chore: update safe npm dependencies by Copilot · Pull Request #7983 · github/gh-aw-firewall

Copilot · 2026-09-01T20:11:33Z

Updates the requested npm dependencies to current safe versions and ensures installs resolve through the trusted Microsoft Azure Artifacts registry.

Dependency updates
- js-yaml 5.4.1
- eslint 10.9.1
- Jest/Babel-Jest 30.5.0
- TypeScript ESLint packages 8.69.0
Registry pinning
- Configures npm to use the Microsoft registry.
- Rewrites all lockfile tarball URLs to the same registry.

registry=https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/

Fixes [Deps] Safe dependency updates (2026-09-01) #7962

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

🟡 Changes recommended

Several minor-version upgrades conflict with the linked issue’s patch-only scope.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates core npm dependencies and pins installs to the trusted Azure Artifacts registry.

Changes:

Updates YAML, linting, and Jest dependencies.
Regenerates the dependency lockfile.
Configures the project npm registry.

File summaries

File	Description
`.npmrc`	Sets the Azure Artifacts registry.
`package.json`	Updates dependency versions.
`package-lock.json`	Locks updated dependency trees and registry URLs.

Review details

Files reviewed: 2/3 changed files
Comments generated: 1
Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

    "commander": "^12.1.0",
    "execa": "^5.1.1",
-    "js-yaml": "5.3.0"
+    "js-yaml": "5.4.1"


lpcox · 2026-09-01T22:24:03Z

@copilot address review feedback

Copilot · 2026-09-01T22:39:30Z

@copilot address review feedback

Reverted js-yaml, jest/babel-jest, and the TypeScript ESLint packages back to their original pinned versions (5.3.0, ^30.4.2/^30.2.0, 8.67.0) since no newer patch releases exist in those lines — only eslint's genuine 10.9.0→10.9.1 patch bump remains. See 90a0776.

github-actions · 2026-09-01T23:05:02Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-09-01T23:09:58Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.10%	93.11%	📈 +0.01%
Statements	91.74%	91.74%	➡️ +0.00%
Functions	92.19%	92.21%	📈 +0.02%
Branches	85.44%	85.45%	📈 +0.01%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/cloud-hypervisor/cleanup-registry.ts`	93.7% → 94.1% (+0.39%)	90.7% → 91.0% (+0.33%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (4 files)

src/cloud-hypervisor/cleanup-handle.ts: 87.0% lines
src/cloud-hypervisor/cleanup-identity.ts: 98.2% lines
src/cloud-hypervisor/cleanup-process.ts: 100.0% lines
src/cloud-hypervisor/cleanup-registry.test-utils.ts: 88.2% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-09-01T23:24:45Z

✅ Contribution Check completed successfully!

Code review complete: the PR follows CONTRIBUTING.md for style, documentation, file organization, and PR description. No new functionality was added, so the dependency-only update does not require additional tests beyond the existing lockfile/package refresh.

Generated by Contribution Check for #7983

github-actions · 2026-09-01T23:24:46Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-09-01T23:24:47Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-09-01T23:24:48Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-09-01T23:24:48Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-09-01T23:24:51Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #7983

github-actions · 2026-09-01T23:24:52Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-09-01T23:24:55Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-09-01T23:24:56Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Docker Sbx

github-actions · 2026-09-01T23:25:03Z

✅ Smoke Claude passed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #7983

github-actions · 2026-09-01T23:25:03Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-09-01T23:25:04Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-09-01T23:25:05Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-09-01T23:28:00Z

Smoke Test: Claude Engine Validation

Check	Status
API	✅ PASS
gh CLI	✅ PASS
File	✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #7983 · claude · haiku45 · 58.3 AIC · ⊞ 4.5K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T23:28:20Z

Copilot Network Isolation Smoke Test @lpcox

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com): allowed=200
✅ Blocked domain (example.com): CONNECT 403, blocked

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T23:28:20Z

Smoke Test: Copilot BYOK (Direct) Mode ✅

Test Results:

✅ GitHub MCP connectivity (merged PRs fetched)
✅ GitHub.com HTTP: 200 OK
✅ File write/read: verified
✅ BYOK inference: working via api-proxy → api.githubcopilot.com

Status: PASS

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) with real credentials held by api-proxy sidecar.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T23:28:45Z

Smoke Test: Services Connectivity

Redis PING: ❌ (Temporary failure in name resolution)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (could not translate host name "host.docker.internal")

Overall: FAIL — host.docker.internal did not resolve from the sandbox.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T23:29:14Z

@Copilot Smoke test results:

GitHub MCP API: ❌ (unexpected PR list)
GitHub.com connectivity: ✅
File I/O: ✅
BYOK inference: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: FAIL

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T23:29:19Z

Smoke Test: Docker Sbx — @lpcox

GitHub MCP connectivity: ✅ (PR ci: recompile Playwright smoke workflows #7977 ci: recompile Playwright smoke workflows, PR Split cleanup-registry.ts into focused identity/process/handle modules #7976 Split cleanup-registry.ts into focused identity/process/handle modules)
GitHub.com connectivity: ✅ (HTTP 200)
File write/read: ✅

Overall: PASS

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T23:29:20Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.19.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Not all runtime versions matched between host and chroot (Node.js differs), so the smoke-chroot label was not applied.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T23:29:33Z

Recent merged PRs: Normalize parameterized model IDs for AI-credit pricing, chore: update safe npm dependencies

GitHub MCP review: ❌
Safeinputs GH query: ❌
Playwright title check: ✅
File write: ✅
Bash cat verify: ✅
Discussion interaction: ❌
Build (npm ci && npm run build): ✅

Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T23:29:35Z

Smoke Test: Copilot Engine — @lpcox

✅ GitHub MCP: PR Split cleanup-registry.ts into focused identity/process/handle modules #7976 confirmed
✅ GitHub.com connectivity: HTTP 200
✅ File write/read test passed

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T23:30:08Z

ci: recompile Playwright smoke workflows: ❌
Split cleanup-registry.ts into focused identity/process/handle modules: ❌
GitHub.com connectivity: ✅
File write/read: ✅
BYOK inference via Azure OpenAI: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

Overall status: FAIL

@lpcox @Copilot

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T23:30:42Z

Smoke Test Results: API Proxy OTel Tracing

Scenario 1 (Module Loading): ✅ otel.js loaded successfully, isEnabled() → true. Exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, _provider, _ProxyAwareOtlpExporter, _FileSpanExporter, _FanOutSpanExporter, _parseEndpoints, _parseOtlpHeaders, _buildResourceSpans, _createOtlpWorkloadIdentity.
Scenario 2 (Test Suite): ✅ otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js — 3 suites, 68/68 tests passed.
Scenario 3 (Env Var Forwarding): ✅ env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID / GITHUB_AW_OTEL_PARENT_SPAN_ID to the agent; api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, and the trace/span IDs to api-proxy.
Scenario 4 (Token Tracker Integration): ✅ onUsage callback present in token-tracker-http.js as the OTEL hook point.
Scenario 5 (OTel Diagnostics): ⚠️ No api-proxy otel.jsonl span file was produced this run (checked /tmp/gh-aw/sandbox/firewall/logs/api-proxy/otel.jsonl — not found; actual logs dir is api-proxy-logs/, containing only token-usage.jsonl, 15 records). No OTLP collector endpoint secrets appear to be configured for this run, so no spans were exported — expected/pending, not a regression.

Overall: 4/5 scenarios fully passing, 1 expected-pending (no OTLP export activity, no credentials configured in this run). No code regressions detected.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T23:30:57Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A (build only)	✅ PASS
C++	json	✅	N/A (build only)	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (run only)	✅ PASS
.NET	json-parse	✅	N/A (run only)	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Notes:

Java's default ~/.m2/repository was owned by root (permission denied), so -Dmaven.repo.local=/tmp/gh-aw/agent/m2repo was used as a workaround for a local, writable repo. The Squid HTTP/HTTPS proxy settings in ~/.m2/settings.xml worked correctly for dependency resolution.
All repositories cloned successfully; no CLONE_FAILED cases.
All network-dependent installs/downloads (bun, npm, cargo, go mod, deno, maven, dotnet nuget, cmake/apt toolchain) succeeded through the firewall proxy.

Generated by Build Test Suite for #7983 · copilot · auto · 48.3 AIC · ⊞ 12K · ◷
_{Add label ready-for-aw to run again}

Initial plan

51f6027

Copilot AI assigned Copilot and lpcox Sep 1, 2026

Copilot started work on behalf of lpcox September 1, 2026 20:11 View session

Copilot AI linked an issue Sep 1, 2026 that may be closed by this pull request

[Deps] Safe dependency updates (2026-09-01) #7962

Closed

4 tasks

chore: update safe npm dependencies

272ca6c

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update dependencies with safe patch-level updates~~ chore: update safe npm dependencies Sep 1, 2026

Copilot finished work on behalf of lpcox September 1, 2026 20:17

Copilot AI requested a review from lpcox September 1, 2026 20:17

lpcox marked this pull request as ready for review September 1, 2026 22:10

Copilot AI balanced review requested due to automatic review settings September 1, 2026 22:10

Copilot started reviewing on behalf of lpcox September 1, 2026 22:11 View session

Copilot AI reviewed Sep 1, 2026

View reviewed changes

Comment thread package.json Outdated

"commander": "^12.1.0",

"execa": "^5.1.1",

"js-yaml": "5.3.0"

"js-yaml": "5.4.1"

Copilot started work on behalf of lpcox September 1, 2026 22:24 View session

chore: revert minor-version deps to patch-only scope

90a0776

Copilot finished work on behalf of lpcox September 1, 2026 22:39

lpcox added the ready-for-aw label Sep 1, 2026

lpcox temporarily deployed to aoai-model September 1, 2026 23:25 — with GitHub Actions Inactive

github-actions Bot added smoke-claude smoke-copilot-network-isolation Copilot network-isolation egress smoke test labels Sep 1, 2026

github-actions Bot added the smoke-copilot-byok label Sep 1, 2026

github-actions Bot added the smoke-docker-sbx label Sep 1, 2026

github-actions Bot added the smoke-copilot label Sep 1, 2026

lpcox temporarily deployed to aoai-model September 1, 2026 23:29 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-entra label Sep 1, 2026

lpcox temporarily deployed to aoai-model September 1, 2026 23:30 — with GitHub Actions Inactive

github-actions Bot added the build-test label Sep 1, 2026

lpcox merged commit cda60ea into main Sep 1, 2026
179 of 180 checks passed

lpcox deleted the copilot/deps-safe-dependency-updates-again branch September 1, 2026 23:40

This was referenced Sep 2, 2026

Connect agent enclaves directly to shared GitHub MCP #7991

Merged

Refactor Google API-key provider factories #7990

Merged

Uh oh!

Conversation

Copilot AI commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

lpcox commented Sep 1, 2026

Uh oh!

Copilot AI commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Smoke Test: Copilot BYOK (Direct) Mode ✅

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Chroot Version Comparison

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

Copilot AI commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading