release: 0.20.0 (beta → main) by eFAILution · Pull Request #344 · eFAILution/gitlab-component-helper

eFAILution · 2026-10-06T15:23:44Z

Release PR for the next stable version. Merging to main cuts a stable GitHub Release straight away. The Marketplace publish is a separate manual workflow_dispatch.

What is on `beta`

PR
#325	`refactor(webview)`: render every webview document from type-checked TSX views, escaped by default
#346	`feat(component-browser)`: insert components into the existing `include:` list
#345	`chore`: GitHub Actions annotations for extension-host test failures
#347	`chore(deps-dev)`: remove unused `@octokit/core` and `@octokit/plugin-paginate-rest`
#350	`chore(deps-dev)`: preact 10.29.8 → 11.0.1
#343, #353	`chore(deps-dev)`: dev-dependency group updates (includes js-yaml 5.5.0, preact-render-to-string 6.8.1, undici 7.29.1)
#340, #348	`chore(ci)`: Argus reusable security hardening 1.12.7 → 1.12.8
#351	`chore(ci)`: dorny/test-reporter 3.0.0 → 3.2.0

User-facing changes

#346 is the one feature. Inserting a component from the browser now adds it to the file's include: list, creating the list or converting a single entry when needed, in place of dropping the snippet at the cursor.

#325 moves the Component Browser, details panel, loading, no-sources and error views to TSX rendered with preact-render-to-string. No visible change is intended. It was checked by hand in a real VS Code with no CSP violations (see #325). The preact 11 bump (#350) renders byte-identical HTML for all six views compared with preact 10.

Security

npm audit --omit=dev reports 0 vulnerabilities. The full audit reports 22 (21 high, 1 critical), all in dev tooling (release-it, stylelint, commitizen and their transitive deps). None are imported from src/, so none ship in the VSIX.

Dependabot security PR #352 (undici 7.29.1 on main) is covered here through #353.

Soak

0.19.4 (#325, #346) has been on the Marketplace pre-release channel since 2026-10-13, and 0.19.9 since 2026-10-19. No issues have been filed since 2026-10-13.

Versioning

beta is at 0.19.9. On merge, .release-it.json's requireEvenMinor rolls this to 0.20.0 for the stable channel.

Verification on `beta` tip

CI (unit, extension-host) and Security Hardening pass on 15f474e (chore(deps-dev): remove unused @octokit/core and @octokit/plugin-paginate-rest #347), the last code change on beta
npm audit --omit=dev --audit-level=high is clean, matching the publish workflow's gate

Move every webview document from template literals into TSX views rendered with preact-render-to-string. Escaping is now on by default, markup errors fail tsc, and lint bans inline styles, handlers and raw HTML outside Page.tsx.

…ith 10 updates (#343) Bumps the dev-dependencies group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.4` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.70.1` | `8.71.0` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.70.1` | `8.71.0` | | [dotenv](https://github.com/motdotla/dotenv) | `18.0.4` | `18.0.5` | | [eslint](https://github.com/eslint/eslint) | `10.11.0` | `10.12.0` | | [globals](https://github.com/sindresorhus/globals) | `17.12.0` | `17.13.0` | | [mocha](https://github.com/mochajs/mocha) | `12.0.2` | `12.0.3` | | [preact-render-to-string](https://github.com/preactjs/preact-render-to-string) | `6.7.0` | `6.8.0` | | [stylelint](https://github.com/stylelint/stylelint) | `17.15.0` | `17.16.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.70.1` | `8.71.0` | Updates `@types/node` from 26.6.2 to 26.6.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@typescript-eslint/eslint-plugin` from 8.70.1 to 8.71.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.0/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.70.1 to 8.71.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.0/packages/parser) Updates `dotenv` from 18.0.4 to 18.0.5 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v18.0.4...v18.0.5) Updates `eslint` from 10.11.0 to 10.12.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.11.0...v10.12.0) Updates `globals` from 17.12.0 to 17.13.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.12.0...v17.13.0) Updates `mocha` from 12.0.2 to 12.0.3 - [Release notes](https://github.com/mochajs/mocha/releases) - [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md) - [Commits](mochajs/mocha@v12.0.2...v12.0.3) Updates `preact-render-to-string` from 6.7.0 to 6.8.0 - [Release notes](https://github.com/preactjs/preact-render-to-string/releases) - [Changelog](https://github.com/preactjs/preact-render-to-string/blob/main/CHANGELOG.md) - [Commits](https://github.com/preactjs/preact-render-to-string/commits) Updates `stylelint` from 17.15.0 to 17.16.0 - [Release notes](https://github.com/stylelint/stylelint/releases) - [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md) - [Commits](stylelint/stylelint@17.15.0...17.16.0) Updates `typescript-eslint` from 8.70.1 to 8.71.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.71.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@typescript-eslint/parser" dependency-version: 8.71.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: dotenv dependency-version: 18.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: eslint dependency-version: 10.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: globals dependency-version: 17.13.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: mocha dependency-version: 12.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: preact-render-to-string dependency-version: 6.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: stylelint dependency-version: 17.16.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: typescript-eslint dependency-version: 8.71.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

github-actions · 2026-10-13T01:33:01Z

🛡️ Security Hardening Pipeline Results

Branch: beta
Commit: 67e8dbc

Workflow Run: 574
Branch: beta
Commit: 67e8dbc

Scan Status

Scanner	Status
`bandit`	⏭️ skipped
`checkov`	⏭️ skipped
`clamav`	⏭️ skipped
`codeql`	✅ PASS
`container`	⏭️ skipped
`dependency-review`	✅ PASS
`gitleaks`	✅ PASS
`grype`	⏭️ skipped
`lint`	⏭️ skipped
`opengrep`	⏭️ skipped
`osv`	✅ PASS
`sbom`	⏭️ skipped
`supply-chain`	⏭️ skipped
`trivy-container`	⏭️ skipped
`trivy-iac`	⏭️ skipped
`zap`	⏭️ skipped

✅ All enabled scanners completed successfully.

Summaries Collected: 4

Scanner Results

🔬 CodeQL SAST (Javascript)

Status: Completed

Findings Summary

Critical	High	Medium	Low	Total
0	0	0	0	0

No security findings detected for Javascript.

Artifacts: CodeQL Reports (Javascript)

🔗 Dependency Review

Status: ✅ No issues found

No vulnerable or license-violating dependencies detected in this PR.
📋 View full report

🔑 Gitleaks (Secrets)

No 🔑 Gitleaks (Secrets) findings summary was produced.

📦 OSV (Dependencies)

No 📦 OSV (Dependencies) findings summary was produced.

Generated by Argus

…ity-hardening.yml (#340) Bumps [huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml](https://github.com/huntridge-labs/argus) from 1.12.6 to 1.12.7. - [Release notes](https://github.com/huntridge-labs/argus/releases) - [Changelog](https://github.com/huntridge-labs/argus/blob/main/CHANGELOG.md) - [Commits](huntridge-labs/argus@3fb133a...309e971) --- updated-dependencies: - dependency-name: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml dependency-version: 1.12.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat(component-browser): insert components into the include list * Fix review comments --------- Co-authored-by: Simon Heather <simon.heather@yulife.com>

Co-authored-by: Simon Heather <simon.heather@yulife.com>

…ity-hardening.yml (#348) Bumps [huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml](https://github.com/huntridge-labs/argus) from 1.12.7 to 1.12.8. - [Release notes](https://github.com/huntridge-labs/argus/releases) - [Changelog](https://github.com/huntridge-labs/argus/blob/main/CHANGELOG.md) - [Commits](huntridge-labs/argus@309e971...cf54e58) --- updated-dependencies: - dependency-name: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml dependency-version: 1.12.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [dorny/test-reporter](https://github.com/dorny/test-reporter) from 3.0.0 to 3.2.0. - [Release notes](https://github.com/dorny/test-reporter/releases) - [Changelog](https://github.com/dorny/test-reporter/blob/main/CHANGELOG.md) - [Commits](dorny/test-reporter@a43b3a5...d1b5dff) --- updated-dependencies: - dependency-name: dorny/test-reporter dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ith 9 updates (#353) Bumps the dev-dependencies group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.5` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.71.0` | `8.71.2` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.71.0` | `8.71.2` | | [dateformat](https://github.com/felixge/node-dateformat) | `5.0.3` | `5.0.4` | | [dotenv](https://github.com/motdotla/dotenv) | `18.0.5` | `18.0.8` | | [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.2` | `5.5.0` | | [preact-render-to-string](https://github.com/preactjs/preact-render-to-string) | `6.8.0` | `6.8.1` | | [release-it](https://github.com/release-it/release-it) | `21.1.0` | `21.1.1` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.0` | `8.71.2` | Updates `@types/node` from 26.6.4 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@typescript-eslint/eslint-plugin` from 8.71.0 to 8.71.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.2/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.71.0 to 8.71.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.2/packages/parser) Updates `dateformat` from 5.0.3 to 5.0.4 - [Release notes](https://github.com/felixge/node-dateformat/releases) - [Commits](felixge/node-dateformat@v5.0.3...v5.0.4) Updates `dotenv` from 18.0.5 to 18.0.8 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v18.0.5...v18.0.8) Updates `js-yaml` from 5.4.2 to 5.5.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.4.2...5.5.0) Updates `preact-render-to-string` from 6.8.0 to 6.8.1 - [Release notes](https://github.com/preactjs/preact-render-to-string/releases) - [Changelog](https://github.com/preactjs/preact-render-to-string/blob/main/CHANGELOG.md) - [Commits](https://github.com/preactjs/preact-render-to-string/commits/v6.8.1) Updates `release-it` from 21.1.0 to 21.1.1 - [Release notes](https://github.com/release-it/release-it/releases) - [Changelog](https://github.com/release-it/release-it/blob/main/CHANGELOG.md) - [Commits](release-it/release-it@21.1.0...21.1.1) Updates `typescript-eslint` from 8.71.0 to 8.71.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.2/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.71.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@typescript-eslint/parser" dependency-version: 8.71.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: dateformat dependency-version: 5.0.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: dotenv dependency-version: 18.0.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: js-yaml dependency-version: 5.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: preact-render-to-string dependency-version: 6.8.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: release-it dependency-version: 21.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: typescript-eslint dependency-version: 8.71.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [preact](https://github.com/preactjs/preact) from 10.29.8 to 11.0.1. - [Release notes](https://github.com/preactjs/preact/releases) - [Commits](preactjs/preact@10.29.8...11.0.1) --- updated-dependencies: - dependency-name: preact dependency-version: 11.0.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…nate-rest (#347) Neither package is imported anywhere in the repo. Both date back to the initial commit. release-it keeps its own @octokit/rest dependency tree. Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>

X-Guardian and others added 2 commits October 6, 2026 10:53

chore(release): 0.19.0 [skip ci]

9910dda

eFAILution deployed to publish-beta October 6, 2026 15:29 — with GitHub Actions Active

github-actions Bot and others added 7 commits October 13, 2026 01:36

chore(release): 0.19.1 [skip ci]

16f962a

chore(release): 0.19.2 [skip ci]

1334e68

feat(component-browser): insert components into the include list (#346)

e8c8d7c

* feat(component-browser): insert components into the include list * Fix review comments --------- Co-authored-by: Simon Heather <simon.heather@yulife.com>

chore(release): 0.19.3 [skip ci]

2743e9f

chore: Add extension host test GitHub Action annotations (#345)

8b7c602

Co-authored-by: Simon Heather <simon.heather@yulife.com>

chore(release): 0.19.4 [skip ci]

453b770

eFAILution deployed to publish-beta October 13, 2026 11:18 — with GitHub Actions Active

dependabot Bot and others added 10 commits October 19, 2026 10:12

chore(release): 0.19.5 [skip ci]

14c0a27

chore(release): 0.19.6 [skip ci]

1a3bcd5

chore(release): 0.19.7 [skip ci]

8e6323f

chore(release): 0.19.8 [skip ci]

c623413

chore(release): 0.19.9 [skip ci]

526bbec

eFAILution deployed to publish-beta October 19, 2026 16:08 — with GitHub Actions Active

eFAILution changed the title ~~release: beta → main (next stable)~~ release: 0.20.0 (beta → main) Oct 21, 2026

eFAILution marked this pull request as ready for review October 21, 2026 12:17

eFAILution merged commit cab0fa6 into main Oct 21, 2026
1 check passed

Navigation Menu

Repository navigation

release: 0.20.0 (beta → main) - #344

release: 0.20.0 (beta → main)#344
eFAILution merged 20 commits into
mainfrom
beta

eFAILution commented Oct 6, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

eFAILution commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What is on beta

User-facing changes

Security

Soak

Versioning

Verification on beta tip

Uh oh!

github-actions Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛡️ Security Hardening Pipeline Results

Scan Status

Scanner Results

🔬 CodeQL SAST (Javascript)

Findings Summary

🔗 Dependency Review

🔑 Gitleaks (Secrets)

📦 OSV (Dependencies)

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

eFAILution commented Oct 6, 2026 •

edited

Loading

What is on `beta`

Verification on `beta` tip

github-actions Bot commented Oct 13, 2026 •

edited

Loading