Merge main into release/stable - #1328
Open
MrRishabhJain wants to merge 43 commits into
Open
Conversation
Co-authored-by: Rishabh Jain <rishjain@microsoft.com>
* Updated brace-expansion version to 2.0.2 * updated with brace version * updated packages
* Update overview.md * Update nuget.json
* Update pac CLI to 1.49.4 * Add back pac CLI 1.44 release note line alongside 1.49 * Add pac CLI 1.44 release note to the overview --------- Co-authored-by: Rishabh Jain <rishjain@microsoft.com>
* Override electron-to-chromium * pinned version 1.5.191
* Override electron-to-chromium * pinned version 1.5.191 * Updated electron to chromium version
* Override electron-to-chromium * pinned version 1.5.191 * Updated electron to chromium version * update package dependencies
Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.1.1 and updates ancestor dependency [gulp-mocha](https://github.com/sindresorhus/gulp-mocha). These dependencies need to be updated together. Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) Updates `gulp-mocha` from 8.0.0 to 10.0.1 - [Release notes](https://github.com/sindresorhus/gulp-mocha/releases) - [Commits](sindresorhus/gulp-mocha@v8.0.0...v10.0.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect - dependency-name: gulp-mocha dependency-version: 10.0.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
* Added claude skiils and updated dependencies * updated tar fix * updated with fixes
* Updated claude skills and dependencies * updated package lock
* Add download-code-site and upload-code-site Azure DevOps tasks Add new build tool tasks for Power Pages Code Site download and upload, following the same pattern as existing download-paportal/upload-paportal tasks. These tasks wrap the downloadCodeSite and uploadCodeSite actions from the CLI wrapper. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix CI build: increase heap size and add task metadata - Bump --max-old-space-size from 5120 to 8192 in package.json to fix OOM during webpack compile with 34 task entry points - Add download-code-site and upload-code-site entries to extension/task-metadata.json with new GUIDs for all stages Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Rishabh Jain <rishjain@microsoft.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
jbujula
approved these changes
Mar 18, 2026
…lls (#1340) * Updated claude skills and dependencies * updated package lock * fix: update OfficialBuild pipeline to Node 20.x and add claude agents - Bump NodeTool from 16.x to 20.x in OfficialBuild.yml — cli-spinners@3.4.0 uses `with {type: 'json'}` import attribute syntax (Node 20+ only), which broke the set-version step running release-it - Add .claude/agents/ subagent prompts for PR, debug, dependencies, PAC CLI, work items, review, knowledge-sync workflows - Add .claude/knowledge/architecture.md reference - Update security-alerts.md to query both ADO area paths in parallel - Add debug-agent.md command Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor: consolidate .claude/ to skills/ structure Migrated from three duplicated directories (commands/, agents/, knowledge/) to a single .claude/skills/<name>/SKILL.md layout matching the CDS repo pattern. Each SKILL.md has frontmatter (name, description, allowed-tools, user-invocable) which registers it as both a slash command and a subagent type — eliminating the duplication where agents/ and commands/ held near-identical content. Cross-reference fixes: - /update-pac-cli → /pac-cli-update (create-pr, review) - /create-pr → /pr (fix-dependencies, security-alerts, workitem, review, debug-agent) - /review-pr → /review, /implement-workitem → /workitem (knowledge-sync) - File path refs in knowledge-sync Step 7 updated to skills/ paths - Invocation /debug-pipeline → /debug-agent Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: rename pr skill to create-pr; fix skill frontmatter - Rename skills/pr/ → skills/create-pr/ for clarity - Update all /pr references to /create-pr across skills - Remove unsupported 'allowed-tools' frontmatter attribute from all SKILL.md files - Replace unsupported 'args:' blocks with 'argument-hint:' strings (workitem, pac-cli-update, review, debug-agent) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: fix stale /pr refs and skill clarity issues - workitem: /pr → /create-pr (frontmatter, step 7 header + body) - knowledge-sync: skills/pr/ → skills/create-pr/; /fix-dependencies → /pac-cli-update in auto-invoke list - debug-agent: rename duplicate section 2c → 2d - review: remove "Step " prefix from sub-headings 3a/3b/3c - create-pr: stripped branch-setup and build-verify steps (belong in callers) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 2.0.2 to 2.0.3. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 2.0.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [basic-ftp](https://github.com/patrickjuchli/basic-ftp) from 5.2.0 to 5.2.1. - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.2.0...v5.2.1) --- updated-dependencies: - dependency-name: basic-ftp dependency-version: 5.2.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.4.1 to 3.4.2. - [Commits](WebReflection/flatted@v3.4.1...v3.4.2) --- updated-dependencies: - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
…igning (#1349) Filters out pac/_rels/.rels and pac_linux/_rels/.rels when copying the pac CLI bin folder into the tool-installer staging directory. These OPC metadata artifacts are left behind when the pac CLI NuGet packages are extracted. When vsixsigntool.exe (ESRP) encounters them inside the VSIX (itself an OPC container), the OPC parser fails with error 0x80510005 because the .rels files reference non-existent targets. Fixes: ICM 779156496 Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
#1354) Non-LIVE stages (BETA, DEV, EXPERIMENTAL) share the same extension manifest as LIVE, causing 'duplicate contribution id' errors in the Marketplace when all four stage packages are published simultaneously. For non-LIVE stages, suffix the service endpoint contribution id and properties.name with the lowercase stage name, and append the stage label to displayName. Also update each task's connectedService input type to reference the stage-specific endpoint id so tasks bind to the correct service endpoint type at runtime. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Bumps [basic-ftp](https://github.com/patrickjuchli/basic-ftp) from 5.2.1 to 5.3.0. - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.2.1...v5.3.0) --- updated-dependencies: - dependency-name: basic-ftp dependency-version: 5.2.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.1.0 to 10.2.0. - [Commits](https://github.com/beaugunderson/ip-address/commits) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1. - [Commits](lodash/lodash@4.17.23...4.18.1) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
Bumps [defu](https://github.com/unjs/defu) from 6.1.4 to 6.1.6. - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.6) --- updated-dependencies: - dependency-name: defu dependency-version: 6.1.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
…46) (#1386) Adds security validation to BuildToolsRunnerParams.runnersDir to ensure the PAC CLI path read from POWERPLATFORMTOOLS_PACCLIPATH points to the official PowerPlatformToolInstaller task directory. A low-trust build step could previously overwrite the mutable job-scoped variable to redirect protected tasks to an attacker-controlled PAC binary, allowing credential theft via the service-connection auth flow. The fix validates that: 1. The path is under the agent's _tasks directory 2. The path contains a known ToolInstaller task GUID (LIVE/BETA/DEV/EXPERIMENTAL) If either check fails, the task fails closed before materializing any service-connection credentials. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…, #6430957) (#1389) * fix: mask SPN clientSecret and password via tl.setSecret (#6430957) MSRC 117102: Power Platform Build Tools previously read clientSecret and password from the service connection without registering them with task-lib. As a result they appeared unmasked in pipeline logs and in task-lib debug output (e.g. `auth param clientSecret = <VALUE>` when System.Debug=true). Call tl.setSecret() on clientSecret and password immediately after reading them in getClientCredentials() and getUsernamePassword() so task-lib masks them everywhere they are echoed. The existing pattern was already in place for the OIDC PAC_ADO_ID_TOKEN_REQUEST_TOKEN value. The remaining /proc/<pid>/cmdline and PAC_CLI_SPN_SECRET env-var leaks are in @microsoft/powerplatform-cli-wrapper (pac auth create invocation) and must be addressed upstream. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: also mask base64-encoded form of clientSecret and password (#6430957) Per review on #1389: the cli-wrapper passes the secret to pac as `data:text/plain;base64,<base64>`. Without registering the base64 form with task-lib, the encoded value would not be masked in pipeline logs even though the raw value is. Register both forms with tl.setSecret(). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…#1399) Closes 4 PPBT S360 work items on KPI 240c2bea (BIC Component Governance): - ADO #6364952 brace-expansion 1.1.12 -> 1.1.15 (target 1.1.13, CVE-2026-33750) - ADO #6364953 brace-expansion 2.0.2 -> 2.0.3 (CVE-2026-33750) - ADO #6364954 picomatch 2.3.1 -> 2.3.2 (CVE-2026-33672) - ADO #6364955 brace-expansion 5.0.4 -> 5.0.6 (target 5.0.5, CVE-2026-33750) - ADO #6408700 brace-expansion 5.0.4 -> 5.0.6 (CVE-2026-45149, same package paths) Mechanism: - package.json overrides: minimatch -> brace-expansion ^5.0.6 (handles 5.x paths in cli-wrapper, tfx-cli, glob, mocha, readdir-glob). - package.json existing brace-expansion dep at ^2.0.3 (handles root 2.x hoist). - Lock-file patches for inBundle: true paths that npm overrides cannot reach: - @microsoft/powerplatform-cli-wrapper bundled brace-expansion 5.0.4 -> 5.0.6 - azure-pipelines-task-lib bundled minimatch@3.x's brace-expansion 1.1.12 -> 1.1.15 - hoisted picomatch (inBundle=true) 2.3.1 -> 2.3.2 Verification: - npm audit no longer reports brace-expansion or picomatch findings - compile + lint + pac CLI 2.7.4 restore pass - Pre-existing Node 24 unit-test ts-strip incompatibility is unrelated to this change
…ceeds (#1402) The official build pipeline now creates a published GitHub Release automatically on successful run (PR #1399's tooling change). Update both skills so contributors know to look for the release at /releases/tag/v<version> after their PR ships: - create-pr SKILL.md: Step 4 prompt now mentions the auto-release URL and what to do if it doesn't appear (token scope / SSO check). - pac-cli-update SKILL.md: Step 9 final summary now includes the same guidance.
Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.5 to 0.2.7. - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.5...v0.2.7) --- updated-dependencies: - dependency-name: tmp dependency-version: 0.2.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
…1410) Resolves all 9 high-severity npm-audit findings plus Dependabot alerts across transitive dev/runtime deps. Strategy: - Bump existing overrides to patched versions: basic-ftp ^6.0.1, serialize-javascript ^7.0.5, postcss ^8.5.15, qs ^6.15.2 - New flat overrides (single-major, single-instance, safe): tmp ^0.2.7, undici ^6.24.0, defu ^6.1.7, flatted ^3.4.2, form-data ^2.5.6, ip-address ^10.2.0, js-yaml ^4.2.0, lodash ^4.18.1 - Scoped overrides to avoid forcing inBundle siblings: tinyglobby>picomatch ^4.0.4 (leaves inBundle picomatch 2.3.2), tfx-cli>uuid ^13.0.1 (leaves inBundle uuid 3.4.0 under azure-pipelines-task-lib) - Direct dep bump: tar ^7.5.16 - Lock-file patch (Strategy C) for follow-redirects 1.15.11 -> 1.16.0; overrides cannot reach it (inBundle via bundled cli-wrapper subtree) Remaining 8 (down from 28) are documented accepted-risk/deferred: - 6 low: elliptic chain (GHSA-848j-6mx2-7j84, dev-only, no patch) - 2 moderate: uuid 3.4.0 bundled in azure-pipelines-task-lib (requires uuid ^3.0.1) -> needs upstream fix; cannot override a bundled subtree Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Update CLI version to 1.44.2 (#1181) Co-authored-by: Rishabh Jain <rishjain@microsoft.com> * Users/jbujula/cliversion1.46.1 release (#1215) * Update overview.md * Update nuget.json * Revert "Users/jbujula/cliversion1.46.1 release (#1215)" (#1219) This reverts commit 26f9ff2. * [release] Update Pac CLI to 1.49.4 (#1251) * Replicate diff from PR #1250: bump pac CLI to 1.49.4 and add 2.0.94 block * Fix formatting in overview.md by removing extra blank line * Update extension/overview.