a> chore: prune stale advisory refs (<a href="https://redirect.github.com/lodash/lodash/issues/6170">#6170</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/62e91bc6a39c98d85b9ada8c44d40593deaf82a4"><code>62e91bc</code></a> docs: remove n_ Node.js < 6 REPL note from README (<a href="https://redirect.github.com/lodash/lodash/issues/6165">#6165</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/59be2de61f8aa9461c7856533b51d31b7d8babc4"><code>59be2de</code></a> release(minor): bump to 4.18.0 (<a href="https://redirect.github.com/lodash/lodash/issues/6161">#6161</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/af634573030f979194871da7c68f79420992f53d"><code>af63457</code></a> fix: broken tests for _.template 879aaa9</li> <li><a href="https://github.com/lodash/lodash/commit/1073a7693e1727e0cf3641e5f71f75ddcf8de7c0"><code>1073a76</code></a> fix: linting issues</li> <li><a href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6"><code>879aaa9</code></a> fix: validate imports keys in _.template</li> <li><a href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b"><code>fe8d32e</code></a> fix: block prototype pollution in baseUnset via constructor/prototype traversal</li> <li><a href="https://github.com/lodash/lodash/commit/18ba0a32f42fd02117f096b032f89c984173462d"><code>18ba0a3</code></a> refactor(fromPairs): use baseAssignValue for consistent assignment (<a href="https://redirect.github.com/lodash/lodash/issues/6153">#6153</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/b8190803d48d60b8c80ad45d39125f32fa618cb2"><code>b819080</code></a> ci: add dist sync validation workflow (<a href="https://redirect.github.com/lodash/lodash/issues/6137">#6137</a>)</li> <li>Additional commits viewable in <a href="https://github.com/lodash/lodash/compare/4.17.23...4.18.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/winappCli/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.8.11 to 0.8.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/xmldom/xmldom/releases"><code>@xmldom/xmldom</code>'s releases</a>.</em></p> <blockquote> <h2>0.8.12</h2> <p><a href="https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12">Commits</a></p> <h3>Fixed</h3> <ul> <li>preserve trailing whitespace in ProcessingInstruction data <a href="https://redirect.github.com/xmldom/xmldom/pull/962"><code>[#962](https://github.com/xmldom/xmldom/issues/962)</code></a> / <a href="https://redirect.github.com/xmldom/xmldom/issues/42"><code>[#42](https://github.com/xmldom/xmldom/issues/42)</code></a></li> <li>Security: <code>createCDATASection</code> now throws <code>InvalidCharacterError</code> when <code>data</code> contains <code>"]]>"</code>, as required by the <a href="https://dom.spec.whatwg.org/#dom-document-createcdatasection">WHATWG DOM spec</a>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li> <li>Security: <code>XMLSerializer</code> now splits CDATASection nodes whose data contains <code>"]]>"</code> into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (<code>appendData</code>, <code>replaceData</code>, <code>.data =</code>, <code>.textContent =</code>). <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li> </ul> <p>Code that passes a string containing <code>"]]>"</code> to <code>createCDATASection</code> and relied on the previously unsafe behavior will now receive <code>InvalidCharacterError</code>. Use a mutation method such as <code>appendData</code> if you intentionally need <code>"]]>"</code> in a CDATASection node's data.</p> <p>Thank you, <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>, <a href="https://github.com/stevenobiajulu"><code>@stevenobiajulu</code></a>, for your contributions</p> <p><a href="https://github.com/xmldom/xmldom/discussions/357">https://github.com/xmldom/xmldom/discussions/357</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md"><code>@xmldom/xmldom</code>'s changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12">0.8.12</a></h2> <h3>Fixed</h3> <ul> <li>preserve trailing whitespace in ProcessingInstruction data <a href="https://redirect.github.com/xmldom/xmldom/pull/962"><code>[#962](https://github.com/xmldom/xmldom/issues/962)</code></a> / <a href="https://redirect.github.com/xmldom/xmldom/issues/42"><code>[#42](https://github.com/xmldom/xmldom/issues/42)</code></a></li> <li>Security: <code>createCDATASection</code> now throws <code>InvalidCharacterError</code> when <code>data</code> contains <code>"]]>"</code>, as required by the <a href="https://dom.spec.whatwg.org/#dom-document-createcdatasection">WHATWG DOM spec</a>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li> <li>Security: <code>XMLSerializer</code> now splits CDATASection nodes whose data contains <code>"]]>"</code> into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (<code>appendData</code>, <code>replaceData</code>, <code>.data =</code>, <code>.textContent =</code>). <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li> </ul> <p>Code that passes a string containing <code>"]]>"</code> to <code>createCDATASection</code> and relied on the previously unsafe behavior will now receive <code>InvalidCharacterError</code>. Use a mutation method such as <code>appendData</code> if you intentionally need <code>"]]>"</code> in a CDATASection node's data.</p> <p>Thank you, <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>, <a href="https://github.com/stevenobiajulu"><code>@stevenobiajulu</code></a>, for your contributions</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xmldom/xmldom/commit/189cb78a83e81e1515880988a399e863a8be85ac"><code>189cb78</code></a> 0.8.12</li> <li><a href="https://github.com/xmldom/xmldom/commit/ed08df7572f4236d4fd88d16063c3fd8f59c7884"><code>ed08df7</code></a> fix: XML injection via unsafe CDATA serialization (GHSA-wh4c-j3r5-mjhp) (<a href="https://redirect.github.com/xmldom/xmldom/issues/968">#968</a>)</li> <li><a href="https://github.com/xmldom/xmldom/commit/a5b929ba008f067eeabb427c38de008e36a92796"><code>a5b929b</code></a> chore: clean up generated test artefacts before running ci-local</li> <li><a href="https://github.com/xmldom/xmldom/commit/4e37a205627a08eb64365b13c4e4cce5e86278cb"><code>4e37a20</code></a> ci: run format:check in lint job</li> <li><a href="https://github.com/xmldom/xmldom/commit/ac0ac7714f0e5a7bd7aff5c30f7733666cf03982"><code>ac0ac77</code></a> chore: ignore generated files when checking formatting</li> <li><a href="https://github.com/xmldom/xmldom/commit/968c8939438eec2eca1d003b333cd0fc4595c72d"><code>968c893</code></a> chore: add local CI script and format:check script</li> <li><a href="https://github.com/xmldom/xmldom/commit/ac40424adfa49429811095bcdaf6598255a81a39"><code>ac40424</code></a> fix: preserve trailing whitespace in ProcessingInstruction data (<a href="https://redirect.github.com/xmldom/xmldom/issues/962">#962</a>)</li> <li><a href="https://github.com/xmldom/xmldom/commit/cece7521a3c77da7a10f3fc66521e3e077c9974c"><code>cece752</code></a> chore: add .nvmrc pointing to node version 18</li> <li><a href="https://github.com/xmldom/xmldom/commit/cbf44d90a40703237d217598fa0bcd88770bfa0b"><code>cbf44d9</code></a> docs: improve links to changes in most recent release</li> <li>See full diff in <a href="https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~karfau">karfau</a>, a new releaser for <code>@xmldom/xmldom</code> since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/winappCli/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nikola Metulev <nmetulev@users.noreply.github.com>
## Description Adds winapp run command, that allows developers to pack a folder and run the application as a packaged application. ## Usage Example ```bash winapp run .\bin\Debug\net10.0-windows10.0.26100.0\win-x64 --manifest .\appxmanifest.xml ``` --> ## Related Issue Fixes #130 ## Type of Change - ✨ New feature ## Checklist <!-- Delete the ones that do not apply to your changes --> - [X] New tests added for new functionality (if applicable) - [X] Tested locally on Windows - [X] Main [README.md](../README.md) updated (if applicable) - [X] [docs/usage.md](../docs/usage.md) updated (if CLI commands changed) - [x] [Language-specific guides](../docs/guides) updated (if applicable) - [x] [Sample projects updated](../samples) to reflect changes (if applicable) ## Demo ``` dotnet new wpf winapp init dotnet run ``` Runs the app as a packaged windows app. ## AI Description <!-- ai-description-start --> The `winapp run` command has been added, which allows developers to pack a folder and run the application as a packaged application. This new command simplifies the process of launching applications in a packaged format. Usage example: ```bash winapp run .\bin\Debug\net10.0-windows10.0.26100.0\win-x64 --manifest .\appxmanifest.xml ``` <!-- ai-description-end --> --------- Co-authored-by: Nikola Metulev <nmetulev@users.noreply.github.com> Co-authored-by: Nikola Metulev <711864+nmetulev@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…r PowerShell and fix debug adapter spawn Agent-Logs-Url: https://github.com/microsoft/winappCli/sessions/a8c7f2c1-44e6-4c1c-811e-766e0f91b42b Co-authored-by: chiaramooney <34109996+chiaramooney@users.noreply.github.com>
…ron e2e (#387) Co-authored-by: Nikola Metulev <711864+nmetulev@users.noreply.github.com>
