Merge for 1.33.6 (2nd time)

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/bug-debugger.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Add Comment

.github/workflows/by-design-closer-debugger .yml → .github/workflows/by-design-closer-debugger.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

.github/workflows/by-design-closer.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

.github/workflows/codeql.yml

@@ -59,11 +59,11 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -91,7 +91,7 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       with:
         category: "/language:${{matrix.language}}"
 

.github/workflows/duplicate-closer.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

.github/workflows/enhancement-closer-no-milestone.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

.github/workflows/enhancement-closer-triage.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

.github/workflows/enhancement-reopener.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Run Reopener

.github/workflows/external-closer-debugger.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

.github/workflows/feature-request-closer-no-milestone.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

.github/workflows/feature-request-closer-triage.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

.github/workflows/feature-request-debugger.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Add Comment

.github/workflows/feature-request-reopener.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Run Reopener

.github/workflows/investigate-closer-debugger.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

.github/workflows/investigate-costing-closer-debugger.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

.github/workflows/job-compile-and-test.yml

@@ -25,12 +25,12 @@ jobs:
     runs-on: ${{ inputs.runner-env }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.checkout-ref }}
 
       - name: Use Node.js 24
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
 
@@ -80,21 +80,21 @@ jobs:
 
       - name: Run languageServer integration tests (linux/macOS)
         if: ${{ inputs.platform == 'mac' || inputs.platform == 'linux' }}
-        uses: coactions/setup-xvfb@v1
+        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1
         with:
           run: yarn test --scenario=SingleRootProject
           working-directory: Extension
 
       - name: Run E2E IntelliSense features tests (linux/macOS)
         if: ${{ inputs.platform == 'mac' || inputs.platform == 'linux' }}
-        uses: coactions/setup-xvfb@v1
+        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1
         with:
           run: yarn test --scenario=MultirootDeadlockTest
           working-directory: Extension
 
       - name: Run RunWithoutDebugging tests (linux/macOS)
         if: ${{ inputs.platform == 'mac' || inputs.platform == 'linux' }}
-        uses: coactions/setup-xvfb@v1
+        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1
         with:
           run: yarn test --scenario=RunWithoutDebugging --scenario-arg=skipExternalConsole
           working-directory: Extension

.github/workflows/locker.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Run Locker

.github/workflows/more-info-needed-closer-debugger.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

.github/workflows/more-info-needed-closer.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

.github/workflows/question-closer-debugger.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

.github/workflows/question-closer.yml

@@ -18,7 +18,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Actions
         run: cd ./.github/actions && npm install --production && cd ../..
       - name: Stale Closer

Documentation/Building the Extension.md

@@ -5,7 +5,7 @@ These steps will allow you to debug the TypeScript code that is part of the Micr
 Prerequisite steps:
   * Clone the release branch of [this](https://github.com/Microsoft/vscode-cpptools) repository.
       * git clone -b release https://github.com/Microsoft/vscode-cpptools
-  * Install [node](https://nodejs.org).
+  * Install the [required Node.js version](../Extension/readme.developer.md#required-tools).
   * Install [yarn](https://yarnpkg.com).
   * From a command line, run the following commands from the **Extension** folder in the root of the repository:
       * `yarn install` will install the dependencies needed to build the extension.

Extension/.gitignore

@@ -10,6 +10,7 @@ server
 debugAdapters
 LLVM
 bin/assert_dialog.sh
+bin/binaryVersion.json
 bin/cpptools*
 bin/edge_cli
 bin/isense_driver

Extension/.scripts/copyExtensionBinaries.ts

@@ -7,7 +7,7 @@ import { cp, readdir, rm, stat } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
 import { verbose } from '../src/Utility/Text/streams';
-import { $args, $root, green, heading, note } from './common';
+import { $args, $root, Git, green, heading, note, warn } from './common';
 
 const extensionPrefix = 'ms-vscode.cpptools-';
 const foldersToCopy = ['bin', 'debugAdapters', 'LLVM'] as const;
@@ -125,6 +125,33 @@ async function findLatestInstalledExtension(providedPath?: string): Promise<stri
     return installed[0].path;
 }
 
+/**
+ * A few files inside the copied folders are checked into the repo (for example bin/cpp.hint and
+ * bin/messages/**). The copy overwrites them with the installed extension's versions, which can differ
+ * in line endings or content and then show up as spurious local modifications. Restore any tracked files
+ * that the copy changed so only the untracked binaries remain in the working tree.
+ */
+async function restoreTrackedFiles(): Promise<void> {
+    const modified = await Git('ls-files', '--modified', '--', ...foldersToCopy);
+    if (modified.code) {
+        warn(`Unable to determine which tracked files to restore: ${modified.error.all().join('\n')}`);
+        return;
+    }
+
+    const files = modified.stdio.all().map(line => line.trim()).filter(line => line.length > 0);
+    if (!files.length) {
+        return;
+    }
+
+    const restored = await Git('checkout', '--', ...files);
+    if (restored.code) {
+        warn(`Unable to restore tracked files after copy: ${restored.error.all().join('\n')}`);
+        return;
+    }
+
+    note(`Restored ${files.length} tracked ${files.length === 1 ? 'file' : 'files'} overwritten by the copy.`);
+}
+
 export async function main(sourcePath = $args[0]): Promise<string | undefined> {
     console.log(heading('Copy installed extension binaries'));
 
@@ -142,6 +169,8 @@ export async function main(sourcePath = $args[0]): Promise<string | undefined> {
 
     note(`Copied installed binaries into ${$root}`);
 
+    await restoreTrackedFiles();
+
     const installedVersion = tryParseVersion(basename(installedExtensionPath));
     return installedVersion?.join('.');
 }

Extension/CHANGELOG.md

@@ -1,15 +1,17 @@
 # C/C++ for Visual Studio Code Changelog
 
-## Version 1.33.6: July 31, 2026
+## Version 1.33.6: August 4, 2026
 ### Bug Fixes
 * Fix a spurious recursive includes (`**`) debug console log warning for paths merged from `c_cpp_properties.json` when `C_Cpp.mergeConfigurations` is enabled. [#14125](https://github.com/microsoft/vscode-cpptools/issues/14125)
   * Thanks for the contribution. [@owevertonguedes (Weverton Guedes)](https://github.com/owevertonguedes) [PR #14620](https://github.com/microsoft/vscode-cpptools/pull/14620)
 * Fix custom configurations being discarded when `C_Cpp.mergeConfigurations` is enabled and a provider supplies the file `uri` as a `vscode.Uri`. [#14621](https://github.com/microsoft/vscode-cpptools/issues/14621)
   * Thanks for the contribution. [@owevertonguedes (Weverton Guedes)](https://github.com/owevertonguedes) [PR #14624](https://github.com/microsoft/vscode-cpptools/pull/14624)
+* Fix a tag parser crash when a UTF-8 string literal is concatenated with a narrow string literal containing an invalid multibyte sequence.
 * Fix potential browse database corruption when the same workspace is opened by multiple processes on Linux and macOS.
 * Fix a crash when reading files saved in certain multibyte encodings such as GB18030 or EUC-JP.
 * Fix an incorrect file path in an error message on Windows.
 * Other potential crash fixes.
+* Update dependencies.
 
 ## Version 1.33.5: July 28, 2026
 ### Bug Fixes