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Rishabh Jain <rishjain@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Override electron-to-chromium (#1270) * pinned version to 1.5.191 (#1271) * updated node version (#1274) * Users/jbujula/update dependencies electon to chromium release 2 (#1276) * pinned version to 1.5.191 * Update electron-to-chromium * Users/jbujula/update dependencies electon to chromium release 2 (#1277) * pinned version to 1.5.191 * Update electron-to-chromium * Update webpack version to match ado upstream * Updated cli version to 1.52.1 (#1302) * Merge main into release/stable for pipeline build and package publish (#1331) Includes download-code-site and upload-code-site tasks (#1318), claude skills, dependency updates (webpack ^5.105.4, security overrides), and pac CLI 1.52.1. Co-authored-by: Rishabh Jain <rishjain@microsoft.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: update OfficialBuild pipeline to Node 20.x; add claude agent skills (#1340) (#1341) * Updated claude skills and dependencies * updated package lock * fix: update OfficialBuild pipeline to Node 20.x and add claude agents - Bump NodeTool from 16.x to 20.x in OfficialBuild.yml — cli-spinners@3.4.0 uses `with {type: 'json'}` import attribute syntax (Node 20+ only), which broke the set-version step running release-it - Add .claude/agents/ subagent prompts for PR, debug, dependencies, PAC CLI, work items, review, knowledge-sync workflows - Add .claude/knowledge/architecture.md reference - Update security-alerts.md to query both ADO area paths in parallel - Add debug-agent.md command * refactor: consolidate .claude/ to skills/ structure Migrated from three duplicated directories (commands/, agents/, knowledge/) to a single .claude/skills/<name>/SKILL.md layout matching the CDS repo pattern. Each SKILL.md has frontmatter (name, description, allowed-tools, user-invocable) which registers it as both a slash command and a subagent type — eliminating the duplication where agents/ and commands/ held near-identical content. Cross-reference fixes: - /update-pac-cli → /pac-cli-update (create-pr, review) - /create-pr → /pr (fix-dependencies, security-alerts, workitem, review, debug-agent) - /review-pr → /review, /implement-workitem → /workitem (knowledge-sync) - File path refs in knowledge-sync Step 7 updated to skills/ paths - Invocation /debug-pipeline → /debug-agent * chore: rename pr skill to create-pr; fix skill frontmatter - Rename skills/pr/ → skills/create-pr/ for clarity - Update all /pr references to /create-pr across skills - Remove unsupported 'allowed-tools' frontmatter attribute from all SKILL.md files - Replace unsupported 'args:' blocks with 'argument-hint:' strings (workitem, pac-cli-update, review, debug-agent) * chore: fix stale /pr refs and skill clarity issues - workitem: /pr → /create-pr (frontmatter, step 7 header + body) - knowledge-sync: skills/pr/ → skills/create-pr/; /fix-dependencies → /pac-cli-update in auto-invoke list - debug-agent: rename duplicate section 2c → 2d - review: remove "Step " prefix from sub-headings 3a/3b/3c - create-pr: stripped branch-setup and build-verify steps (belong in callers) --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: exclude nested _rels/.rels files from VSIX bin folder for ESRP signing (#1350) Filters out pac/_rels/.rels and pac_linux/_rels/.rels when copying the pac CLI bin folder into the tool-installer staging directory. These OPC metadata artifacts are left behind when the pac CLI NuGet packages are extracted. When vsixsigntool.exe (ESRP) encounters them inside the VSIX (itself an OPC container), the OPC parser fails with error 0x80510005 because the .rels files reference non-existent targets. Fixes: ICM 779156496 Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: make service endpoint contributions unique per stage in VSIX pack (#1355) Non-LIVE stages (BETA, DEV, EXPERIMENTAL) share the same extension manifest as LIVE, causing 'duplicate contribution id' errors in the Marketplace when all four stage packages are published simultaneously. For non-LIVE stages, suffix the service endpoint contribution id and properties.name with the lowercase stage name, and append the stage label to displayName. Also update each task's connectedService input type to reference the stage-specific endpoint id so tasks bind to the correct service endpoint type at runtime. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: publish non-LIVE stage extensions publicly to VS Marketplace (#1357) BETA, DEV, and EXPERIMENTAL stage VSIXs were marked public=false, keeping them unlisted on the Marketplace. Setting public=true makes them discoverable so testers and preview users can install them without needing a direct install link. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: update create-pr skill with dual-PR and build prompt workflow (#1359) - Step 2: capture branch/SHAs before creating main PR - Step 3: auto cherry-pick to release/stable, push, open paired PR - Step 4: prompt user to queue pipeline 21491 with required variables (GITHUB_TOKEN, AZ_DevOps_Read_PAT, isEsrpEnabled, PUBLISH_TO_MARKETPLACE) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: update pac CLI to 2.6.4 (#1363) * fix: add Override entries to VSIX [Content_Types].xml for extension-less pac CLI files (#1367) * chore: update pac CLI to 2.7.4 (#1377) * fix: validate PAC CLI path to prevent mutable variable hijack (#6414246) (#1387) Adds security validation to BuildToolsRunnerParams.runnersDir to ensure the PAC CLI path read from POWERPLATFORMTOOLS_PACCLIPATH points to the official PowerPlatformToolInstaller task directory. A low-trust build step could previously overwrite the mutable job-scoped variable to redirect protected tasks to an attacker-controlled PAC binary, allowing credential theft via the service-connection auth flow. The fix validates that: 1. The path is under the agent's _tasks directory 2. The path contains a known ToolInstaller task GUID (LIVE/BETA/DEV/EXPERIMENTAL) If either check fails, the task fails closed before materializing any service-connection credentials. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: mask SPN clientSecret and password via tl.setSecret (MSRC 117102, #6430957) (#1390) * fix: mask SPN clientSecret and password via tl.setSecret (#6430957) MSRC 117102: Power Platform Build Tools previously read clientSecret and password from the service connection without registering them with task-lib. As a result they appeared unmasked in pipeline logs and in task-lib debug output (e.g. `auth param clientSecret = <VALUE>` when System.Debug=true). Call tl.setSecret() on clientSecret and password immediately after reading them in getClientCredentials() and getUsernamePassword() so task-lib masks them everywhere they are echoed. The existing pattern was already in place for the OIDC PAC_ADO_ID_TOKEN_REQUEST_TOKEN value. The remaining /proc/<pid>/cmdline and PAC_CLI_SPN_SECRET env-var leaks are in @microsoft/powerplatform-cli-wrapper (pac auth create invocation) and must be addressed upstream. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: also mask base64-encoded form of clientSecret and password (#6430957) Per review on #1389: the cli-wrapper passes the secret to pac as `data:text/plain;base64,<base64>`. Without registering the base64 form with task-lib, the encoded value would not be masked in pipeline logs even though the raw value is. Register both forms with tl.setSecret(). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: update pac CLI to 2.8.1 (#1395) * revert: pac CLI 2.8.1 -> 2.7.4 due to upstream bug (#1398) * fix: bump brace-expansion + picomatch to patched versions (S360 CVEs) (#1400) Closes 4 PPBT S360 work items on KPI 240c2bea (BIC Component Governance): - ADO #6364952 brace-expansion 1.1.12 -> 1.1.15 (target 1.1.13, CVE-2026-33750) - ADO #6364953 brace-expansion 2.0.2 -> 2.0.3 (CVE-2026-33750) - ADO #6364954 picomatch 2.3.1 -> 2.3.2 (CVE-2026-33672) - ADO #6364955 brace-expansion 5.0.4 -> 5.0.6 (target 5.0.5, CVE-2026-33750) - ADO #6408700 brace-expansion 5.0.4 -> 5.0.6 (CVE-2026-45149, same package paths) Mechanism: - package.json overrides: minimatch -> brace-expansion ^5.0.6 (handles 5.x paths in cli-wrapper, tfx-cli, glob, mocha, readdir-glob). - package.json existing brace-expansion dep at ^2.0.3 (handles root 2.x hoist). - Lock-file patches for inBundle: true paths that npm overrides cannot reach: - @microsoft/powerplatform-cli-wrapper bundled brace-expansion 5.0.4 -> 5.0.6 - azure-pipelines-task-lib bundled minimatch@3.x's brace-expansion 1.1.12 -> 1.1.15 - hoisted picomatch (inBundle=true) 2.3.1 -> 2.3.2 Verification: - npm audit no longer reports brace-expansion or picomatch findings - compile + lint + pac CLI 2.7.4 restore pass - Pre-existing Node 24 unit-test ts-strip incompatibility is unrelated to this change * docs(skills): document auto-created GitHub Release after pipeline succeeds (#1403) The official build pipeline now creates a published GitHub Release automatically on successful run (PR #1399's tooling change). Update both skills so contributors know to look for the release at /releases/tag/v<version> after their PR ships: - create-pr SKILL.md: Step 4 prompt now mentions the auto-release URL and what to do if it doesn't appear (token scope / SSO check). - pac-cli-update SKILL.md: Step 9 final summary now includes the same guidance. * chore: fix dependency vulnerabilities (28 -> 8, all highs resolved) Resolves all 9 high-severity npm-audit findings plus Dependabot alerts across transitive dev/runtime deps. Strategy: - Bump existing overrides to patched versions: basic-ftp ^6.0.1, serialize-javascript ^7.0.5, postcss ^8.5.15, qs ^6.15.2 - New flat overrides (single-major, single-instance, safe): tmp ^0.2.7, undici ^6.24.0, defu ^6.1.7, flatted ^3.4.2, form-data ^2.5.6, ip-address ^10.2.0, js-yaml ^4.2.0, lodash ^4.18.1 - Scoped overrides to avoid forcing inBundle siblings: tinyglobby>picomatch ^4.0.4 (leaves inBundle picomatch 2.3.2), tfx-cli>uuid ^13.0.1 (leaves inBundle uuid 3.4.0 under azure-pipelines-task-lib) - Direct dep bump: tar ^7.5.16 - Lock-file patch (Strategy C) for follow-redirects 1.15.11 -> 1.16.0; overrides cannot reach it (inBundle via bundled cli-wrapper subtree) Remaining 8 (down from 28) are documented accepted-risk/deferred: - 6 low: elliptic chain (GHSA-848j-6mx2-7j84, dev-only, no patch) - 2 moderate: uuid 3.4.0 bundled in azure-pipelines-task-lib (requires uuid ^3.0.1) -> needs upstream fix; cannot override a bundled subtree Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: fix uuid vulnerability (CVE-2026-41907) by upgrading azure-pipelines-task-lib Upgrade azure-pipelines-task-lib 5.2.8 -> 5.277.0, which drops its transitive dependency on the vulnerable uuid@3.4.0 (CVE-2026-41907). uuid no longer appears in the tree via azure-pipelines-task-lib. npm audit no longer reports the moderate uuid finding. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Rishabh Jain <rishabhmj21@gmail.com> Co-authored-by: Rishabh Jain <rishjain@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Brad Flood <63075802+brflood@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
#1420) PR #1418 merged azure-pipelines-task-lib@^5.277.0, but the official pipeline (PowerPlatform-DPX-Tools-GitHub-BT-Official) restores from the DPX-Tools-Upstream Azure Artifacts feed, which does not carry 5.277.0 (npm 404). The feed does carry 5.276.0, which likewise drops the transitive uuid@3.4.0 dependency, keeping CVE-2026-41907 fixed. Pinned exactly (no caret) so npm cannot re-resolve to the feed-missing 5.277.0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Rishabh Jain <rishjain@microsoft.com> Copilot-Session: 5a0fd990-27f4-4a2a-8df7-3b81302917c1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Requested by @jbujula