Bumps [electron](https://github.com/electron/electron) from 39.2.7 to 39.8.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/electron/electron/releases">electron's releases</a>.</em></p> <blockquote> <h2>electron v39.8.4</h2> <h1>Release Notes for v39.8.4</h1> <h2>Fixes</h2> <ul> <li>Fixed an issue where <code>nodeIntegrationInWorker</code> overrides in <code>setWindowOpenHandler</code> were not honored for child windows sharing a renderer process with their opener. <a href="https://redirect.github.com/electron/electron/pull/50468">#50468</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50163">38</a>, <a href="https://redirect.github.com/electron/electron/pull/50467">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50134">41</a>)<!-- raw HTML omitted --></li> <li>Fixed crash when handling JavaScript dialogs from windows opened with invalid or empty URLs. <a href="https://redirect.github.com/electron/electron/pull/50400">#50400</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50401">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50399">41</a>, <a href="https://redirect.github.com/electron/electron/pull/50398">42</a>)<!-- raw HTML omitted --></li> <li>Fixed improper focus tracking in BaseWindow on MacOS. <a href="https://redirect.github.com/electron/electron/pull/50338">#50338</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50337">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50340">41</a>, <a href="https://redirect.github.com/electron/electron/pull/50339">42</a>)<!-- raw HTML omitted --></li> <li>Fixed window freeze when failing to enter/exit fullscreen on macOS. <a href="https://redirect.github.com/electron/electron/pull/50341">#50341</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50344">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50343">41</a>, <a href="https://redirect.github.com/electron/electron/pull/50342">42</a>)<!-- raw HTML omitted --></li> </ul> <h2>Other Changes</h2> <ul> <li>Added support for using a proxy during yarn install. <a href="https://redirect.github.com/electron/electron/pull/50349">#50349</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50352">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50350">41</a>, <a href="https://redirect.github.com/electron/electron/pull/50351">42</a>)<!-- raw HTML omitted --></li> <li>Backported fix for 485935305. <a href="https://redirect.github.com/electron/electron/pull/50440">#50440</a></li> <li>Backported fix for 489381399. <a href="https://redirect.github.com/electron/electron/pull/50443">#50443</a></li> <li>Backported fix for chromium:475877320. <a href="https://redirect.github.com/electron/electron/pull/50436">#50436</a></li> <li>Backported fixes for 484751092, 487117772. <a href="https://redirect.github.com/electron/electron/pull/50461">#50461</a></li> </ul> <h2>electron v39.8.3</h2> <h1>Release Notes for v39.8.3</h1> <h2>Fixes</h2> <ul> <li>Added additional ASAR support to additional <code>fs</code> copy methods. <a href="https://redirect.github.com/electron/electron/pull/50284">#50284</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50287">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50286">41</a>, <a href="https://redirect.github.com/electron/electron/pull/50285">42</a>)<!-- raw HTML omitted --></li> <li>Fixed user resizing of transparent windows on win32 platform. <a href="https://redirect.github.com/electron/electron/pull/50300">#50300</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50301">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50298">41</a>, <a href="https://redirect.github.com/electron/electron/pull/50299">42</a>)<!-- raw HTML omitted --></li> </ul> <h2>electron v39.8.2</h2> <h1>Release Notes for v39.8.2</h1> <h2>Other Changes</h2> <ul> <li>Backported fix for b/491421267. <a href="https://redirect.github.com/electron/electron/pull/50230">#50230</a></li> </ul> <h2>electron v39.8.1</h2> <h1>Release Notes for v39.8.1</h1> <h2>Fixes</h2> <ul> <li>Added validation to protocol client methods to reject protocol names that do not conform to the RFC 3986 URI scheme grammar. <a href="https://redirect.github.com/electron/electron/pull/50156">#50156</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50157">38</a>, <a href="https://redirect.github.com/electron/electron/pull/50158">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50155">41</a>)<!-- raw HTML omitted --></li> <li>Fixed an issue on macOS where calling <code>autoUpdater.quitAndInstall()</code> could fail if <code>checkForUpdates()</code> was called again after an update was already downloaded. <a href="https://redirect.github.com/electron/electron/pull/50215">#50215</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50216">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50217">41</a>)<!-- raw HTML omitted --></li> <li>Fixed an issue where Chrome Devtools menus may not appear in certain embedded windows. <a href="https://redirect.github.com/electron/electron/pull/50136">#50136</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50138">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50137">41</a>)<!-- raw HTML omitted --></li> <li>Fixed an issue where <code>additionalData</code> passed to <code>app.requestSingleInstanceLock</code> on Windows could be truncated or fail to deserialize in the primary instance's <code>second-instance</code> event. <a href="https://redirect.github.com/electron/electron/pull/50174">#50174</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50177">38</a>, <a href="https://redirect.github.com/electron/electron/pull/50162">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50154">41</a>)<!-- raw HTML omitted --></li> <li>Fixed an issue where <code>screen.getCursorScreenPoint()</code> crashed on Wayland when it was called before a <code>BrowserWindow</code> had been created. <a href="https://redirect.github.com/electron/electron/pull/50106">#50106</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50104">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50105">41</a>)<!-- raw HTML omitted --></li> <li>Fixed an issue where calling <code>setBounds</code> on a <code>WebContentsView</code> could trigger redundant <code>page-favicon-updated</code> events even when the favicon had not changed. <a href="https://redirect.github.com/electron/electron/pull/50086">#50086</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50084">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50085">41</a>)<!-- raw HTML omitted --></li> <li>Fixed an issue where invalid characters in custom protocol or webRequest response header values were not rejected. <a href="https://redirect.github.com/electron/electron/pull/50129">#50129</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50130">38</a>, <a href="https://redirect.github.com/electron/electron/pull/50131">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50132">41</a>)<!-- raw HTML omitted --></li> <li>Fixed an issue where permission and device-chooser handlers received the top-level page origin instead of the requesting subframe's origin. <a href="https://redirect.github.com/electron/electron/pull/50147">#50147</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50151">38</a>, <a href="https://redirect.github.com/electron/electron/pull/50149">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50148">41</a>)<!-- raw HTML omitted --></li> <li>Fixed an issue where traffic light buttons would flash at position (0,0) when restoring a window with a custom <code>trafficLightPosition</code> from minimization on macOS. <a href="https://redirect.github.com/electron/electron/pull/50208">#50208</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50207">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50209">41</a>)<!-- raw HTML omitted --></li> <li>Fixed bug where opening a message box immediately upon closing a child window may cause the parent window to freeze on Windows. <a href="https://redirect.github.com/electron/electron/pull/50190">#50190</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50189">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50191">41</a>)<!-- raw HTML omitted --></li> <li>Fixed menu bar hiding after a call to <code>win.setFullScreen(false)</code> when not in fullscreen on Linux. <a href="https://redirect.github.com/electron/electron/pull/49995">#49995</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/49994">40</a>, <a href="https://redirect.github.com/electron/electron/pull/49996">41</a>)<!-- raw HTML omitted --></li> <li>Fixed shutdown crash on windows when hidden titlebar is enabled. <a href="https://redirect.github.com/electron/electron/pull/50054">#50054</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50053">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50055">41</a>)<!