chore: bump @electron/get to v5, migrate to got v15, fix audit vulnerabilities

[Copilot]

Summary

• Bumps @electron/get from ^4.0.1 to ^5.0.0
• Adds got as a direct dependency (^15.0.5) — @electron/get v5 dropped it from its own deps, but src/download.js uses it directly
• Updates src/download.js to use const got = require("got").default — got v15 removed the undocumented named got export, leaving only the default export
• Resolves all 3 npm audit vulnerabilities by adding overrides for transitive deps in mocha:
  • diff → ^9.0.0 (fixes CVE in 6.0.0–8.0.2 range)
  • serialize-javascript → ^7.0.5 (fixes two CVEs in ≤7.0.4)
• azure-pipelines.yml already uses nodeVersions: [22.x, 24.x] and engines.node is already >=22 — no changes needed there

Test Results

13 tests pass, 4 are pending. One test (should download from a custom repo) fails only in the sandboxed CI environment due to a DNS proxy blocking network requests — this is not a code regression.

[rzhao271]

@copilot Migrate to got v15

[Copilot]

@copilot Migrate to got v15

Done in b7a8d01. Also updated src/download.js to use const got = require("got").default since got v15 removed the undocumented named got export — only the default export remains.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/deepak1556/electron-debug-version/releases/tags/v32.2.3
  • Triggering command: /usr/local/bin/node node /home/REDACTED/work/vscode-gulp-electron/vscode-gulp-electron/node_modules/.bin/mocha (http block)
• https://api.github.com/repos/foo//releases/tags/v35.0.0
  • Triggering command: /usr/local/bin/node node /home/REDACTED/work/vscode-gulp-electron/vscode-gulp-electron/node_modules/.bin/mocha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[rzhao271]

@copilot Also confirm that workflows and pipelines are using node 22

[Copilot]

@copilot Also confirm that workflows and pipelines are using node 22

Already confirmed — azure-pipelines.yml specifies nodeVersions: [22.x, 24.x] for all three platforms (Linux, macOS, Windows), and there are no GitHub Actions workflow files in this repo. No changes were needed.