chore(deps): update dependency ovsx to v1.3.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ovsx (source)	1.2.0 → 1.3.0

---

Release Notes

eclipse-openvsx/openvsx (ovsx)

v1.3.0

Compare Source

Changed

• publish checks a package against the size limit that applies to its own namespace, which a size override can raise above the registry default, and refuses an oversized upload before sending it. Against a registry older than 1.3.0, which cannot report that limit, it warns against the default and publishes anyway; if a registry that should be able to report it does not answer, it says the check did not happen rather than passing silently (#​2129)

Fixed

• --version reads the version from package.json at runtime instead of a generated src/version.ts, so it can no longer report a stale version (#​2295)
• publish now deletes the .vsix it packages into the temp directory once publishing finishes or fails, instead of leaving one behind per package and target (#​2286)
• Drop the X-OpenVSX-Token header, which carries the personal access token when --username/--password are set, on a redirect to another origin, as is done for Authorization (#​2309)
• A request with a body that is redirected with 301/302/303 now fails with an error naming the redirect target, instead of being resent as a GET without its body (#​2309)
• Trusted publishing's OIDC ID token request now uses the registry client's request handling: it follows redirects (dropping the runner token on a redirect to another origin) and reports the token service's error message instead of only its status (#​2322)
• An HTML page in a successful response (any <!doctype html> casing, or a text/html Content-Type) now fails with an error naming the status, instead of printing the raw HTML or a JSON SyntaxError (#​2326)
• An error response whose JSON body starts with whitespace now reports the server's message instead of only its status (#​2326)

Dependencies

• Bump commander from 6.2.1 to 14.0.3; a command given more arguments than it takes now fails instead of ignoring the extras (#​2294)
• Bump @​vscode/vsce from 3.7.1 to 4.0.0 (#​2288)
• Bump vitest from 4.1.11 to 5.0.3, adding vite as a direct dev dependency - vitest 5 no longer bundles it, only requires it as a peer (#​2291)
• Remove leven; the command-suggestion distance check now uses a vendored Levenshtein implementation, the same way @vscode/vsce itself replaced its own leven dependency in 4.0.0 (#​2290)
• Remove tmp; temporary file names are now generated with crypto.randomUUID (#​2284)
• Remove follow-redirects; requests use node:http/node:https and the registry client follows redirects itself (#​2309)
• Bump ip-address from 10.4.0 to 10.7.2 (#​2264)
• Bump brace-expansion to 1.1.21, 2.1.7, 5.0.12
• Bump markdown-it from 14.2.0 to 14.3.2 (#​2281)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.