-- raw HTML omitted --></li> <li>Reverted AltGr key fix that caused menu bar to no longer show on Windows. <a href="https://redirect.github.com/electron/electron/pull/50109">#50109</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50110">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50111">41</a>)<!-- raw HTML omitted --></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/electron/electron/commit/7007907df08d02da98f513dcbdb430ab51be59c7"><code>7007907</code></a> chore: cherry-pick 3 changes from chromium (<a href="https://redirect.github.com/electron/electron/issues/50461">#50461</a>)</li> <li><a href="https://github.com/electron/electron/commit/2c8b6ee0c0a7c26871dc0b320982afd8ed29df6c"><code>2c8b6ee</code></a> chore: cherry-pick fbfb27470bf6 from chromium (<a href="https://redirect.github.com/electron/electron/issues/50436">#50436</a>)</li> <li><a href="https://github.com/electron/electron/commit/4c64377ead6b53bc565d7793a2712e49882e5354"><code>4c64377</code></a> chore: cherry-pick 50b057660b4d from chromium (<a href="https://redirect.github.com/electron/electron/issues/50440">#50440</a>)</li> <li><a href="https://github.com/electron/electron/commit/0ef056130cde0c19c81ccfbc2932df6911765849"><code>0ef0561</code></a> fix: read nodeIntegrationInWorker from per-frame WebPreferences (<a href="https://redirect.github.com/electron/electron/issues/50122">#50122</a>) (<a href="https://redirect.github.com/electron/electron/issues/50">#50</a>...</li> <li><a href="https://github.com/electron/electron/commit/64373df3ca697bc6fe6e3ab1f463ba05beaf64cf"><code>64373df</code></a> chore: cherry-pick 074d472db745 from chromium (<a href="https://redirect.github.com/electron/electron/issues/50443">#50443</a>)</li> <li><a href="https://github.com/electron/electron/commit/13e44072be367f516cfad36f95d183765174f4bf"><code>13e4407</code></a> fix: don't re-parse URL unnecessarily when handling dialogs (<a href="https://redirect.github.com/electron/electron/issues/50400">#50400</a>)</li> <li><a href="https://github.com/electron/electron/commit/16a038502a4ea0c79976be60bcc8f28a49f1ab99"><code>16a0385</code></a> ci: output build cache hit rate as GHA annotation (<a href="https://redirect.github.com/electron/electron/issues/50369">#50369</a>)</li> <li><a href="https://github.com/electron/electron/commit/00a492d2822fea0d57c282c6362f755a738d230c"><code>00a492d</code></a> chore: Respect HTTP(S) proxy env variable for Yarn (<a href="https://redirect.github.com/electron/electron/issues/50349">#50349</a>)</li> <li><a href="https://github.com/electron/electron/commit/290a77b8436ec92a44efe9ec9ce4961969f3e2c2"><code>290a77b</code></a> fix: correctly track BaseWindow::IsActive() on MacOS (<a href="https://redirect.github.com/electron/electron/issues/50338">#50338</a>)</li> <li><a href="https://github.com/electron/electron/commit/87baa17e653a118d83926875d323a48c81c5b9ed"><code>87baa17</code></a> fix: ensure WebContents::WasShown runs when window is shown (<a href="https://redirect.github.com/electron/electron/issues/50341">#50341</a>)</li> <li>Additional commits viewable in <a href="https://github.com/electron/electron/compare/v39.2.7...v39.8.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/winappCli/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/winappCli/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nikola Metulev <nmetulev@users.noreply.github.com>
Bumps [electron](https://github.com/electron/electron) from 39.8.4 to 39.8.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/electron/electron/releases">electron's releases</a>.</em></p> <blockquote> <h2>electron v39.8.5</h2> <h1>Release Notes for v39.8.5</h1> <h2>Fixes</h2> <ul> <li>Fixed a crash in <code>clipboard.readImage()</code> when the clipboard contains malformed image data. <a href="https://redirect.github.com/electron/electron/pull/50493">#50493</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50491">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50492">41</a>, <a href="https://redirect.github.com/electron/electron/pull/50494">42</a>)<!-- raw HTML omitted --></li> <li>Fixed a crash when calling an offscreen shared texture's <code>release()</code> after the texture object was garbage collected. <a href="https://redirect.github.com/electron/electron/pull/50499">#50499</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50500">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50501">41</a>, <a href="https://redirect.github.com/electron/electron/pull/50502">42</a>)<!-- raw HTML omitted --></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/electron/electron/commit/9d2f8cb4da0d35e2daf7e7f60e35313b508cb224"><code>9d2f8cb</code></a> refactor: remove dead named-window lookup from guest-window-manager (<a href="https://redirect.github.com/electron/electron/issues/50498">#50498</a>)</li> <li><a href="https://github.com/electron/electron/commit/11730047394233e70743c52567e17f4c3b2dc9fc"><code>1173004</code></a> fix: crash calling OSR shared texture release() after texture GC'd (<a href="https://redirect.github.com/electron/electron/issues/50499">#50499</a>)</li> <li><a href="https://github.com/electron/electron/commit/be37adefd08f882e3f1fb8403d2d9e92c3009d56"><code>be37ade</code></a> fix: crash in clipboard.readImage() on malformed image data (<a href="https://redirect.github.com/electron/electron/issues/50493">#50493</a>)</li> <li>See full diff in <a href="https://github.com/electron/electron/compare/v39.8.4...v39.8.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/winappCli/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
|
@copilot please update the PR description to use the PR description template for this repo. Also please resolve the merge conflicts. |
Build Metrics ReportBinary Sizes
Test Results✅ 0 passed out of 0 tests in 0.0s (-647 tests, -387.5s vs. baseline) Updated 2026-04-06 17:58:46 UTC · commit |
Co-authored-by: chiaramooney <34109996+chiaramooney@users.noreply.github.com>
Merge conflicts are resolved — merged the latest For the PR description, the GitHub API is blocked in this agent environment so I can't update the body directly. Here is the content using the repo template that should be applied: DescriptionFixes WinApp CLI commands failing when invoked through the VS Code extension. The debug adapter ( Usage Example# Before - ParserError in PowerShell:
"c:\Users\user\.vscode\extensions\winapp-0.2.0\bin\win-arm64\winapp.exe" get-winapp-path --global
# After - works correctly:
& "c:\Users\user\.vscode\extensions\winapp-0.2.0\bin\win-arm64\winapp.exe" get-winapp-path --globalRelated IssueFixes #385 Type of Change
Checklist
Screenshots / DemoN/A — behavior fix, no visual changes. Additional NotesTwo fixes in
AI DescriptionThis section is auto-generated by AI when the PR is opened or updated. To opt out, delete this entire section including the marker comments. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
|
@copilot Your base branch should have been alzollin/vsc but it looks like you began with a checkout from main. Please adjust this PR to use alzollin/vsc as the base branch. You may need to revert all of your changes so your branch exactly matches alzollin/vsc and then reapply your fixes. |
Co-authored-by: chiaramooney <34109996+chiaramooney@users.noreply.github.com>
Co-authored-by: chiaramooney <34109996+chiaramooney@users.noreply.github.com>
Agent-Logs-Url: https://github.com/microsoft/winappCli/sessions/0bf29d6f-3664-4505-9512-545ca57dd566 Co-authored-by: chiaramooney <34109996+chiaramooney@users.noreply.github.com>
Co-authored-by: chiaramooney <34109996+chiaramooney@users.noreply.github.com>
Co-authored-by: chiaramooney <34109996+chiaramooney@users.noreply.github.com>
Done. The PR now targets |
WinApp CLI commands routed through the VS Code extension fail in PowerShell terminals due to missing
&call operator, and the debug adapter'sspawncall breaks when the extension path contains spaces.Changes
Terminal commands — PowerShell
&operator (runWinappCommand): PowerShell treats a bare quoted string as an expression, not an invocation. Prefix with&so it executes:Debug adapter — replace shell string with args array (
WinAppDebugAdapterFactory): The adapter was joining all args into a single string and spawning withshell: true, which silently breaks whenwinapp.exelives under a path with spaces (e.g.C:\Users\John Smith\...). Switch tospawn(cliPath, spawnArgs, { shell: false })so the OS receives the executable path and arguments directly, with no shell parsing involved:Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/repos/microsoft/winappCli/pulls/386/usr/bin/curl curl -s -X PATCH -H Accept: application/vnd.github.v3+json -H Authorization: ****** REDACTED -d {"base": "alzollin/vsc"} sh -c s/REDACTED/win32_window.cpp(http block)If you need me to access, download, or install something from one of these locations, you can either: