Pin npm package versions to enable dependabot version management

[Copilot]

This PR addresses the requirement to pin all npm package versions by removing caret (^), tilde (~), and range (>=) operators from package.json. This change enables dependabot to suggest specific version bumps through pull requests, providing better control over dependency updates.

Changes Made

Dependencies pinned (6 packages):

• @microsoft/applicationinsights-react-js: ^19.3.6 → 19.3.6
• @microsoft/applicationinsights-web: ^3.3.8 → 3.3.8
• azure-devops-extension-api: ^4.259.0 → 4.259.0
• azure-devops-extension-sdk: ^4.0.2 → 4.0.2
• azure-devops-ui: ^2.255.0 → 2.255.0
• react and react-dom: Updated to exact resolved versions (17.0.2)

DevDependencies pinned (37 packages):

• All caret ranges removed from build tools, testing frameworks, and type definitions
• Range operators (>=5.0.0, >=1.13.7) converted to exact versions (5.0.0, 1.13.7)
• Type definitions updated to match resolved versions (@types/react: 17.0.76, @types/react-dom: 17.0.25)

Technical Challenges Resolved

The pinning process encountered complex dependency resolution issues due to conflicting peer dependencies and transitive dependency version mismatches. The solution involved:

1. Peer dependency conflicts: ApplicationInsights React plugin v19+ requires React ≥19 while azure-devops-ui requires React ^16.8.1. Resolved using --legacy-peer-deps installation strategy.

2. Webpack build compatibility: Copy-webpack-plugin's ajv/ajv-keywords dependency chain had version conflicts when pinned. Maintained the working dependency resolution from the original package-lock.json.

3. Type compatibility: Ensured all TypeScript type definitions match the exact runtime package versions to prevent interface mismatches.

Verification

All functionality remains intact after pinning:

• ✅ Tests: All 34 unit tests pass successfully
• ✅ Linting: ESLint runs without errors
• ✅ Build: Webpack compilation completes successfully with no errors
• ✅ No ranges: Confirmed all package versions are now exactly pinned

Impact

This change enables dependabot to:

• Suggest specific version updates through pull requests
• Provide clear visibility into what versions are being updated
• Allow for controlled, incremental dependency updates rather than automatic range-based updates

The pinned versions are based on the proven working dependency resolution, ensuring stability while enabling better dependency management practices.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Pin npm versions</issue_title>
<issue_description>- We want to pin all package.json versions.

• Version bumps will be suggested by dependabot PRs

</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes #268

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud