chore(deps): consolidate Dependabot updates - #9416
Open
vhvb1989 wants to merge 12 commits into
Open
Conversation
vhvb1989
requested review from
JeffreyCA,
RickWinter,
XiaofuHuang,
achauhan-scc,
anchenyi,
bwateratmsft,
danieljurek,
glharper,
hemarina,
huimiu,
hund030,
kingernupur,
richardpark-msft,
saanikaguptamicrosoft,
tg-msft,
therealjohn,
trangevi and
trrwilson
as code owners
August 3, 2026 22:30
🔗 Linked Issue RequiredThanks for the contribution! Please link a GitHub issue to this PR by adding |
This was referenced Aug 3, 2026
Closed
jongio
reviewed
Aug 4, 2026
jongio
left a comment
jongio
left a comment
Member
There was a problem hiding this comment.
Re-reviewed at 395bba1. The lockfile fix holds up.
I verified both entries independently rather than taking the shape change at face value, since hand-editing integrity values is an easy way to silently break npm ci. Pulling the tarball shasums straight from the registry and base64-encoding them gives:
fast-uri@3.1.5->610f37419a030270430cecd68d74e3d4d96725d0->sha1-YQ83QZoDAnBDDOzWjXTj1NlnJdA=undici@7.29.0->ae0f6f62e06e057a9cbb7b2b5fde2bb74f791b8f->sha1-rg9vYuBuBXqcu3srX94rt095G48=
Both match what's committed. ext/vscode/package-lock.json is now internally consistent again at HEAD: zero resolved fields and zero sha512- entries across all 342 integrity values, so the CFSClean shape is intact. vscode (BuildAndTest GenerateReleaseArtifacts) also went green on this commit, which exercises the install path, so the edit didn't break resolution. The other four lockfiles in this PR keep their sha512 plus resolved shape, which is correct since they aren't under the same enforcement.
Two things still open, neither of them about the diff itself:
PR Governance is still red because the description has no linked issue. Adding Fixes #123 will clear it.
azure-dev - cli (BuildAndTest BuildCLI Mac) was failing at 3f535cc and is still in progress on this commit, so it's not confirmed yet. Worth watching, since the grpc 1.80.0 to 1.82.1 bump is the only cli/azd change here. The vscode pipeline legs are red again, but they fail with the same profile and timing they did before this branch, so those aren't from this change.
One optional thought: nothing in the repo currently detects a public-registry URL creeping back into that lockfile, which is exactly the regression that happened here. A small check over ext/vscode/package-lock.json that fails on resolved or sha512- would catch it at PR time instead of at review time. Not something this PR needs to solve.
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0. - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.10.0) --- updated-dependencies: - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.80.0 to 1.82.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.80.0...v1.82.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.80.0 to 1.82.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.80.0...v1.82.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.16 to 7.5.22. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.16...v7.5.22) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.22 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.80.0 to 1.82.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.80.0...v1.82.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.16 to 1.1.18. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.16...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.4...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [undici](https://github.com/nodejs/undici) from 7.28.0 to 7.29.0. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.28.0...v7.29.0) --- updated-dependencies: - dependency-name: undici dependency-version: 7.29.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [hono](https://github.com/honojs/hono) from 4.12.30 to 4.12.34. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.30...v4.12.34) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.34 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 31fa6854-d00e-4dd6-a2cb-b2f860d6375a
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 31fa6854-d00e-4dd6-a2cb-b2f860d6375a
vhvb1989
force-pushed
the
maintenance/dependabot-consolidation-20260803
branch
from
August 4, 2026 18:30
395bba1 to
432326e
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 15 out of 35 changed files in this pull request and generated no new comments.
Files not reviewed (5)
- .github/scripts/package-lock.json: Generated file
- cli/azd/test/evals/package-lock.json: Generated file
- eng/common/tsp-client/package-lock.json: Generated file
- ext/azuredevops/setupAzd/package-lock.json: Generated file
- ext/vscode/package-lock.json: Generated file
jongio
reviewed
Aug 4, 2026
jongio
left a comment
jongio
left a comment
Member
There was a problem hiding this comment.
The vscode pipeline is red on all three platforms and that's what's holding the merge. I dug into whether the lockfile change caused it, and I don't think it did.
What I checked against this exact HEAD:
Both hand-edited integrity values match the registry. I pulled dist.shasum for fast-uri 3.1.5 and undici 7.29.0, base64-encoded them, and they match the sha1- values here exactly. The file is internally consistent too, all 581 entries use sha1- with no resolved, so the CFSClean metadata survived this round.
undici and fast-uri are only reachable through @vscode/vsce, via cheerio and via @secretlint/node into ajv. Both are dev-only packaging deps, so nothing in lint, build, or test touches them.
I ran the full ci-test chain locally on Windows at 432326e: npm ci, npm run lint, npm run build, npm run test. All green, 93 tests passing.
So the lockfile looks fine and the failure is somewhere I can't see from outside. The annotations only say PowerShell exited with code '1' and the ADO logs aren't publicly readable. Linux vscode has been failing on main since at least 2026-07-23, so that leg is pre-existing, but Windows passed on the last four main commits that touched ext/vscode and fails here, so something did change.
One lead worth ruling out: eng/pipelines/templates/jobs/vscode-build.yml runs npm i -g npm @vscode/vsce unpinned, so every build picks up whatever npm is latest. npm 12.0.2 shipped on 7/29 and blocks install scripts by default. I reproduced that locally: under npm 12, npm ci still exits 0 and only warns, but keytar and @vscode/vsce-sign end up with no native binaries. It didn't break lint, build, or test for me, so I can't call it the cause, but an unpinned global npm major landing mid-flight is exactly the kind of thing that flips a green leg red without any code change. Pinning it would make these builds reproducible either way.
Can you pull the actual failing step out of the ADO run? I've exhausted what's visible from the GitHub side.
On the dependency content itself, I checked every version bump against the patched versions the alerts call for and they're all met or exceeded, and all 15 Go modules land on grpc v1.82.1 consistently.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 31fa6854-d00e-4dd6-a2cb-b2f860d6375a
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 15 out of 35 changed files in this pull request and generated no new comments.
Files not reviewed (5)
- .github/scripts/package-lock.json: Generated file
- cli/azd/test/evals/package-lock.json: Generated file
- eng/common/tsp-client/package-lock.json: Generated file
- ext/azuredevops/setupAzd/package-lock.json: Generated file
- ext/vscode/package-lock.json: Generated file
Contributor
VSCode Extension Installation Instructions
|
vhvb1989
enabled auto-merge (squash)
August 4, 2026 22:43
Contributor
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
Member
Author
|
@jongio Follow-up on the pipeline concern: I rebased onto the latest |
Member
Author
|
@jongio The linked-issue suggestion is intentionally not applied. This maintenance consolidation PR uses the |
hemarina
approved these changes
Aug 5, 2026
JeffreyCA
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates currently actionable Dependabot updates and mitigates current Dependabot security alerts. Multiple alerts for the same dependency are resolved by the highest required patched version. One update is blocked because the authenticated CI feed does not yet contain the patched package version.
Source Dependabot PRs
Security alerts
.github/scripts/package-lock.jsonpostcss8.5.18.github/scripts/package-lock.jsonpostcss8.5.23.github/scripts/package-lock.jsonundici6.28.0cli/azd/extensions/azure.ai.agents/go.modgoogle.golang.org/grpc1.82.1cli/azd/extensions/azure.ai.connections/go.modgoogle.golang.org/grpc1.82.1cli/azd/extensions/azure.ai.finetune/go.modgoogle.golang.org/grpc1.82.1cli/azd/extensions/azure.ai.inspector/go.modgoogle.golang.org/grpc1.82.1cli/azd/extensions/azure.ai.models/go.modgoogle.golang.org/grpc1.82.1cli/azd/extensions/azure.ai.projects/go.modgoogle.golang.org/grpc1.82.1cli/azd/extensions/azure.ai.rle/go.modgoogle.golang.org/grpc1.82.1cli/azd/extensions/azure.ai.routines/go.modgoogle.golang.org/grpc1.82.1cli/azd/extensions/azure.ai.skills/go.modgoogle.golang.org/grpc1.82.1cli/azd/extensions/azure.ai.toolboxes/go.modgoogle.golang.org/grpc1.82.1cli/azd/extensions/azure.ai.training/go.modgoogle.golang.org/grpc1.82.1cli/azd/extensions/azure.appservice/go.modgoogle.golang.org/grpc1.82.1cli/azd/extensions/azure.coding-agent/go.modgoogle.golang.org/grpc1.82.1cli/azd/extensions/microsoft.azd.concurx/go.modgoogle.golang.org/grpc1.82.1cli/azd/go.modgoogle.golang.org/grpc1.82.1cli/azd/test/evals/package-lock.jsonhono4.12.34eng/common/tsp-client/package-lock.jsonfast-uri3.1.3eng/common/tsp-client/package-lock.jsonfast-uri3.1.4eng/common/tsp-client/package-lock.jsonfast-uri3.1.5eng/common/tsp-client/package-lock.jsonshell-quote1.9.0eng/common/tsp-client/package-lock.jsontar7.5.17eng/common/tsp-client/package-lock.jsontar7.5.18eng/common/tsp-client/package-lock.jsontar7.5.19eng/common/tsp-client/package-lock.jsontar7.5.21ext/azuredevops/setupAzd/package-lock.jsonbrace-expansion1.1.17ext/azuredevops/setupAzd/package-lock.jsonbrace-expansion1.1.18ext/vscode/package-lock.jsonfast-uri3.1.5ext/vscode/package-lock.jsonundici7.29.0Validation
cd cli/azd && go build ./... && go test ./... -shortgo test ./...in each affected extension Go modulecd .github/scripts && npm ci --ignore-scripts && npm testcd eng/common/tsp-client && npm ci --ignore-scriptscd ext/azuredevops/setupAzd && npm ci --ignore-scripts && npm testcd ext/vscode && npm ci --ignore-scripts && npm run lint && npm run buildcd ext/vscode && npx vscode-test --config <headless-config>(93 tests passed)cd cli/azd/test/evals && npm ci --ignore-scripts && go test ./...Blocked items
fast-uri@3.1.5is not available from the authenticatedazure-sdk-for-jsnpm feed used by CFSClean CI. The alert remains open. PR chore(deps): bump fast-uri from 3.1.4 to 3.1.5 in /ext/vscode #9411 cannot be reopened because Dependabot deleted its head branch.Dependabot alerts will close automatically after this PR merges into
main.