chore(deps): group all Dependabot security updates into a single PR#9240
Open
vhvb1989 wants to merge 1 commit into
Open
chore(deps): group all Dependabot security updates into a single PR#9240vhvb1989 wants to merge 1 commit into
vhvb1989 wants to merge 1 commit into
Conversation
Addresses all open Dependabot alerts across the repo: - cli/azd/extensions/azure.ai.rle: bump golang.org/x/crypto 0.49.0 -> 0.52.0 and golang.org/x/net 0.52.0 -> 0.55.0 (alerts #456-#469). Note x/net requires 0.55.0 for full remediation of #456. - ext/vscode: js-yaml -> 4.3.0, brace-expansion -> 2.1.2 & 5.0.7 (alerts #539, #540, #541) - ext/azuredevops/setupAzd: adm-zip -> 0.6.0, azure-pipelines-task-lib -> 5.278.0, brace-expansion -> 1.1.16 & 2.1.2 (alerts #535, #537, #538) - cli/azd/test/eval: brace-expansion -> 1.1.16 (alert #536) Supersedes and consolidates #9093 and #9215. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2cef6dea-2ec8-4538-8e55-7a2b0dfa196c
vhvb1989
requested review from
JeffreyCA,
RickWinter,
bwateratmsft,
glharper,
hemarina,
huimiu,
hund030,
richardpark-msft,
tg-msft,
therealjohn,
trangevi and
trrwilson
as code owners
July 21, 2026 22:57
This was referenced Jul 21, 2026
🔗 Linked Issue RequiredThanks for the contribution! Please link a GitHub issue to this PR by adding |
|
Azure Pipelines: Successfully started running 4 pipeline(s). 18 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
Consolidates security dependency updates across the RLE extension, editor integrations, and evaluation tooling.
Changes:
- Updates vulnerable Go networking and cryptography modules.
- Patches vulnerable npm transitive dependencies.
- Upgrades Azure Pipelines task dependencies to patched releases.
Reviewed changes
Copilot reviewed 1 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
ext/vscode/package-lock.json |
Updates vulnerable npm dependencies. |
ext/azuredevops/setupAzd/package-lock.json |
Updates task-lib, adm-zip, and brace-expansion. |
cli/azd/test/eval/package-lock.json |
Patches brace-expansion. |
cli/azd/extensions/azure.ai.rle/go.mod |
Updates affected Go modules. |
cli/azd/extensions/azure.ai.rle/go.sum |
Records updated module checksums. |
Files not reviewed (3)
- cli/azd/test/eval/package-lock.json: Generated file
- ext/azuredevops/setupAzd/package-lock.json: Generated file
- ext/vscode/package-lock.json: Generated file
richardpark-msft
approved these changes
Jul 21, 2026
Contributor
VSCode Extension Installation Instructions
|
JeffreyCA
approved these changes
Jul 21, 2026
Member
Author
|
/check-enforcer override |
Member
Author
|
Contributor
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
jongio
approved these changes
Jul 22, 2026
jongio
left a comment
jongio
left a comment
Member
There was a problem hiding this comment.
Verified every checksum in this PR against upstream sources: all five golang.org/x module hashes (crypto 0.52.0, net 0.55.0, sys 0.45.0, term 0.43.0, text 0.37.0) match sum.golang.org, and all npm integrity hashes (brace-expansion, adm-zip 0.6.0, azure-pipelines-task-lib 5.278.0, js-yaml 4.3.0) match the registry. The go.mod and go.sum are consistent, and the transitive sys/term/text bumps are what go mod tidy produces alongside the crypto/net updates.
bwateratmsft
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates all open Dependabot security alerts across the repository into a single PR, instead of multiple individual Dependabot PRs.
This supersedes and consolidates #9093 and #9215.
Alerts addressed (21 total)
cli/azd/extensions/azure.ai.rle/go.modgolang.org/x/crypto0.49.0→0.52.0cli/azd/extensions/azure.ai.rle/go.modgolang.org/x/net0.52.0→0.55.0ext/vscode/package-lock.jsonjs-yaml4.3.0ext/vscode/package-lock.jsonbrace-expansion2.1.2&5.0.7ext/azuredevops/setupAzd/package-lock.jsonadm-zip0.6.0ext/azuredevops/setupAzd/package-lock.jsonazure-pipelines-task-lib5.278.0ext/azuredevops/setupAzd/package-lock.jsonbrace-expansion1.1.16&2.1.2cli/azd/test/eval/package-lock.jsonbrace-expansion1.1.16Verification
go build ./...passes incli/azd/extensions/azure.ai.rlenpm auditreports 0 remaining relevant vulnerabilities in each npm project (the 4 low-severityjsdiff/mochadev findings inext/vscodeare not part of the Dependabot alert set and require breaking changes)Notes
npm audit fix --package-lock-only.go get+go mod tidy.