feat/fix: auto-detect dependencies for foreign managers, make vsce self-contained, and add --no-prepublish

[Mopsgamer]

Issues

• Fixes Feature Request: Add support for Bun package manager #1108.
• Refs Support pnpm #421. Fixes if you're bundling.
• Refs Support yarn v2 #517. Fixes if you're bundling.
• Refs The ls command does not respect the options in the manifest #1213. I'm not trying to use npm's arborist here anymore.
• Fixes Use libnpmversion instead of execing npm version #972.

Some issues were prefixed with "fixes", and now they are "refs".

Summary

Fixes: vsce pack, dependencies (unblocks foreign managers)
Features: makes vsce self-contained, --no-prepublish.

100% backward compatibility.

Fixes

vsce pack (aliasing)

• This PR fixes a race condition (I have no idea how it works):

The problem was the return Promise.all(promises).then(util.flatten) line. It's replaced with await + return arr.flat().
This problem is real: #1257 (comment)

dependencies

• Now the npm/yarn list takes dependencies into account and uses an auto-detection for undefined. undefined is an equivalent for auto, it is not set to a boolean value as a fallback.
  • README.md

It ensures the flag is enabled automatically when there is a node_modules/ vscodeignore pattern, or a package manager other than npm/yarn1 is detected.

Note

Lockfile lookup order and logic can be found in npm.ts.

• Enables support for pnpm, modern yarn (Berry, ZPM), vlt, bun, and other alternative package managers.

It's not a resolution algorithm. We are just assuming that users bundle their dependencies and they don't need node_modules prod deps in their vsix. dependencies is used for packaging this directory, so we are simply disabling this option.

dependencies: true will force npm/yarn list and node_modules prod deps, even if a foreign package manager is detected.

Features

vscode:prepublish

• New CLI flag, --no-prepublish, skips vscode:prepublish.

  • README.md

• @npmcli/run-script replaces exec(npm run vscode:prepublish)

versionBump()

• Replaced the exec(npm version)-based versionBump implementation with a 'libnpmversion'-based one to make vsce self-contained.

[Mopsgamer]

Before

Details

user@DESKTOP-NKNOS3C ~/D/G/dracula-highlighting (main)> time node node_modules/vsce/vsce package
 DONE  Packaged: C:\Users\user\Documents\GitHub\dracula-highlighting\dracula-highlighting-0.1.0.vsix (16 files, 79.47KB)

________________________________________________________
Executed in    3.06 secs      fish           external
   usr time   46.00 millis    0.00 micros   46.00 millis
   sys time   15.00 millis    0.00 micros   15.00 millis

user@DESKTOP-NKNOS3C ~/D/G/dracula-highlighting (main)> node node_modules/vsce/vsce pack
Usage: vsce <command>

Options:
  -V, --version                      output the version number
  -h, --help                         display help for command

Commands:
  ls [options]                       Lists all the files that will be published
  package [options] [version]        Packages an extension
  publish [options] [version]        Publishes an extension
  unpublish [options] [extensionid]  Unpublishes an extension. Example extension id: microsoft.csharp.
  ls-publishers                      List all known publishers
  delete-publisher <publisher>       Deletes a publisher
  login <publisher>                  Add a publisher to the known publishers list
  logout <publisher>                 Remove a publisher from the known publishers list
  verify-pat [options] [publisher]   Verify if the Personal Access Token has publish rights for the publisher.
  show [options] <extensionid>       Show extension metadata
  search [options] <text>            search extension gallery
  help [command]                     display help for command

Unknown command 'pack'.

After

Details

ser@DESKTOP-NKNOS3C ~/D/G/dracula-highlighting (main) [1]> time node ../vscode-vsce/vsce package
 INFO  Detected presence of bun.lock. Using 'bun' logic.
 INFO  Files included in the VSIX:
dracula-highlighting-0.1.0.vsix
├─ [Content_Types].xml
├─ extension.vsixmanifest
└─ extension/
   ├─ LICENSE.txt [1.1 KB]
   ├─ package.json [1.79 KB]
   ├─ readme.md [1.74 KB]
   ├─ assets/
   │  └─ icon.png [10.08 KB]
   └─ themes/
      ├─ abyss-dracula.json [58.82 KB]
      ├─ dark-2026-dracula.json [58.67 KB]
      ├─ dark-dracula.json [17.61 KB]
      ├─ dark-high-contrast-dracula.json [58.24 KB]
      ├─ dark-modern-dracula.json [22.05 KB]
      ├─ kimbie-dark-dracula.json [58.94 KB]
      ├─ monokai-dimmed-dracula.json [18.86 KB]
      ├─ monokai-dracula.json [20.13 KB]
      ├─ solarized-dark-dracula.json [20.12 KB]
      └─ tomorrow-night-blue-dracula.json [58.95 KB]

 DONE  Packaged: C:\Users\user\Documents\GitHub\dracula-highlighting\dracula-highlighting-0.1.0.vsix (16 files, 79.49 KB)

________________________________________________________
Executed in    1.90 secs      fish           external
   usr time    0.00 millis    0.00 micros    0.00 millis
   sys time   31.00 millis    0.00 micros   31.00 millis

user@DESKTOP-NKNOS3C ~/D/G/dracula-highlighting (main)> node ../vscode-vsce/vsce pack
 INFO  Detected presence of bun.lock. Using 'bun' logic.
 INFO  Files included in the VSIX:
dracula-highlighting-0.1.0.vsix
├─ [Content_Types].xml
├─ extension.vsixmanifest
└─ extension/
   ├─ LICENSE.txt [1.1 KB]
   ├─ package.json [1.79 KB]
   ├─ readme.md [1.74 KB]
   ├─ assets/
   │  └─ icon.png [10.08 KB]
   └─ themes/
      ├─ abyss-dracula.json [58.82 KB]
      ├─ dark-2026-dracula.json [58.67 KB]
      ├─ dark-dracula.json [17.61 KB]
      ├─ dark-high-contrast-dracula.json [58.24 KB]
      ├─ dark-modern-dracula.json [22.05 KB]
      ├─ kimbie-dark-dracula.json [58.94 KB]
      ├─ monokai-dimmed-dracula.json [18.86 KB]
      ├─ monokai-dracula.json [20.13 KB]
      ├─ solarized-dark-dracula.json [20.12 KB]
      └─ tomorrow-night-blue-dracula.json [58.95 KB]

 DONE  Packaged: C:\Users\user\Documents\GitHub\dracula-highlighting\dracula-highlighting-0.1.0.vsix (16 files, 79.49 KB)