[dependabot]

Bumps msw from 2.15.0 to 3.0.4.

Release notes

Sourced from msw's releases.

v3.0.4 (2026-11-06)

Bug Fixes

• worker: prevent the worker from going idle (#2830) (6dd13026f08c1c85a9eb4fdbb3b5c59d0f2c079e) @​kettanaito
• isCommonAssetRequest: add ico to common assets (#2829) (ebffbd4c7f5be0d4db625ed10812d58f82ed92d7) @​kettanaito

v3.0.3 (2026-10-10)

Bug Fixes

• HandlersController: dispose of reset handlers (#2810) (3818a81c455a638eda1558558d8ae3cd17a34e55) @​kettanaito
• expose network context on enable in network sources (#2809) (d1fe8e6e6e7eefce43746ee44802bc553731e951) @​kettanaito

v3.0.2 (2026-10-03)

Bug Fixes

• vite: support virtual:msw imports in vitest (#2802) (e73c381e3adc0848fcf9a7ef291b614b06a0d92b) @​kettanaito

v3.0.1 (2026-09-30)

Bug Fixes

• treat CONNECT requests as the transport mechanism (#2796) (7cad86a03b0ddb2efdec96ce8a49b0ed07d9f4dc) @​kettanaito

v3.0.0 (2026-09-28)

• v3.0.0 (#2692) (2bb43428b79ac06f94bb8ea8aeacd6102fe31f56) @​kettanaito @​Andarist

⚠️ BREAKING CHANGES

• MSW is now ESM-only (#2765).
• Deprecate support for Node.js v18 and v20 (#2729). The minimal supported Node.js version is v22.
• msw/native is removed in favor of @msw/react-native.
• Require TypeScript 5.9 as the minimal version.
• Deprecate support for TypeScript 5.1 and 5.2 (#2730)
• worker.stop() returns a Promise (#2724). Awaiting it is relevant only for in-flight critical scenarios.
• graphql is now exported as msw/graphql (#2691). GraphQL is now handled as a proper optional peer dependency.
• Removes the handleRequest() utility. Please use the defineNetwork() API instead.
• GraphQLLinkHandlers type has been renamed to GraphQLLink.
• The file:// requests now throw in Node.js as they normally do (not supported by fetch).
• The Content-Length request header is now removed by bypass().
• HTTP-to-WebSocket upgrade requests performed via fetch() now throw in Node.js as they normally do (not supported by fetch).
• Cookies are no longer managed in Node.js for better compatibility. Instead, whatever is the default behavior of your environment that's the cookie behavior you get. This has no effect on the browser.
• WebSocket connection life cycle event has been renamed to websocket:connection (#2783).
• onUnhandledRequest option has been renamed to onUnhandledFrame.
• The library no longer patches setTimeout to circumvent fake timers in test runners. You should advance the fake timers normally for delayed mocked responses to resolve.
• The library no longer returns a mocked cookie string on request.headers.get('cookie') in the handlers. It returns null in all environments. Please use the cookies resolver argument to have cookie-based logic.

... (truncated)

Commits

• 9bbfe99 chore(release): v3.0.4
• 6dd1302 fix(worker): prevent the worker from going idle (#2830)
• ebffbd4 fix(isCommonAssetRequest): add ico to common assets (#2829)
• 28c74aa chore: fix the typescript-nightly job to run (#2819)
• 3560a94 chore(release): v3.0.3
• 3818a81 fix(HandlersController): dispose of reset handlers (#2810)
• d1fe8e6 fix: expose network context on enable in network sources (#2809)
• 22a4626 test(node): add jsdom cors/preflight regression tests (#2808)
• a32ee31 docs: add beehiiv to partners (#2805)
• 501a591 chore: update github social image
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
msw	[>= 1.a, < 2]

[Copilot]

🟡 Changes recommended

The MSW 3 bump leaves Jest unable to load its ESM modules and retains the renamed onUnhandledRequest option, breaking affected tests and leaving unhandled-request policies unmigrated.

2 open issues

• Add MSW and ESM dependencies to Jest's transform allowlist · New
• Rename onUnhandledRequest to onUnhandledFrame in server callers · New

1 file not reviewed

• extensions/ql-vscode/package-lock.json: Generated file

What changed in this PR

Updates MSW, used for GitHub API mocking and tests in the CodeQL VS Code extension, from 2.15.0 to 3.0.3.

Changes:

• Raises the MSW dependency range to ^3.0.3.
• Refreshes the lockfile for MSW 3 and its transitive dependencies, including updated runtime and peer requirements.

File	Description
extensions/​ql-vscode/​package.json	Updates the declared MSW dependency.
extensions/​ql-vscode/​package-lock.json	Locks MSW 3.0.3 and updates its dependency tree.

_{Review effort: Balanced (auto)}

[Copilot]

🟡 Changes recommended

The MSW 3 upgrade leaves removed APIs in use and lacks Jest ESM transformation support, causing type-checking failures, ignored request-handling options, and test module-loading failures.

3 open issues

• Allowlist MSW for Jest transformation · New
• Rename onUnhandledRequest to onUnhandledFrame in server callers
• Add MSW and ESM dependencies to Jest's transform allowlist

1 file not reviewed

• extensions/ql-vscode/package-lock.json: Generated file

_{Review effort: Balanced (auto)}