Skip to content

fix: dependabot package upgrades#438

Open
Ayaz-Microsoft wants to merge 8 commits into
devfrom
feature/dependabot-upgrades-may2026
Open

fix: dependabot package upgrades#438
Ayaz-Microsoft wants to merge 8 commits into
devfrom
feature/dependabot-upgrades-may2026

Conversation

@Ayaz-Microsoft
Copy link
Copy Markdown
Contributor

@Ayaz-Microsoft Ayaz-Microsoft commented May 20, 2026 •
edited
Loading

Purpose

Down-merge dependabotchanges into dev and bring all pending Dependabot upgrades into the dev branch. Addresses known security vulnerabilities.

Changes

Python (src/backend/requirements.txt)

Package From To
semantic-kernel[azure] 1.41.1 1.41.3

Note: opentelemetry-* and azure-ai-projects are intentionally kept at dev's versions (sdk/api 1.40.0, semconv/instrumentation 0.61b0, fastapi 0.61b0, azure-ai-projects 1.0.0b12) because:

  • azure-monitor-opentelemetry==1.8.7 strictly pins opentelemetry-sdk==1.40
  • semantic-kernel==1.41.3 requires azure-ai-projects~=1.0.0b12
    Upgrading either would cause pip ResolutionImpossible. Will be unblocked when upstream umbrellas catch up.

NPM - Frontend (src/frontend/package.json)

Package From To
@fluentui/react-components ^9.73.6 ^9.73.8
@fluentui/react-icons ^2.0.323 ^2.0.325
@tailwindcss/vite ^4.2.2 ^4.2.4
@tailwindcss/postcss ^4.2.2 ^4.2.4
autoprefixer ^10.4.27 ^10.5.0
axios ^1.15.0 ^1.15.2
lucide-react ^1.7.0 ^1.14.0
postcss ^8.5.8 ^8.5.13
react ^19.2.4 ^19.2.5
react-dom ^19.2.4 ^19.2.5
react-router-dom ^7.13.2 ^7.14.2
uuid ^13.0.0 ^14.0.0
@azure/msal-browser ^5.6.2 ^5.9.0
@azure/msal-react ^5.2.0 ^5.3.2
globals ^17.4.0 ^17.5.0
rollup ^4.60.1 ^4.60.2
vite ^8.0.3 ^8.0.10
vite-plugin-svgr ^5.0.0 ^5.2.0

Note: eslint and @eslint/js are kept at ^9.39.2 (not upgraded to v10) because eslint-plugin-react@7.37.5 only supports eslint up to v9.7. A v10 bump would break the strict npm install used in the Docker build.

Engines

  • Added engines.node: ">=20" to src/frontend/package.json (required by uuid@14 and @azure/msal-react@5; matches Dockerfile FROM node:22).

Overrides (preserved from dev)

follow-redirects ^1.16.0, minimatch ^3.1.5, flatted 3.4.2, js-yaml 4.1.1, picomatch 4.0.4

Related Dependabot PRs (all covered)

Validation

  • ✅ PyLint
  • ✅ Backend tests
  • ✅ Docker build (frontend & backend)

ADO Work Item

https://dev.azure.com/CSACTOSOL/CSA%20Solutioning/_queries/edit/43443/

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

dependabot Bot and others added 4 commits May 2, 2026 00:22
@dependabot @github-actions
build: bump the all-frontend-deps group in /src/frontend with 21 updates
6f3e98b 
Bumps the all-frontend-deps group in /src/frontend with 21 updates:

| Package | From | To |
| --- | --- | --- |
| [@fluentui/react-components](https://github.com/microsoft/fluentui) | `9.73.6` | `9.73.8` |
| [@fluentui/react-icons](https://github.com/microsoft/fluentui-system-icons) | `2.0.323` | `2.0.325` |
| [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.2.2` | `4.2.4` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.4.27` | `10.5.0` |
| [axios](https://github.com/axios/axios) | `1.15.0` | `1.15.2` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.7.0` | `1.14.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.8` | `8.5.13` |
| [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.2` | `4.2.4` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.5` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.5` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.13.2` | `7.14.2` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.2` | `4.2.4` |
| [uuid](https://github.com/uuidjs/uuid) | `13.0.0` | `14.0.0` |
| [@azure/msal-browser](https://github.com/AzureAD/microsoft-authentication-library-for-js) | `5.6.2` | `5.9.0` |
| [@azure/msal-react](https://github.com/AzureAD/microsoft-authentication-library-for-js) | `5.2.0` | `5.3.2` |
| [eslint](https://github.com/eslint/eslint) | `10.1.0` | `10.2.1` |
| [eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks) | `7.0.1` | `7.1.1` |
| [globals](https://github.com/sindresorhus/globals) | `17.4.0` | `17.5.0` |
| [rollup](https://github.com/rollup/rollup) | `4.60.1` | `4.60.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.3` | `8.0.10` |
| [vite-plugin-svgr](https://github.com/pd4d10/vite-plugin-svgr) | `5.0.0` | `5.2.0` |


Updates `@fluentui/react-components` from 9.73.6 to 9.73.8
- [Release notes](https://github.com/microsoft/fluentui/releases)
- [Commits](https://github.com/microsoft/fluentui/commits)

Updates `@fluentui/react-icons` from 2.0.323 to 2.0.325
- [Changelog](https://github.com/microsoft/fluentui-system-icons/blob/main/docs/releases.md)
- [Commits](https://github.com/microsoft/fluentui-system-icons/commits)

Updates `@tailwindcss/vite` from 4.2.2 to 4.2.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.4/packages/@tailwindcss-vite)

Updates `autoprefixer` from 10.4.27 to 10.5.0
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.4.27...10.5.0)

Updates `axios` from 1.15.0 to 1.15.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.15.0...v1.15.2)

Updates `lucide-react` from 1.7.0 to 1.14.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.14.0/packages/lucide-react)

Updates `postcss` from 8.5.8 to 8.5.13
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.8...8.5.13)

Updates `@tailwindcss/postcss` from 4.2.2 to 4.2.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.4/packages/@tailwindcss-postcss)

Updates `react` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react)

Updates `react-dom` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react-dom)

Updates `react-router-dom` from 7.13.2 to 7.14.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.14.2/packages/react-router-dom)

Updates `tailwindcss` from 4.2.2 to 4.2.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.4/packages/tailwindcss)

Updates `uuid` from 13.0.0 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v13.0.0...v14.0.0)

Updates `@azure/msal-browser` from 5.6.2 to 5.9.0
- [Release notes](https://github.com/AzureAD/microsoft-authentication-library-for-js/releases)
- [Commits](AzureAD/microsoft-authentication-library-for-js@msal-browser-v5.6.2...msal-browser-v5.9.0)

Updates `@azure/msal-react` from 5.2.0 to 5.3.2
- [Release notes](https://github.com/AzureAD/microsoft-authentication-library-for-js/releases)
- [Commits](AzureAD/microsoft-authentication-library-for-js@msal-react-v5.2.0...msal-react-v5.3.2)

Updates `eslint` from 10.1.0 to 10.2.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.1.0...v10.2.1)

Updates `eslint-plugin-react-hooks` from 7.0.1 to 7.1.1
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/eslint-plugin-react-hooks@7.1.1/packages/eslint-plugin-react-hooks)

Updates `globals` from 17.4.0 to 17.5.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.4.0...v17.5.0)

Updates `rollup` from 4.60.1 to 4.60.2
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.60.1...v4.60.2)

Updates `vite` from 8.0.3 to 8.0.10
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.10/packages/vite)

Updates `vite-plugin-svgr` from 5.0.0 to 5.2.0
- [Release notes](https://github.com/pd4d10/vite-plugin-svgr/releases)
- [Commits](pd4d10/vite-plugin-svgr@v5.0.0...v5.2.0)

---
updated-dependencies:
- dependency-name: "@fluentui/react-components"
  dependency-version: 9.73.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-frontend-deps
- dependency-name: "@fluentui/react-icons"
  dependency-version: 2.0.325
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-frontend-deps
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-frontend-deps
- dependency-name: autoprefixer
  dependency-version: 10.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-frontend-deps
- dependency-name: axios
  dependency-version: 1.15.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-frontend-deps
- dependency-name: lucide-react
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-frontend-deps
- dependency-name: postcss
  dependency-version: 8.5.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-frontend-deps
- dependency-name: "@tailwindcss/postcss"
  dependency-version: 4.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-frontend-deps
- dependency-name: react
  dependency-version: 19.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-frontend-deps
- dependency-name: react-dom
  dependency-version: 19.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-frontend-deps
- dependency-name: react-router-dom
  dependency-version: 7.14.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-frontend-deps
- dependency-name: tailwindcss
  dependency-version: 4.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-frontend-deps
- dependency-name: uuid
  dependency-version: 14.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-frontend-deps
- dependency-name: "@azure/msal-browser"
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-frontend-deps
- dependency-name: "@azure/msal-react"
  dependency-version: 5.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-frontend-deps
- dependency-name: eslint
  dependency-version: 10.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-frontend-deps
- dependency-name: eslint-plugin-react-hooks
  dependency-version: 7.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-frontend-deps
- dependency-name: globals
  dependency-version: 17.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-frontend-deps
- dependency-name: rollup
  dependency-version: 4.60.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-frontend-deps
- dependency-name: vite
  dependency-version: 8.0.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-frontend-deps
- dependency-name: vite-plugin-svgr
  dependency-version: 5.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-frontend-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build: bump the all-actions group with 6 updates
69a0541 
Bumps the all-actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `6` |
| [microsoft/template-validation-action](https://github.com/microsoft/template-validation-action) | `0.4.3` | `0.4.4` |
| [azure/login](https://github.com/azure/login) | `2` | `3` |
| [tj-actions/changed-files](https://github.com/tj-actions/changed-files) | `47.0.5` | `47.0.6` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5` | `6` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |


Updates `actions/checkout` from 4 to 6
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)

Updates `microsoft/template-validation-action` from 0.4.3 to 0.4.4
- [Release notes](https://github.com/microsoft/template-validation-action/releases)
- [Commits](microsoft/template-validation-action@v0.4.3...v0.4.4)

Updates `azure/login` from 2 to 3
- [Release notes](https://github.com/azure/login/releases)
- [Commits](Azure/login@v2...v3)

Updates `tj-actions/changed-files` from 47.0.5 to 47.0.6
- [Release notes](https://github.com/tj-actions/changed-files/releases)
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md)
- [Commits](tj-actions/changed-files@22103cc...9426d40)

Updates `actions/setup-python` from 5 to 6
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5...v6)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: microsoft/template-validation-action
  dependency-version: 0.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
- dependency-name: azure/login
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: tj-actions/changed-files
  dependency-version: 47.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
- dependency-name: actions/setup-python
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build: bump the all-backend-deps group in /src/backend with 6 updates
82bd7b5 
Bumps the all-backend-deps group in /src/backend with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [semantic-kernel](https://github.com/microsoft/semantic-kernel) | `1.41.1` | `1.41.3` |
| [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python) | `1.40.0` | `1.41.1` |
| [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.40.0` | `1.41.1` |
| [opentelemetry-semantic-conventions](https://github.com/open-telemetry/opentelemetry-python) | `0.61b0` | `0.62b1` |
| [opentelemetry-instrumentation](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.61b0` | `0.62b1` |
| azure-ai-projects | `2.0.1` | `2.1.0` |


Updates `semantic-kernel` from 1.41.1 to 1.41.3
- [Release notes](https://github.com/microsoft/semantic-kernel/releases)
- [Commits](microsoft/semantic-kernel@python-1.41.1...python-1.41.3)

Updates `opentelemetry-sdk` from 1.40.0 to 1.41.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/v1.41.1/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.40.0...v1.41.1)

Updates `opentelemetry-api` from 1.40.0 to 1.41.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/v1.41.1/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.40.0...v1.41.1)

Updates `opentelemetry-semantic-conventions` from 0.61b0 to 0.62b1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python/commits)

Updates `opentelemetry-instrumentation` from 0.61b0 to 0.62b1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `azure-ai-projects` from 2.0.1 to 2.1.0

---
updated-dependencies:
- dependency-name: semantic-kernel
  dependency-version: 1.41.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-backend-deps
- dependency-name: opentelemetry-sdk
  dependency-version: 1.41.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-backend-deps
- dependency-name: opentelemetry-api
  dependency-version: 1.41.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-backend-deps
- dependency-name: opentelemetry-semantic-conventions
  dependency-version: 0.62b1
  dependency-type: direct:production
  dependency-group: all-backend-deps
- dependency-name: opentelemetry-instrumentation
  dependency-version: 0.62b1
  dependency-type: direct:production
  dependency-group: all-backend-deps
- dependency-name: azure-ai-projects
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-backend-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
chore: merge dev into dependabotchanges
ebb515c 
Resolves conflicts:
- requirements.txt: keep higher OT 1.41.1/0.62b1 & azure-ai-projects 2.1.0, add fastapi instrumentation at 0.62b1
- package.json: keep higher eslint v10, msal, uuid; add overrides block from dev
- package-lock.json: regenerated with overrides via npm install --legacy-peer-deps

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings May 20, 2026 05:37
Copilot AI reviewed May 20, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR down-merges pending Dependabot changes into dev by upgrading backend Python dependencies, frontend npm dependencies, and GitHub Actions used in CI/CD workflows to address security vulnerabilities and keep tooling current.

Changes:

  • Bumped key backend Python dependencies (Semantic Kernel, OpenTelemetry packages, azure-ai-projects) in src/backend/requirements.txt.
  • Updated frontend runtime/dev dependencies (e.g., axios, uuid, React, router, Tailwind tooling, ESLint/Vite) and regenerated package-lock.json.
  • Updated multiple GitHub Actions workflow steps (notably azure/login@v3, plus newer actions/* versions and template validation action).

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
src/frontend/package.json Updates direct frontend dependencies/devDependencies and preserves overrides.
src/frontend/package-lock.json Regenerates lockfile to reflect updated frontend dependency graph and overrides.
src/backend/requirements.txt Updates pinned Python package versions for security/compatibility.
.github/workflows/validate-bicep-params.yml Updates GitHub Actions versions for checkout/python/artifact upload.
.github/workflows/test-automation-v2.yml Updates azure/login action to v3.
.github/workflows/job-docker-build.yml Updates azure/login action to v3.
.github/workflows/job-deploy.yml Updates azure/login action to v3.
.github/workflows/job-deploy-windows.yml Updates azure/login action to v3.
.github/workflows/job-deploy-linux.yml Updates azure/login action to v3.
.github/workflows/job-cleanup-deployment.yml Updates azure/login action to v3.
.github/workflows/deploy.yml Updates azure/login action to v3.
.github/workflows/build-docker.yml Updates azure/login action to v3.
.github/workflows/broken-links-checker.yml Updates pinned SHA for tj-actions/changed-files v46.
.github/workflows/azure-dev.yml Updates azure/login action to v3.
.github/workflows/azd-template-validation.yml Updates template validation action patch version.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/frontend/package.json
fix(deps): revert OT 1.41/azure-ai-projects 2.1 due to upstream pins
f0137d2 
Resolves pip ResolutionImpossible errors in lint, backend_tests, and
docker-build jobs:

- semantic-kernel 1.41.3 requires azure-ai-projects~=1.0.0b12 (cannot use 2.1.0)
- azure-monitor-opentelemetry 1.8.7 pins opentelemetry-sdk==1.40 (cannot use 1.41.1)

Reverted to versions compatible with both umbrella packages. The 2.1.0
azure-ai-projects pin in dependabotchanges was incompatible with the
semantic-kernel version present in the repo and was previously masked
because CI didn't run on that branch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 20, 2026 •
edited
Loading

Coverage

Coverage Report •
FileStmtsMissCoverMissing
TOTAL222138582% 
report-only-changed-files is enabled. No files were changed during this commit :)

Tests Skipped Failures Errors Time
282 0 💤 0 ❌ 0 🔥 10.005s ⏱️

fix(deps): downgrade eslint to v9 for peer dep compatibility
7dc7b06 
Docker build fails (npm install, no --legacy-peer-deps) because
eslint-plugin-react@7.37.5 only supports eslint up to v9.7.

Downgrade eslint and @eslint/js back to ^9.39.2 (matches dev) to allow
clean install. Per known-issues table: keep eslint at v9 until
eslint-plugin-react supports v10.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings May 20, 2026 05:56
Copilot AI reviewed May 20, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 3 comments.

Comment thread src/frontend/package-lock.json
Comment thread src/frontend/package-lock.json Outdated
Comment thread src/frontend/package-lock.json Outdated
fix(frontend): add engines.node and refresh babel transitives
a4833ab 
Addresses Copilot review feedback on PR #438:
- Add engines.node: >=20 (uuid@14 and msal-react@5 require Node 20+;
  Dockerfile uses node:22 so this codifies the intended minimum)
- npm update @babel/helpers @babel/runtime to bring transitives back
  to 7.29.2 (avoid unintended transitive downgrades from clean install)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Ayaz-Microsoft Ayaz-Microsoft requested a review from Copilot May 20, 2026 06:24
Copilot AI reviewed May 20, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

Comment thread src/frontend/package.json Outdated
fix(frontend): remove obsolete @types/react-router-dom
0287fca 
react-router-dom@7 ships its own TypeScript types (./dist/index.d.ts),
making @types/react-router-dom (v5-era) obsolete and a potential source
of type conflicts. Codebase doesn't use any v5-only types
(RouteComponentProps, withRouter, etc.). Frontend build verified.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@Avijit-Microsoft Avijit-Microsoft Awaiting requested review from Avijit-Microsoft Avijit-Microsoft is a code owner

@Roopan-Microsoft Roopan-Microsoft Awaiting requested review from Roopan-Microsoft Roopan-Microsoft is a code owner

@Prajwal-Microsoft Prajwal-Microsoft Awaiting requested review from Prajwal-Microsoft Prajwal-Microsoft is a code owner

@aniaroramsft aniaroramsft Awaiting requested review from aniaroramsft aniaroramsft is a code owner

@marktayl1 marktayl1 Awaiting requested review from marktayl1 marktayl1 is a code owner

@Vinay-Microsoft Vinay-Microsoft Awaiting requested review from Vinay-Microsoft Vinay-Microsoft is a code owner

@toherman-msft toherman-msft Awaiting requested review from toherman-msft toherman-msft is a code owner

@nchandhi nchandhi Awaiting requested review from nchandhi nchandhi is a code owner

@dgp10801 dgp10801 Awaiting requested review from dgp10801 dgp10801 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@Ayaz-Microsoft