[data-douser]

This pull request updates several dependencies across the Go client, server, and VSCode extension to their latest patch or minor versions. These updates improve compatibility, address potential bugs, and ensure the project benefits from the latest features and fixes in third-party libraries. No functional or code logic changes are introduced—these are dependency and tooling updates only.

Dependency updates:

Go client dependency updates

• Updated the Go version to 1.26.0 and bumped several dependencies in client/go.mod, including github.com/cli/go-gh/v2, github.com/mark3labs/mcp-go, github.com/lucasb-eyer/go-colorful, github.com/santhosh-tekuri/jsonschema/v6, and various golang.org/x libraries. [1] [2]

Server dependency updates

• Updated dependencies in server/package.json, including adm-zip, js-yaml, and multiple devDependencies such as @types/node, @vitest/coverage-v8, eslint, prettier, typescript-eslint, and vitest.

VSCode extension dependency updates

• Updated devDependencies in extensions/vscode/package.json, including @types/node, @vitest/coverage-v8, @vscode/vsce, eslint, mocha, prettier, typescript-eslint, and vitest.

Root JavaScript tooling updates

• Updated root-level devDependencies in package.json, including eslint, prettier, and typescript-eslint.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 1 packages with OpenSSF Scorecard issues.

View full job summary

[Copilot]

Copilot review overview

🟡 Changes recommended

Dependency override mismatches and missing documentation/source-map updates remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 · 1

Open (2)

• Update Node types override and regenerate lockfile · New
• Document dependency changes in CHANGELOG.md · New

What changed in this PR

Prepares v2.27.1 by refreshing Go, server, VS Code extension, and root JavaScript dependencies.

Changes:

• Updates Go version and client modules.
• Updates npm runtime and development dependencies.
• Regenerates the server dependency bundle.

File	Summary
server/​package.json	Server dependency and tooling updates
server/​dist/​codeql-development-mcp-server.js	Regenerated server bundle
package.json	Root JavaScript tooling updates
extensions/​vscode/​package.json	VS Code extension tooling updates
client/​go.sum	Updated Go checksums
client/​go.mod	Go version and client dependency updates

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Dependency override and lockfile inconsistencies must be corrected before approval.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 · 2

Open (3)

• Align Node types override and lockfile with extension dependency bump · New
• Changelog omits VS Code and root tooling dependency updates · New
• Document dependency changes in CHANGELOG.md

Resolved since last review (1)

• Update Node types override and regenerate lockfile

[Copilot]

Copilot review overview

🔵 Needs a closer look

Resolve the missing source map, dependency override, major-version validation, and Go prerequisite documentation issues.

Review effort: Lite
Findings: 1

Open (1)

• Align Node types override and lockfile with extension dependency bump

Resolved since last review (2)

• Changelog omits VS Code and root tooling dependency updates
• Document dependency changes in CHANGELOG.md