build(deps-dev): Bump the vscode-extension group across 1 directory with 4 updates

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
   "name": "devcontainer-builder",
-  "image": "mcr.microsoft.com/devcontainers/typescript-node:1-20-bookworm",
+  "image": "mcr.microsoft.com/devcontainers/typescript-node:26-trixie",
   "features": {
     "ghcr.io/devcontainers/features/terraform:1": {},
     "ghcr.io/devcontainers/features/kubectl-helm-minikube:1": {

.devcontainer/postCreateCommand.sh

@@ -22,14 +22,6 @@ fi
 
 arch="$(dpkg --print-architecture)"
 
-# --- Node 20 + npm + git --------------------------------------------------
-# devcontainer.json's `image` is supposed to already provide these
-# (mcr.microsoft.com/devcontainers/typescript-node:1-20-bookworm) - this
-# call is a fast no-op there. It only does real work when the workspace
-# actually booted from something else (e.g. a Coder Workspace Template not
-# overriding its image), which otherwise breaks every npm-based step below.
-bash "$(dirname "${BASH_SOURCE[0]}")/typescript-node.sh"
-
 # --- Timezone -------------------------------------------------------------
 # In the workspace, devcontainer.json's containerEnv already sets TZ.
 tz="America/Los_Angeles"

.devcontainer/updateContentCommand.sh

@@ -8,8 +8,8 @@
 set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")/.."
 
-# npx fails with ENOENT when npm's global prefix has no lib/ (e.g. the
-# ~/.npm-global prefix typescript-node.sh sets, persisted in $HOME).
+# npx fails with ENOENT when npm's global prefix has no lib/ (e.g. a
+# ~/.npm-global prefix an older setup left in the persisted $HOME).
 mkdir -p "$(npm config get prefix)/lib"
 
 # Only when a pinned skill is missing: the restore downloads every skill

.github/workflows/ci.yaml

@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "24"
+          node-version: "26"
       - run: npm install
       - run: npm run build
       # Fast, cluster-free tests of the pure logic - the BDD suite
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "24"
+          node-version: "26"
       - run: npm install
       - run: npm run build
       - run: npm test

.github/workflows/docs.yaml

@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "24"
+          node-version: "26"
       - run: npm install
       - run: npm run build
       # Generates docs/openapi.json (repo root) and its two rendered

.github/workflows/release.yaml

@@ -96,7 +96,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "24"
+          node-version: "26"
           registry-url: "https://registry.npmjs.org"
       # Node 20's own bundled npm (10.x) predates Trusted Publishing
       # support - bump to a real minimum here rather than "latest", so a
@@ -208,7 +208,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "24"
+          node-version: "26"
       - run: npm ci
       - run: npm version --no-git-tag-version --allow-same-version "${{ needs.version.outputs.version }}"
       - run: npm run build
@@ -232,7 +232,7 @@ jobs:
     steps:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "24"
+          node-version: "26"
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode-extension
@@ -252,7 +252,7 @@ jobs:
     steps:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "24"
+          node-version: "26"
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vscode-extension

CHANGELOG.md

@@ -66,9 +66,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ### Changed
 
+- **Breaking:** **Extension: requires VS Code 1.140 or newer** (was 1.90), to build against current
+  VS Code APIs. Editors on an older VS Code base can keep using 0.5.0.
 - **Breaking:** **Template: `hostRequirements` are minimums**, as in the Dev Container spec, instead of overriding
-- **Image: Node 24 LTS** (was Node 20, end-of-life since April 2026), base image pinned by digest.
-  The npm package's `engines` is now `node >=22`.
+- **Breaking:** **Image: Node 26** (was Node 20, end-of-life since April 2026), on Debian trixie,
+  base image pinned by digest. The npm package's `engines` is now `node >=26`.
 - **Image: `@devcontainers/cli` pinned to 0.89.0** (`DEVCONTAINERS_CLI_VERSION` build arg), the
   version the service is checked against, instead of whatever was latest at build time.
 - **Image: `tini` is PID 1**, so exited `git`/`ssh`/`buildx` children are reaped and signals reach

docs/project/installing.md

@@ -10,12 +10,12 @@ Opening this repo in the provided
 everything below for free — its `postCreateCommand.sh` installs Helm,
 Terraform, the GitHub CLI, `kubectl`, the Docker CLI + `buildx` plugin,
 and the `@devcontainers/cli`, on top of the base
-`mcr.microsoft.com/devcontainers/typescript-node:1-20-bookworm` image
-(Node 20 already included). Versions are deliberately unpinned there,
+`mcr.microsoft.com/devcontainers/typescript-node:26-trixie` image
+(Node 26 already included). Versions are deliberately unpinned there,
 matching CI's own unpinned `setup-helm`/`setup-terraform` actions.
 
-Outside a Dev Container, you need real, working installs of: Node 22 or
-newer (the image runs Node 24, the current LTS),
+Outside a Dev Container, you need real, working installs of: Node 26 or
+newer (what the image runs),
 Docker CLI with the `buildx` plugin, `@devcontainers/cli`, and `git` —
 the same set `service/Dockerfile` installs into the deployable image
 itself.
@@ -52,8 +52,8 @@ var/settings-file field is identical either way — see
 
 ### The container image
 
-`service/Dockerfile` has two build targets, sharing one runtime base: Node 24
-(`node:24-bookworm-slim`, pinned by digest), `git`, the Docker CLI +
+`service/Dockerfile` has two build targets, sharing one runtime base: Node 26
+(`node:26-trixie-slim`, pinned by digest), `git`, the Docker CLI +
 `buildx` plugin (no `dockerd`, see
 [0001](../decisions/0001-remote-buildkit-builder.md)), `@devcontainers/cli`
 pinned to the version the service is checked against

docs/project/testing.md

@@ -49,12 +49,6 @@ manifests, indexes and config blobs, `DELETE`, redirected blobs, and an
 `serviceConfig.insecureRegistries` so the client uses plain http.
 `src/testing/` is excluded from the `tsc` build, so none of it ships.
 
-!!! note "`test:coverage` needs Node 22.5 or newer"
-    It uses `--test-coverage-include`/`--test-coverage-exclude`, which
-    Node 22.5 added. CI runs Node 24. On older Node, run
-    `node --import tsx --test --experimental-test-coverage src/*.test.ts`
-    instead (that table also lists the test files).
-
 ## Prerequisites
 
 - A real, reachable Kubernetes cluster, with `kubectl`'s current context

service/Dockerfile

@@ -1,9 +1,9 @@
 # syntax=docker/dockerfile:1
 
-# Node 24 (Active LTS). Pinned by digest for reproducible builds - the tag
+# Node 26. Pinned by digest for reproducible builds - the tag
 # is kept alongside for readability; bump both together (the digest is the
 # multi-arch index from `docker buildx imagetools inspect node:<tag>`).
-ARG NODE_IMAGE=node:24-bookworm-slim@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+ARG NODE_IMAGE=node:26-trixie-slim@sha256:930557a230abacbc3f4fd9b8648abf8f4bee1e17cb72195dcdfb2f709bc85b33
 
 FROM ${NODE_IMAGE} AS runtime-base
 

service/package.json

@@ -16,7 +16,7 @@
     "kubernetes"
   ],
   "engines": {
-    "node": ">=22"
+    "node": ">=26"
   },
   "type": "module",
   "bin": {
@@ -55,7 +55,7 @@
   "devDependencies": {
     "@cucumber/cucumber": "^12.2.0",
     "@redocly/cli": "^2.53.2",
-    "@types/node": "^20.14.0",
+    "@types/node": "^26.6.4",
     "thomas": "github:DeepSpaceCartel/thomas#bc54f0cd85be7bf6f54bddd102bd6a784c0a7bc1",
     "tsx": "^4.19.0",
     "typescript": "^5.6.0"

vscode-extension/CHANGELOG.md

@@ -23,6 +23,8 @@ adheres to [Semantic Versioning](https://semver.org/).
 
 ### Changed
 
+- **Breaking:** **Extension: requires VS Code 1.140 or newer** (was 1.90), to build against current
+  VS Code APIs. Editors on an older VS Code base can keep using 0.5.0.
 - `devcontainerBuilder.coderUrl` and `devcontainerBuilder.template` are user settings only
   (application scope); a folder's `.vscode/settings.json` no longer sets them.
 - `devcontainerBuilder.checkIntervalMinutes` is at most 1440 (a day).