Skip to content

Merge main into release/stable - #1328

Open
Rishabh Jain (MrRishabhJain) wants to merge 46 commits into
release/stablefrom
main
Open

Rishabh Jain (MrRishabhJain) wants to merge 46 commits into
release/stablefrom
main

Conversation

@MrRishabhJain

Copy link
Copy Markdown
Contributor

Summary

Requested by Jayanth Reddy Bujula (@jbujula)

Co-authored-by: Rishabh Jain <rishjain@microsoft.com>
* Updated brace-expansion version to 2.0.2

* updated with brace version

* updated packages
* Update overview.md

* Update nuget.json
* Update pac CLI to 1.49.4

* Add back pac CLI 1.44 release note line alongside 1.49

* Add pac CLI 1.44 release note to the overview

---------

Co-authored-by: Rishabh Jain <rishjain@microsoft.com>
* Override electron-to-chromium

* pinned version 1.5.191
* Override electron-to-chromium

* pinned version 1.5.191

* Updated electron to chromium version
* Override electron-to-chromium

* pinned version 1.5.191

* Updated electron to chromium version

* update package dependencies
Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.1.1 and updates ancestor dependency [gulp-mocha](https://github.com/sindresorhus/gulp-mocha). These dependencies need to be updated together.


Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `gulp-mocha` from 8.0.0 to 10.0.1
- [Release notes](https://github.com/sindresorhus/gulp-mocha/releases)
- [Commits](sindresorhus/gulp-mocha@v8.0.0...v10.0.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
- dependency-name: gulp-mocha
  dependency-version: 10.0.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
* Added claude skiils and updated dependencies

* updated tar fix

* updated with fixes
* Updated claude skills and dependencies

* updated package lock
* Add download-code-site and upload-code-site Azure DevOps tasks

Add new build tool tasks for Power Pages Code Site download and upload,
following the same pattern as existing download-paportal/upload-paportal
tasks. These tasks wrap the downloadCodeSite and uploadCodeSite actions
from the CLI wrapper.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix CI build: increase heap size and add task metadata

- Bump --max-old-space-size from 5120 to 8192 in package.json to fix
  OOM during webpack compile with 34 task entry points
- Add download-code-site and upload-code-site entries to
  extension/task-metadata.json with new GUIDs for all stages

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Rishabh Jain <rishjain@microsoft.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…lls (#1340)

* Updated claude skills and dependencies

* updated package lock

* fix: update OfficialBuild pipeline to Node 20.x and add claude agents

- Bump NodeTool from 16.x to 20.x in OfficialBuild.yml — cli-spinners@3.4.0
  uses `with {type: 'json'}` import attribute syntax (Node 20+ only), which
  broke the set-version step running release-it
- Add .claude/agents/ subagent prompts for PR, debug, dependencies, PAC CLI,
  work items, review, knowledge-sync workflows
- Add .claude/knowledge/architecture.md reference
- Update security-alerts.md to query both ADO area paths in parallel
- Add debug-agent.md command

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor: consolidate .claude/ to skills/ structure

Migrated from three duplicated directories (commands/, agents/, knowledge/)
to a single .claude/skills/<name>/SKILL.md layout matching the CDS repo pattern.

Each SKILL.md has frontmatter (name, description, allowed-tools, user-invocable)
which registers it as both a slash command and a subagent type — eliminating
the duplication where agents/ and commands/ held near-identical content.

Cross-reference fixes:
- /update-pac-cli → /pac-cli-update (create-pr, review)
- /create-pr → /pr (fix-dependencies, security-alerts, workitem, review, debug-agent)
- /review-pr → /review, /implement-workitem → /workitem (knowledge-sync)
- File path refs in knowledge-sync Step 7 updated to skills/ paths
- Invocation /debug-pipeline → /debug-agent

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: rename pr skill to create-pr; fix skill frontmatter

- Rename skills/pr/ → skills/create-pr/ for clarity
- Update all /pr references to /create-pr across skills
- Remove unsupported 'allowed-tools' frontmatter attribute from all SKILL.md files
- Replace unsupported 'args:' blocks with 'argument-hint:' strings
  (workitem, pac-cli-update, review, debug-agent)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: fix stale /pr refs and skill clarity issues

- workitem: /pr → /create-pr (frontmatter, step 7 header + body)
- knowledge-sync: skills/pr/ → skills/create-pr/; /fix-dependencies → /pac-cli-update in auto-invoke list
- debug-agent: rename duplicate section 2c → 2d
- review: remove "Step " prefix from sub-headings 3a/3b/3c
- create-pr: stripped branch-setup and build-verify steps (belong in callers)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 2.0.2 to 2.0.3.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 2.0.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [basic-ftp](https://github.com/patrickjuchli/basic-ftp) from 5.2.0 to 5.2.1.
- [Release notes](https://github.com/patrickjuchli/basic-ftp/releases)
- [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md)
- [Commits](patrickjuchli/basic-ftp@v5.2.0...v5.2.1)

---
updated-dependencies:
- dependency-name: basic-ftp
  dependency-version: 5.2.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.4.1 to 3.4.2.
- [Commits](WebReflection/flatted@v3.4.1...v3.4.2)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
…igning (#1349)

Filters out pac/_rels/.rels and pac_linux/_rels/.rels when copying the
pac CLI bin folder into the tool-installer staging directory.

These OPC metadata artifacts are left behind when the pac CLI NuGet
packages are extracted. When vsixsigntool.exe (ESRP) encounters them
inside the VSIX (itself an OPC container), the OPC parser fails with
error 0x80510005 because the .rels files reference non-existent targets.

Fixes: ICM 779156496

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
#1354)

Non-LIVE stages (BETA, DEV, EXPERIMENTAL) share the same extension manifest
as LIVE, causing 'duplicate contribution id' errors in the Marketplace when
all four stage packages are published simultaneously.

For non-LIVE stages, suffix the service endpoint contribution id and
properties.name with the lowercase stage name, and append the stage label
to displayName. Also update each task's connectedService input type to
reference the stage-specific endpoint id so tasks bind to the correct
service endpoint type at runtime.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
…46) (#1386)

Adds security validation to BuildToolsRunnerParams.runnersDir to ensure
the PAC CLI path read from POWERPLATFORMTOOLS_PACCLIPATH points to the
official PowerPlatformToolInstaller task directory.

A low-trust build step could previously overwrite the mutable job-scoped
variable to redirect protected tasks to an attacker-controlled PAC binary,
allowing credential theft via the service-connection auth flow.

The fix validates that:
1. The path is under the agent's _tasks directory
2. The path contains a known ToolInstaller task GUID (LIVE/BETA/DEV/EXPERIMENTAL)

If either check fails, the task fails closed before materializing any
service-connection credentials.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…, #6430957) (#1389)

* fix: mask SPN clientSecret and password via tl.setSecret (#6430957)

MSRC 117102: Power Platform Build Tools previously read clientSecret and password from the service connection without registering them with task-lib. As a result they appeared unmasked in pipeline logs and in task-lib debug output (e.g. `auth param clientSecret = <VALUE>` when System.Debug=true).

Call tl.setSecret() on clientSecret and password immediately after reading them in getClientCredentials() and getUsernamePassword() so task-lib masks them everywhere they are echoed. The existing pattern was already in place for the OIDC PAC_ADO_ID_TOKEN_REQUEST_TOKEN value.

The remaining /proc/<pid>/cmdline and PAC_CLI_SPN_SECRET env-var leaks are in @microsoft/powerplatform-cli-wrapper (pac auth create invocation) and must be addressed upstream.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: also mask base64-encoded form of clientSecret and password (#6430957)

Per review on #1389: the cli-wrapper passes the secret to pac as `data:text/plain;base64,<base64>`. Without registering the base64 form with task-lib, the encoded value would not be masked in pipeline logs even though the raw value is. Register both forms with tl.setSecret().

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…#1399)

Closes 4 PPBT S360 work items on KPI 240c2bea (BIC Component Governance):
- ADO #6364952 brace-expansion 1.1.12 -> 1.1.15 (target 1.1.13, CVE-2026-33750)
- ADO #6364953 brace-expansion 2.0.2 -> 2.0.3 (CVE-2026-33750)
- ADO #6364954 picomatch 2.3.1 -> 2.3.2 (CVE-2026-33672)
- ADO #6364955 brace-expansion 5.0.4 -> 5.0.6 (target 5.0.5, CVE-2026-33750)
- ADO #6408700 brace-expansion 5.0.4 -> 5.0.6 (CVE-2026-45149, same package paths)

Mechanism:
- package.json overrides: minimatch -> brace-expansion ^5.0.6 (handles 5.x paths
  in cli-wrapper, tfx-cli, glob, mocha, readdir-glob).
- package.json existing brace-expansion dep at ^2.0.3 (handles root 2.x hoist).
- Lock-file patches for inBundle: true paths that npm overrides cannot reach:
    - @microsoft/powerplatform-cli-wrapper bundled brace-expansion 5.0.4 -> 5.0.6
    - azure-pipelines-task-lib bundled minimatch@3.x's brace-expansion 1.1.12 -> 1.1.15
    - hoisted picomatch (inBundle=true) 2.3.1 -> 2.3.2

Verification:
- npm audit no longer reports brace-expansion or picomatch findings
- compile + lint + pac CLI 2.7.4 restore pass
- Pre-existing Node 24 unit-test ts-strip incompatibility is unrelated to this change
…ceeds (#1402)

The official build pipeline now creates a published GitHub Release automatically
on successful run (PR #1399's tooling change). Update both skills so contributors
know to look for the release at /releases/tag/v<version> after their PR ships:

- create-pr SKILL.md: Step 4 prompt now mentions the auto-release URL and what to
  do if it doesn't appear (token scope / SSO check).
- pac-cli-update SKILL.md: Step 9 final summary now includes the same guidance.
Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.5 to 0.2.7.
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](raszi/node-tmp@v0.2.5...v0.2.7)

---
updated-dependencies:
- dependency-name: tmp
  dependency-version: 0.2.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
…1410)

Resolves all 9 high-severity npm-audit findings plus Dependabot alerts
across transitive dev/runtime deps. Strategy:

- Bump existing overrides to patched versions: basic-ftp ^6.0.1,
  serialize-javascript ^7.0.5, postcss ^8.5.15, qs ^6.15.2
- New flat overrides (single-major, single-instance, safe): tmp ^0.2.7,
  undici ^6.24.0, defu ^6.1.7, flatted ^3.4.2, form-data ^2.5.6,
  ip-address ^10.2.0, js-yaml ^4.2.0, lodash ^4.18.1
- Scoped overrides to avoid forcing inBundle siblings: tinyglobby>picomatch
  ^4.0.4 (leaves inBundle picomatch 2.3.2), tfx-cli>uuid ^13.0.1 (leaves
  inBundle uuid 3.4.0 under azure-pipelines-task-lib)
- Direct dep bump: tar ^7.5.16
- Lock-file patch (Strategy C) for follow-redirects 1.15.11 -> 1.16.0;
  overrides cannot reach it (inBundle via bundled cli-wrapper subtree)

Remaining 8 (down from 28) are documented accepted-risk/deferred:
- 6 low: elliptic chain (GHSA-848j-6mx2-7j84, dev-only, no patch)
- 2 moderate: uuid 3.4.0 bundled in azure-pipelines-task-lib (requires
  uuid ^3.0.1) -> needs upstream fix; cannot override a bundled subtree

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Update CLI version to 1.44.2 (#1181)

Co-authored-by: Rishabh Jain <rishjain@microsoft.com>

* Users/jbujula/cliversion1.46.1 release (#1215)

* Update overview.md

* Update nuget.json

* Revert "Users/jbujula/cliversion1.46.1 release (#1215)" (#1219)

This reverts commit 26f9ff2.

* [release] Update Pac CLI to 1.49.4 (#1251)

* Replicate diff from PR #1250: bump pac CLI to 1.49.4 and add 2.0.94 block

* Fix formatting in overview.md by removing extra blank line

* Update extension/overview.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Rishabh Jain <rishjain@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Override electron-to-chromium (#1270)

* pinned version to 1.5.191 (#1271)

* updated node version (#1274)

* Users/jbujula/update dependencies electon to chromium release 2 (#1276)

* pinned version to 1.5.191

* Update electron-to-chromium

* Users/jbujula/update dependencies electon to chromium release 2 (#1277)

* pinned version to 1.5.191

* Update electron-to-chromium

* Update webpack version to match ado upstream

* Updated cli version to 1.52.1 (#1302)

* Merge main into release/stable for pipeline build and package publish (#1331)

Includes download-code-site and upload-code-site tasks (#1318),
claude skills, dependency updates (webpack ^5.105.4, security overrides),
and pac CLI 1.52.1.

Co-authored-by: Rishabh Jain <rishjain@microsoft.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: update OfficialBuild pipeline to Node 20.x; add claude agent skills (#1340) (#1341)

* Updated claude skills and dependencies

* updated package lock

* fix: update OfficialBuild pipeline to Node 20.x and add claude agents

- Bump NodeTool from 16.x to 20.x in OfficialBuild.yml — cli-spinners@3.4.0
  uses `with {type: 'json'}` import attribute syntax (Node 20+ only), which
  broke the set-version step running release-it
- Add .claude/agents/ subagent prompts for PR, debug, dependencies, PAC CLI,
  work items, review, knowledge-sync workflows
- Add .claude/knowledge/architecture.md reference
- Update security-alerts.md to query both ADO area paths in parallel
- Add debug-agent.md command



* refactor: consolidate .claude/ to skills/ structure

Migrated from three duplicated directories (commands/, agents/, knowledge/)
to a single .claude/skills/<name>/SKILL.md layout matching the CDS repo pattern.

Each SKILL.md has frontmatter (name, description, allowed-tools, user-invocable)
which registers it as both a slash command and a subagent type — eliminating
the duplication where agents/ and commands/ held near-identical content.

Cross-reference fixes:
- /update-pac-cli → /pac-cli-update (create-pr, review)
- /create-pr → /pr (fix-dependencies, security-alerts, workitem, review, debug-agent)
- /review-pr → /review, /implement-workitem → /workitem (knowledge-sync)
- File path refs in knowledge-sync Step 7 updated to skills/ paths
- Invocation /debug-pipeline → /debug-agent



* chore: rename pr skill to create-pr; fix skill frontmatter

- Rename skills/pr/ → skills/create-pr/ for clarity
- Update all /pr references to /create-pr across skills
- Remove unsupported 'allowed-tools' frontmatter attribute from all SKILL.md files
- Replace unsupported 'args:' blocks with 'argument-hint:' strings
  (workitem, pac-cli-update, review, debug-agent)



* chore: fix stale /pr refs and skill clarity issues

- workitem: /pr → /create-pr (frontmatter, step 7 header + body)
- knowledge-sync: skills/pr/ → skills/create-pr/; /fix-dependencies → /pac-cli-update in auto-invoke list
- debug-agent: rename duplicate section 2c → 2d
- review: remove "Step " prefix from sub-headings 3a/3b/3c
- create-pr: stripped branch-setup and build-verify steps (belong in callers)



---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: exclude nested _rels/.rels files from VSIX bin folder for ESRP signing (#1350)

Filters out pac/_rels/.rels and pac_linux/_rels/.rels when copying the
pac CLI bin folder into the tool-installer staging directory.

These OPC metadata artifacts are left behind when the pac CLI NuGet
packages are extracted. When vsixsigntool.exe (ESRP) encounters them
inside the VSIX (itself an OPC container), the OPC parser fails with
error 0x80510005 because the .rels files reference non-existent targets.

Fixes: ICM 779156496

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: make service endpoint contributions unique per stage in VSIX pack (#1355)

Non-LIVE stages (BETA, DEV, EXPERIMENTAL) share the same extension manifest
as LIVE, causing 'duplicate contribution id' errors in the Marketplace when
all four stage packages are published simultaneously.

For non-LIVE stages, suffix the service endpoint contribution id and
properties.name with the lowercase stage name, and append the stage label
to displayName. Also update each task's connectedService input type to
reference the stage-specific endpoint id so tasks bind to the correct
service endpoint type at runtime.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat: publish non-LIVE stage extensions publicly to VS Marketplace (#1357)

BETA, DEV, and EXPERIMENTAL stage VSIXs were marked public=false,
keeping them unlisted on the Marketplace. Setting public=true makes
them discoverable so testers and preview users can install them
without needing a direct install link.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: update create-pr skill with dual-PR and build prompt workflow (#1359)

- Step 2: capture branch/SHAs before creating main PR
- Step 3: auto cherry-pick to release/stable, push, open paired PR
- Step 4: prompt user to queue pipeline 21491 with required variables
  (GITHUB_TOKEN, AZ_DevOps_Read_PAT, isEsrpEnabled, PUBLISH_TO_MARKETPLACE)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: update pac CLI to 2.6.4 (#1363)

* fix: add Override entries to VSIX [Content_Types].xml for extension-less pac CLI files (#1367)

* chore: update pac CLI to 2.7.4 (#1377)

* fix: validate PAC CLI path to prevent mutable variable hijack (#6414246) (#1387)

Adds security validation to BuildToolsRunnerParams.runnersDir to ensure
the PAC CLI path read from POWERPLATFORMTOOLS_PACCLIPATH points to the
official PowerPlatformToolInstaller task directory.

A low-trust build step could previously overwrite the mutable job-scoped
variable to redirect protected tasks to an attacker-controlled PAC binary,
allowing credential theft via the service-connection auth flow.

The fix validates that:
1. The path is under the agent's _tasks directory
2. The path contains a known ToolInstaller task GUID (LIVE/BETA/DEV/EXPERIMENTAL)

If either check fails, the task fails closed before materializing any
service-connection credentials.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: mask SPN clientSecret and password via tl.setSecret (MSRC 117102, #6430957) (#1390)

* fix: mask SPN clientSecret and password via tl.setSecret (#6430957)

MSRC 117102: Power Platform Build Tools previously read clientSecret and password from the service connection without registering them with task-lib. As a result they appeared unmasked in pipeline logs and in task-lib debug output (e.g. `auth param clientSecret = <VALUE>` when System.Debug=true).

Call tl.setSecret() on clientSecret and password immediately after reading them in getClientCredentials() and getUsernamePassword() so task-lib masks them everywhere they are echoed. The existing pattern was already in place for the OIDC PAC_ADO_ID_TOKEN_REQUEST_TOKEN value.

The remaining /proc/<pid>/cmdline and PAC_CLI_SPN_SECRET env-var leaks are in @microsoft/powerplatform-cli-wrapper (pac auth create invocation) and must be addressed upstream.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: also mask base64-encoded form of clientSecret and password (#6430957)

Per review on #1389: the cli-wrapper passes the secret to pac as `data:text/plain;base64,<base64>`. Without registering the base64 form with task-lib, the encoded value would not be masked in pipeline logs even though the raw value is. Register both forms with tl.setSecret().

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore: update pac CLI to 2.8.1 (#1395)

* revert: pac CLI 2.8.1 -> 2.7.4 due to upstream bug (#1398)

* fix: bump brace-expansion + picomatch to patched versions (S360 CVEs) (#1400)

Closes 4 PPBT S360 work items on KPI 240c2bea (BIC Component Governance):
- ADO #6364952 brace-expansion 1.1.12 -> 1.1.15 (target 1.1.13, CVE-2026-33750)
- ADO #6364953 brace-expansion 2.0.2 -> 2.0.3 (CVE-2026-33750)
- ADO #6364954 picomatch 2.3.1 -> 2.3.2 (CVE-2026-33672)
- ADO #6364955 brace-expansion 5.0.4 -> 5.0.6 (target 5.0.5, CVE-2026-33750)
- ADO #6408700 brace-expansion 5.0.4 -> 5.0.6 (CVE-2026-45149, same package paths)

Mechanism:
- package.json overrides: minimatch -> brace-expansion ^5.0.6 (handles 5.x paths
  in cli-wrapper, tfx-cli, glob, mocha, readdir-glob).
- package.json existing brace-expansion dep at ^2.0.3 (handles root 2.x hoist).
- Lock-file patches for inBundle: true paths that npm overrides cannot reach:
    - @microsoft/powerplatform-cli-wrapper bundled brace-expansion 5.0.4 -> 5.0.6
    - azure-pipelines-task-lib bundled minimatch@3.x's brace-expansion 1.1.12 -> 1.1.15
    - hoisted picomatch (inBundle=true) 2.3.1 -> 2.3.2

Verification:
- npm audit no longer reports brace-expansion or picomatch findings
- compile + lint + pac CLI 2.7.4 restore pass
- Pre-existing Node 24 unit-test ts-strip incompatibility is unrelated to this change

* docs(skills): document auto-created GitHub Release after pipeline succeeds (#1403)

The official build pipeline now creates a published GitHub Release automatically
on successful run (PR #1399's tooling change). Update both skills so contributors
know to look for the release at /releases/tag/v<version> after their PR ships:

- create-pr SKILL.md: Step 4 prompt now mentions the auto-release URL and what to
  do if it doesn't appear (token scope / SSO check).
- pac-cli-update SKILL.md: Step 9 final summary now includes the same guidance.

* chore: fix dependency vulnerabilities (28 -> 8, all highs resolved)

Resolves all 9 high-severity npm-audit findings plus Dependabot alerts
across transitive dev/runtime deps. Strategy:

- Bump existing overrides to patched versions: basic-ftp ^6.0.1,
  serialize-javascript ^7.0.5, postcss ^8.5.15, qs ^6.15.2
- New flat overrides (single-major, single-instance, safe): tmp ^0.2.7,
  undici ^6.24.0, defu ^6.1.7, flatted ^3.4.2, form-data ^2.5.6,
  ip-address ^10.2.0, js-yaml ^4.2.0, lodash ^4.18.1
- Scoped overrides to avoid forcing inBundle siblings: tinyglobby>picomatch
  ^4.0.4 (leaves inBundle picomatch 2.3.2), tfx-cli>uuid ^13.0.1 (leaves
  inBundle uuid 3.4.0 under azure-pipelines-task-lib)
- Direct dep bump: tar ^7.5.16
- Lock-file patch (Strategy C) for follow-redirects 1.15.11 -> 1.16.0;
  overrides cannot reach it (inBundle via bundled cli-wrapper subtree)

Remaining 8 (down from 28) are documented accepted-risk/deferred:
- 6 low: elliptic chain (GHSA-848j-6mx2-7j84, dev-only, no patch)
- 2 moderate: uuid 3.4.0 bundled in azure-pipelines-task-lib (requires
  uuid ^3.0.1) -> needs upstream fix; cannot override a bundled subtree

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: fix uuid vulnerability (CVE-2026-41907) by upgrading azure-pipelines-task-lib

Upgrade azure-pipelines-task-lib 5.2.8 -> 5.277.0, which drops its transitive dependency on the vulnerable uuid@3.4.0 (CVE-2026-41907). uuid no longer appears in the tree via azure-pipelines-task-lib. npm audit no longer reports the moderate uuid finding.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Rishabh Jain <rishabhmj21@gmail.com>
Co-authored-by: Rishabh Jain <rishjain@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Brad Flood <63075802+brflood@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
#1420)

PR #1418 merged azure-pipelines-task-lib@^5.277.0, but the official pipeline (PowerPlatform-DPX-Tools-GitHub-BT-Official) restores from the DPX-Tools-Upstream Azure Artifacts feed, which does not carry 5.277.0 (npm 404). The feed does carry 5.276.0, which likewise drops the transitive uuid@3.4.0 dependency, keeping CVE-2026-41907 fixed. Pinned exactly (no caret) so npm cannot re-resolve to the feed-missing 5.277.0.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Rishabh Jain <rishjain@microsoft.com>
Copilot-Session: 5a0fd990-27f4-4a2a-8df7-3b81302917c1
…#1433)

* Fix GHSA-73rr-hh4g-fpgx: bump diff (jsdiff) override ^5.2.0 -> ^8.0.3

Resolves the S360 SDL action item 6014425 (jsdiff parsePatch DoS/ReDoS,
GHSA-73rr-hh4g-fpgx), patched in jsdiff 8.0.3. Lockfile resolves to 8.0.4.
Build passes; local mocha suite is blocked by a pre-existing Node 24
TypeScript-loader issue present on origin/main, unrelated to this change.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: de0407b8-fb71-416c-8f0c-d03c0a7e0ef7

* chore: fix dependency vulnerabilities (S360 + Dependabot + npm audit)

Fixed:
- tar        ^7.5.16 -> ^7.5.22  (critical: GHSA-w8wr-v893-vjvp, GHSA-23hp-3jrh-7fpw, GHSA-8x88-c5mf-7j5w, GHSA-gvwx-54wh-qm9j, GHSA-r292-9mhp-454m)
- postcss    ^8.5.15 -> ^8.5.25  (high: GHSA-r28c-9q8g-f849, GHSA-fxqj-rqcc-2cmp)
- ip-address ^10.2.0 -> ^10.3.1  (high: GHSA-mwp4-54f8-5fhr, GHSA-4xrf-jv44-h6hh, GHSA-22jq-vg5j-6vgg)
- js-yaml    ^4.2.0  -> ^4.3.0   (high: GHSA-52cp-r559-cp3m / CVE-2025-64718, S360 6587259)
- adm-zip    ^0.5.16 -> ^0.6.0   (high: GHSA-xcpc-8h2w-3j85)
- undici     ^6.24.0 -> ^6.28.0  (moderate: GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcm)
- brace-expansion v5 ^5.0.6 -> ^5.0.8, v2 ^2.0.3 -> ^2.1.3, v1 1.1.15 -> 1.1.17
  (high: GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg; S360 6587257/6587260/6587261)

The two bundled brace-expansion copies (under @microsoft/powerplatform-cli-wrapper
and minimatch) are inBundle and cannot be reached by npm overrides, so they are
patched directly in package-lock.json.

Accepted risk (no published fix):
- brace-expansion GHSA-rgw5-rvv9-x895 - patched version 5.0.9 is not published;
  5.0.8 is the latest available. Remaining "high" audit entries are all transitive
  paths to this single advisory.
- elliptic GHSA-848j-6mx2-7j84 - dev-only, no patched version (permanent accepted risk).

Verified: npm run ci -> compile + lint pass. Unit tests fail locally with a
pre-existing ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX error under Node v24 that reproduces
on the unmodified dependency tree; not caused by this change.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292

* fix(security): take fully-patched brace-expansion, js-yaml and nanoid

The 1ES feed mirror has caught up, so versions that were unreachable last week are
now installable. This closes the advisories that were previously left open.

  brace-expansion  2.1.3 -> 2.1.4, 5.0.8 -> 5.0.9, 1.1.17 -> 1.1.18
    closes GHSA-rgw5-rvv9-x895 (CVE-2026-69152), previously recorded as unfixable
  js-yaml          4.3.0 -> 4.3.1   closes GHSA-5p4m-2wfm-xmqj
  nanoid           3.3.11 -> 3.3.17 closes GHSA-2v37-7h3g-55p8 and GHSA-28wg-ghj8-5hjv
    the override pinned nanoid to an exact 3.3.11, which was blocking the fix

postcss stays at 8.5.25, which already exceeds the highest patched version (8.5.23).

npm audit high/moderate/critical count is now zero; the 6 remaining low findings are
the documented dev-only elliptic/rewiremock accepted risk.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: de0407b8-fb71-416c-8f0c-d03c0a7e0ef7
Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292
* chore: automate dependency security fixes

Dependabot cannot read or update the npm `overrides` block, and almost every
vulnerability in this repo is transitive and pinned through `overrides`. That gap
is why the same S360/Component Governance alerts are re-raised every week and have
to be fixed by hand.

Adds:
- scripts/audit-overrides.js - resolves `npm audit` output against the GitHub
  Advisory DB, compares each advisory against every installed copy in the lock
  file, and raises the `overrides` range only when the patched version is actually
  published. Reports (rather than guesses at) bundled copies, packages spanning
  several major lines, and advisories with no published fix.
- (workflow file .github/workflows/dependency-security.yml is added in a follow-up; the push token lacks the `workflow` OAuth scope)
- dependabot.yml - grouped minor/patch updates, github-actions ecosystem, and
  ignores for the deliberately pinned `ajv` and `azure-pipelines-task-lib`.

Key finding driving the design: most alerts are a stale lock file rather than a
too-low range. `postcss` at `^8.5.15` already permitted the patched `8.5.25`, and
the same was true for `tar`, `ip-address` and `undici` - `npm update` alone fixes
those, with no manifest edit.

Validated against the unfixed tree on main: the script independently reproduced
the manual fix plan (stale-lock refresh for tar/postcss/ip-address/undici, a real
bump for adm-zip) and correctly refused to emit a flat `brace-expansion` override,
which would have downgraded the 2.x and 5.x copies to 1.1.17.

Also records both learnings in the security-alerts skill.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292

* chore: request review on dependency PRs via CODEOWNERS

Dependabot's 
eviewers: option was retired in 2025 in favour of CODEOWNERS, and
this repo had no CODEOWNERS file, so dependency PRs were raised with no reviewer
requested and no notification to anyone.

Scoped to the dependency and security-automation files only, so unrelated PRs are
not affected. Nothing auto-merges - every PR still needs a human to merge it.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292

* chore: assign dependency PR reviews to managed-app-devops-team

Verified the team has \maintain\ (push) on this repo; CODEOWNERS silently ignores
teams without write access.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292

* chore: add weekly dependency security refresh workflow

Runs npm ci -> npm update -> scripts/audit-overrides.js --write -> npm install ->
npm run ci, and opens a PR only if the build is green. Reviewers come from
.github/CODEOWNERS.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292

* chore: distinguish feed-mirror lag from a genuinely missing fix

The 1ES feed mirror can trail the public npm registry by days. brace-expansion
1.1.18 / 2.1.4 / 5.0.9 were published upstream and picked up by Dependabot (#1437)
while \
pm view\ against our mirror still reported 5.0.8 as latest, which made an
available fix look like an unfixable advisory.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292

* chore: have CODEOWNERS cover every workflow file

dependabot.yml enables the github-actions ecosystem, which raises PRs against any
workflow (PullRequest.yml, codeql.yml, post-release.yml). CODEOWNERS only listed
dependency-security.yml, so those PRs would have landed with no reviewer requested.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292

* fix: escape backslashes when quoting Windows command arguments

CodeQL js/incomplete-sanitization: escaping only the quote character left
a trailing backslash able to escape the closing quote. Backslash runs that
precede a quote (or end the argument) are now doubled per Windows
command-line parsing rules.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292
* fix: anchor PAC paths to the trusted task cache

Resolve the PAC installation from the executing task's cache, validate filesystem containment, and retain the canonical runner directory. Add native filesystem regressions for path imitations, links, and directory identity.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* test: fix PAC path error assertions for Chai typings

Capture and narrow thrown errors explicitly instead of reading assert.throws' void-typed result. Preserve message, filesystem-code, and error-identity assertions.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Gene Chu <genechu@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@microsoft-github-policy-service

Copy link
Copy Markdown

Rishabh Jain (@MrRishabhJain) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

  • (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
  • (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement

Contribution License Agreement

This Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
and conveys certain license rights to Microsoft Corporation and its affiliates (“Microsoft”) for Your
contributions to Microsoft open source projects. This Agreement is effective as of the latest signature
date below.

  1. Definitions.
    “Code” means the computer software code, whether in human-readable or machine-executable form,
    that is delivered by You to Microsoft under this Agreement.
    “Project” means any of the projects owned or managed by Microsoft and offered under a license
    approved by the Open Source Initiative (www.opensource.org).
    “Submit” is the act of uploading, submitting, transmitting, or distributing code or other content to any
    Project, including but not limited to communication on electronic mailing lists, source code control
    systems, and issue tracking systems that are managed by, or on behalf of, the Project for the purpose of
    discussing and improving that Project, but excluding communication that is conspicuously marked or
    otherwise designated in writing by You as “Not a Submission.”
    “Submission” means the Code and any other copyrightable material Submitted by You, including any
    associated comments and documentation.
  2. Your Submission. You must agree to the terms of this Agreement before making a Submission to any
    Project. This Agreement covers any and all Submissions that You, now or in the future (except as
    described in Section 4 below), Submit to any Project.
  3. Originality of Work. You represent that each of Your Submissions is entirely Your original work.
    Should You wish to Submit materials that are not Your original work, You may Submit them separately
    to the Project if You (a) retain all copyright and license information that was in the materials as You
    received them, (b) in the description accompanying Your Submission, include the phrase “Submission
    containing materials of a third party:” followed by the names of the third party and any licenses or other
    restrictions of which You are aware, and (c) follow any other instructions in the Project’s written
    guidelines concerning Submissions.
  4. Your Employer. References to “employer” in this Agreement include Your employer or anyone else
    for whom You are acting in making Your Submission, e.g. as a contractor, vendor, or agent. If Your
    Submission is made in the course of Your work for an employer or Your employer has intellectual
    property rights in Your Submission by contract or applicable law, You must secure permission from Your
    employer to make the Submission before signing this Agreement. In that case, the term “You” in this
    Agreement will refer to You and the employer collectively. If You change employers in the future and
    desire to Submit additional Submissions for the new employer, then You agree to sign a new Agreement
    and secure permission from the new employer before Submitting those Submissions.
  5. Licenses.
  • Copyright License. You grant Microsoft, and those who receive the Submission directly or
    indirectly from Microsoft, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license in the
    Submission to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute
    the Submission and such derivative works, and to sublicense any or all of the foregoing rights to third
    parties.
  • Patent License. You grant Microsoft, and those who receive the Submission directly or
    indirectly from Microsoft, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license under
    Your patent claims that are necessarily infringed by the Submission or the combination of the
    Submission with the Project to which it was Submitted to make, have made, use, offer to sell, sell and
    import or otherwise dispose of the Submission alone or with the Project.
  • Other Rights Reserved. Each party reserves all rights not expressly granted in this Agreement.
    No additional licenses or rights whatsoever (including, without limitation, any implied licenses) are
    granted by implication, exhaustion, estoppel or otherwise.
  1. Representations and Warranties. You represent that You are legally entitled to grant the above
    licenses. You represent that each of Your Submissions is entirely Your original work (except as You may
    have disclosed under Section 3). You represent that You have secured permission from Your employer to
    make the Submission in cases where Your Submission is made in the course of Your work for Your
    employer or Your employer has intellectual property rights in Your Submission by contract or applicable
    law. If You are signing this Agreement on behalf of Your employer, You represent and warrant that You
    have the necessary authority to bind the listed employer to the obligations contained in this Agreement.
    You are not expected to provide support for Your Submission, unless You choose to do so. UNLESS
    REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING, AND EXCEPT FOR THE WARRANTIES
    EXPRESSLY STATED IN SECTIONS 3, 4, AND 6, THE SUBMISSION PROVIDED UNDER THIS AGREEMENT IS
    PROVIDED WITHOUT WARRANTY OF ANY KIND, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY OF
    NONINFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE.
  2. Notice to Microsoft. You agree to notify Microsoft in writing of any facts or circumstances of which
    You later become aware that would make Your representations in this Agreement inaccurate in any
    respect.
  3. Information about Submissions. You agree that contributions to Projects and information about
    contributions may be maintained indefinitely and disclosed publicly, including Your name and other
    information that You submit with Your Submission.
  4. Governing Law/Jurisdiction. This Agreement is governed by the laws of the State of Washington, and
    the parties consent to exclusive jurisdiction and venue in the federal courts sitting in King County,
    Washington, unless no federal subject matter jurisdiction exists, in which case the parties consent to
    exclusive jurisdiction and venue in the Superior Court of King County, Washington. The parties waive all
    defenses of lack of personal jurisdiction and forum non-conveniens.
  5. Entire Agreement/Assignment. This Agreement is the entire agreement between the parties, and
    supersedes any and all prior agreements, understandings or communications, written or oral, between
    the parties relating to the subject matter hereof. This Agreement may be assigned by Microsoft.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants