CLI v1.4.0

Added

• publish --registrationCode (or OVSX_REGISTRATION_CODE) completes the trusted publisher registration of a private repository on its first publish (#2350)

Fixed

• publish -i ext.vsix now warns about the packaging options it ignores, as publish ext.vsix does, naming the file, and publishes the package once instead of once per --target (#2351)
• get and verify ignore a timeout or connection reset while draining the error body of a rejected download, instead of cleaning up a partial file that was never written (#2386)
• publish prints the exact byte counts next to the friendly sizes of a size limit, so a package one byte over its limit no longer reads as "1 MB exceeds the size limit of 1 MB" (#2392)
• publish --trusted-publishing asks the registry which audience its ID token must carry, so trusted publishing works on a registry whose configured audience is not its URL (#2391)
• publish --trusted-publishing only sends its ID token to a registry reached over https, apart from a loopback address, and a failed registry version lookup is no longer remembered (#2391)
• search reports an invalid --size or --offset value as a usage error instead of crashing with a stack trace (#2414)
• verify-pat, unpublish and create-namespace only store a prompted personal access token once the registry accepts it, so a mistyped token is no longer reused on every later run until logout (#2427)

Removed

• LoginOptions is no longer exported from the package entry point; it was the options type of login, which the entry point never actually exported

Dependencies

• Bump vite from 8.3.2 to 8.3.5 (#2357)
• Replace is-ci with ci-info 4.4.0 (#2377)
• Bump undici from 8.11.2 to 8.12.3 (#2387)
• Resolve @azure/msal-node to 7.1.1 (#2388)
• Upgrade yarn from 4.9.1 to 4.18.1 and set npmMinimalAgeGate to 7 days, so versions published in the last 7 days are not picked for new resolutions (#2393)
• Bump qs from 6.16.0 to 6.16.1 (#2415)