chore: security dependency upgrades + config adjustments

.github/dependabot.yml

@@ -10,18 +10,19 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    ignore:
-    - dependency-name: actions/checkout
 
   # Maintain dependencies for npm
   - package-ecosystem: npm
     directory: "/"
     schedule:
       interval: weekly
-    ignore:
-    - dependency-name: "ws"
-    - dependency-name: "@types/node"
-    - dependency-name: "@types/vscode"
-    - dependency-name: "@types/ws"
-    - dependency-name: "typescript"
-      versions: ["5.x"]
+
+  - package-ecosystem: npm
+    directory: "/example"
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: npm
+    directory: "/example-ws"
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -21,14 +21,41 @@ jobs:
       fail-fast: false
 
     steps:
-      # using `v1` because of: https://github.com/actions/checkout/issues/246
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node_version }}
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
 
       - name: Build
         run: npm run ci
+
+      - name: Install example dependencies
+        run: npm ci
+        working-directory: example
+
+      - name: Audit example
+        run: npm audit
+        working-directory: example
+
+      - name: Build example
+        run: npm run compile
+        working-directory: example
+
+      - name: Install WebSocket example dependencies
+        run: npm ci
+        working-directory: example-ws
+
+      - name: Audit WebSocket example
+        run: npm audit
+        working-directory: example-ws
+
+      - name: Build WebSocket example
+        run: npm run compile
+        working-directory: example-ws
+
+      - name: Lint WebSocket example
+        run: npm run lint
+        working-directory: example-ws

.github/workflows/commitlint.yml

@@ -14,7 +14,7 @@ jobs:
   commitlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - uses: wagoid/commitlint-github-action@v6

.github/workflows/release.yml

@@ -12,15 +12,14 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      # using `v1` because of: https://github.com/actions/checkout/issues/246
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
 
       - name: Build
         run: npm run ci
@@ -32,4 +31,4 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           files: sap-devx-webview-rpc-*.tgz
-          fail_on_unmatched_files: true
+          fail_on_unmatched_files: true

README.md

@@ -1,104 +1,149 @@
-[![CircleCI](https://circleci.com/gh/SAP/vscode-webview-rpc-lib.svg?style=svg)](https://circleci.com/gh/SAP/vscode-webview-rpc-lib)
-[![Coverage Status](https://coveralls.io/repos/github/SAP/vscode-webview-rpc-lib/badge.svg?branch=master)](https://coveralls.io/github/SAP/vscode-webview-rpc-lib?branch=master)
+[![Continuous Integration](https://github.com/SAP/vscode-webview-rpc-lib/actions/workflows/ci.yml/badge.svg)](https://github.com/SAP/vscode-webview-rpc-lib/actions/workflows/ci.yml)
 [![Commitizen friendly](https://img.shields.io/badge/commitizen-friendly-brightgreen.svg)](http://commitizen.github.io/cz-cli/)
 ![GitHub license](https://img.shields.io/badge/license-Apache_2.0-blue.svg)
 [![REUSE status](https://api.reuse.software/badge/github.com/SAP/vscode-webview-rpc-lib)](https://api.reuse.software/info/github.com/SAP/vscode-webview-rpc-lib)
-[![dependentbot](https://api.dependabot.com/badges/status?host=github&repo=SAP/vscode-webview-rpc-lib)](https://dependabot.com/)
 
 # vscode-webview-rpc-lib
 
 ## Description
-Provides a conventient way to communicate between VSCode extension and its webviews. Use RPC calls to invoke functions on the webview, receive callbacks and vice versa.
+
+`@sap-devx/webview-rpc` provides a convenient RPC layer for communication between a VS Code extension and its webviews. It supports promise-based calls in both directions, plus WebSocket-based RPC scenarios for browser-to-node and multi-plugin routing.
 
 ## Requirements
-You need to have [node.js](https://www.npmjs.com/package/node) installed on your machine.
-Also, to use this library, you need to run it inside a VSCode extension using [VSCode](https://code.visualstudio.com/) or [Theia](https://www.theia-ide.org/).
-
-## How to use
-*An example of using this libary can be seen under the "example" folder.*
-
-### Installation
-* Create VSCode extension with a Webview. To create your extension go to https://code.visualstudio.com/api/extension-guides/webview.
-* Install using npm
-    ```bash
-    npm install @sap-devx/webview-rpc
-    ```
-    This will install the library in your node_modules folder. The extension library can be used as any node.js module (with TypeScript). The webview library needs to be imported to your html.
-* Add the following script to the root html of your Webview
-    ```html
-    <head>
-        <script>var exports = {};</script>
-        <script type="module" src="vscode-resource:/node_modules/@sap-devx/webview-rpc/out.browser/rpc-common.js"></script>
-        <script type="module" src="vscode-resource:/node_modules/@sap-devx/webview-rpc/out.browser/rpc-browser.js"></script>
-        <script type="module" src="vscode-resource:/out/media/main.js"></script>
-    </head>
-    ```
-### Initializations
-Create new instance of the Rpc in the extension side and the Webview side
-* In the extension code use the following example to start new instance of the RpcExtension:
-    ```ts
-    this._rpc = new RpcExtension(this._panel.webview);
-    ```
-* In the Webview JS code use the following example to start new instance of the RpcBrowser:
-    ```js
-    const vscode = acquireVsCodeApi();
-    let rpc = new RpcBrowser(window, vscode);
-    ```
-### Register methods
-In order to invoke an extension method from the webbiew or webview method from the extension, you will have to register the functions that can be invoked.
-Here is an example on how to register the methods
-```js
-function add(a,b) {
-    return a+b;
-}
 
