Remove unused gulp-sourcemaps dependency

[Sean McManus (sean-mcmanus)]

Summary

Remove the unused gulp-sourcemaps initialization from the localization pipelines and drop the dependency. This removes the vulnerable transitive decode-uri-component@0.2.2 package while preserving localization behavior because the metadata generator does not consume source maps.

Validation

• yarn install --frozen-lockfile --ignore-scripts
• yarn compile
• yarn translations-generate
• yarn gulp translations-export

This PR was investigated and created by GitHub Copilot in VS Code. Any message starting with ✨Copilot: was sent by Copilot.

[Copilot]

🟢 Approval recommended

The dependency and all usages are removed consistently without affecting metadata generation.

Pull request overview

Removes unused source-map initialization from localization pipelines and eliminates its vulnerable dependency chain.

Changes:

• Removes gulp-sourcemaps usage and dependency.
• Prunes related transitive packages from the lockfile.
• Preserves existing localization pipeline behavior.

File summaries

File	Description
Extension/gulpfile.js	Removes source-map initialization from localization tasks.
Extension/package.json	Removes the unused development dependency.
Extension/yarn.lock	Prunes gulp-sourcemaps and orphaned transitive dependencies.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Sean McManus (sean-mcmanus)]

✨Copilot (agent165): Reviewed at a7bd689 against base 2f25880, with local verification.

The core change is correct. vscode-nls-dev@4.0.4's createMetaDataFiles() calls processFile(file.contents.toString('utf8')) with no source-map argument, so the maps were never consumed — only rewriteLocalizeCalls() reads file.sourceMap, and this gulpfile does not use it. The transpiled JS is also filtered out of both pipelines before gulp.dest, so it never reaches disk.

Empirical A/B: with node_modules installed from the base lockfile and only gulpfile.js swapped, gulp translations-generate and gulp translations-export produce byte-identical output (180 files under dist/, and the 312,756-byte vscode-cpptools.xlf). Re-running both at this head after yarn install --frozen-lockfile reproduces the same outputs. yarn test-yarn-lock and yarn verify-yarn-lock pass, and gulp-sourcemaps, source-map-resolve, and decode-uri-component are gone from node_modules.

No debugging regression: gulp-typescript already forces inlineSourceMap: false / sourceMap: true at project creation and then sets sourceMap from whether inputs carry a map, so this only stops an unused map from being generated. Shipped source maps still come from tsc --build (inlineSourceMap) and webpack (devtool: 'source-map').

Security rationale checks out: decode-uri-component@0.2.2 is still covered by GHSA-vcc3-ghjq-m6fr (<= 0.4.2, patched in 0.5.0), so calling it vulnerable is accurate even though it postdates the older GHSA-w573-4hg7-7wgq fix.

One [Minor] follow-through comment on the leftover resolutions entries. Build-time-only change with no product-code impact; low release risk.

[Copilot]

🟢 Approval recommended

The dependency cleanup is complete and consistent with the unchanged localization pipeline behavior.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Balanced