-rpc.registerMethod({func: add});
+For package consumers:
+- A VS Code or Theia extension with a webview.
+- npm access to install `@sap-devx/webview-rpc`.
+
+For repository development:
+- Node.js 20 or newer.
+- npm.
+
+## Installation
+
+Install the package in your extension project:
+
+```bash
+npm install @sap-devx/webview-rpc
 ```
-### Usage
-To invoke a method use the *invoke* method on the rpc instance. You can pass a callback that will be invoked once the response received.\
-***For version ^0.x.y*** :
+
+## Basic Usage
+
+### Extension Side
+
+Create an RPC instance from the extension host:
+
+```ts
+import { RpcExtension } from "@sap-devx/webview-rpc/out.ext/rpc-extension";
+
+const rpc = new RpcExtension(panel.webview);
+```
+
+### Webview Side
+
+Load the browser build from your webview HTML and create an RPC instance:
+
+```html
+<script type="module" src="${rpcCommonUri}"></script>
+<script type="module" src="${rpcBrowserUri}"></script>
+<script type="module" src="${mainScriptUri}"></script>
+```
+
+Use `webview.asWebviewUri(...)` in the extension to create `rpcCommonUri`, `rpcBrowserUri`, and your own script URI. Avoid hardcoded `vscode-resource:` URLs; they are deprecated in modern VS Code webviews.
+
 ```js
-rpc.invoke("add", [1,2]).then((response)=>{
-    console.log("1+2="+response);
-});
+const vscode = acquireVsCodeApi();
+const rpc = new RpcBrowser(window, vscode);
+```
+
+## Register Methods
+
+Register functions that can be invoked remotely:
+
+```js
+function add(a, b) {
+  return a + b;
+}
+
+rpc.registerMethod({ func: add });
 ```
-***Since version 1.x.y*** :
+
+## Invoke Methods
+
+Use `invoke` to call a registered remote method. The result is returned as a `Promise`.
+
 ```js
-rpc.invoke("add", 1,2).then((response)=>{
-    console.log("1+2="+response);
+rpc.invoke("add", 1, 2).then((response) => {
+  console.log(`1 + 2 = ${response}`);
 });
 ```
 
+## WebSocket RPC
+
+The package also includes WebSocket-based RPC classes:
+
+- `RpcBrowserWebSockets` from `out.browser/rpc-browser-ws.js`
+- `RpcExtensionWebSockets` from `out.ext/rpc-extension-ws.js`
+- `RpcBrowserWebSocketsMulti` from `out.browser/rpc-browser-ws-multi.js`
+- `RpcServerWebSocketsMulti` from `out.ext/rpc-server-ws-multi.js`
+
+See `example-ws/` for a runnable WebSocket example.
+
 ## Build and Development
-To build for development purpose do the following:
-* Run "*npm install*" on the repo to download the project dependencies.
-    ```bash
-    npm install @sap-devx/webview-rpc
-    ```
-* Run "*npm run compile-ext*" to compile the extension library sources to javascript. The compilation results will be on the directory "out.ext".
-    ```bash
-    npm run compile-ext
-    ```
-* Run "*npm run compile-browser*" to compile the browser library sources to javascript. The compilation results will be on the directory "out.browser".
-    ```bash
-    npm run compile-browser
-    ```
-* Run the test using "*npm run test*".
-    ```bash
-    npm run test
-    ```
-
-## Known Issues
-* Browser library is does not generate d.ts files.
-
-* overcome Cors issue preventing post message to get through and hit the window:
-use the setHost method and sent the host name from the webview - and then the message should get through.
-
-## How to obtain support
-* To get more help, support and information please open a github issue.
+
+Install dependencies from the lockfile:
+
+```bash
+npm ci
+```
+
+Compile all TypeScript targets:
+
+```bash
+npm run compile
+```
+
+Run linting:
+
+```bash
+npm run lint
+```
+
+Run tests:
+
+```bash
+npm test
+```
+
+Run the full root CI workflow locally:
+
+```bash
+npm run ci
+```
+
+The examples have their own lockfiles. To verify them:
+
+```bash
+cd example
+npm ci
+npm run compile
+```
+
+```bash
+cd example-ws
+npm ci
+npm run compile
+npm run lint
+```
+
+## Support
+
+Open a GitHub issue for help, bugs, or feature requests.
+
 ## Contributing
-Contributing information can be found in the [CONTRIBUTING.md](CONTRIBUTING.md) file.
 
-## To-Do (upcoming changes)
-* remove the need to decalre exposed functions
+Contributing information can be found in [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## To-Do
 
+- Remove the need to declare exposed functions explicitly.