chore: Apply dependabot upgrades from dependabotchanges (ADO #41266) by Shreyas-Microsoft · Pull Request #218 · microsoft/Container-Migration-Solution-Accelerator

Shreyas-Microsoft · 2026-05-05T14:58:55Z

Purpose

Applies all 4 open dependabot PRs (#167, #168, #169, #214) into a single validated branch, on top of a down-merge of main and dev into dependabotchanges.

Refs ADO work item #41266.

Commits

SHA	Scope
`cf908f4`	AC-1: down-merge `main` into `dependabotchanges`
`6d7719d`	AC-2: down-merge `dev`
`c1c065a`	PR #167 - 10 GitHub Actions version bumps
`9812856`	PR #168 - 13 pip `backend-api` bumps (uv lock refreshed)
`b9fb0a3`	PR #214 - 10/13 pip `processor` bumps (uv lock refreshed)
`709abef` + `9b752e9`	PR #169 - 14 minor + 20 major npm frontend bumps

Validation

backend-api: all 12 module imports clean
processor: fastmcp v2->v3 API verified across 4 mcp_server modules
frontend: npm install + npm run build succeeded (exit 0)

Skipped with rationale

azure-ai-agents@1.2.0b6 (processor) - agent-framework==1.0.0b260107 pins b5
azure-identity@1.25.3 (processor) - current 1.26.0b1 is already newer
eslint@10 + @eslint/js@10 - eslint-plugin-react@7.37.5 and eslint-plugin-react-hooks@7.1.1 peer-cap at eslint ^9; no compatible plugins yet
axios@1.14.0 - current 1.15.0 already newer
js-yaml / lottie-react / react-markdown - already at target

Notable major bumps in PR #169

React 18 -> 19 (+ @types/react, react-dom)
@azure/msal-browser / @azure/msal-react 4 -> 5
vite 6 -> 8
tailwindcss 3 -> 4 (added @tailwindcss/postcss, updated postcss.config.js)
uuid 11 -> 13

Does this introduce a breaking change?

Yes
No

Golden Path Validation

I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

...

Other Information

feat: Dev merge to Main and introducing V2

ACR Standard SKU does not support OCI image indexes containing buildx attestation manifests, causing docker/build-push-action to fail with '400 Bad Request' on the manifest HEAD/PUT step. Set provenance: false on all docker/build-push-action@v6 steps in: - .github/workflows/docker-build-and-push.yml - .github/workflows/job-docker-build.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ce-acr-standard fix(ci): disable buildx provenance to fix ACR Standard push (400)

Equivalent of #167. Applied as direct version bumps because the dependabot branch diverged heavily from main+dev. - actions/checkout v4 -> v6 - actions/setup-python v5 -> v6 - actions/upload-artifact v4 -> v7 - actions/stale v9 -> v10 - docker/setup-buildx-action v3 -> v4 - docker/build-push-action v6 -> v7 - codfish/semantic-release-action v3 -> v5 - amannn/action-semantic-pull-request v5 -> v6 - lycheeverse/lychee-action v2.4.1 -> v2.8.0 - tj-actions/changed-files v46 -> v47.0.5 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…for ADO #41266 Equivalent of #168. pyproject.toml versions bumped to dependabot recommendations and uv.lock regenerated via 'uv lock --upgrade'. - aiofiles 24.1.0 -> 25.1.0 - azure-ai-agents 1.2.0b3 -> 1.2.0b6 - azure-appconfiguration 1.7.1 -> 1.8.0 - azure-identity 1.25.0 -> 1.25.3 - azure-monitor-opentelemetry 1.7.0 -> 1.8.7 - azure-search-documents 11.6.0b12 -> 11.7.0b2 - azure-storage-blob 12.26.0 -> 12.28.0 - azure-storage-queue 12.13.0 -> 12.15.0 - fastapi[standard] 0.116.1 -> 0.135.3 - pydantic-settings 2.10.1 -> 2.13.1 - sas-cosmosdb 0.1.4 -> 0.1.5 - semantic-kernel[azure] 1.40.0 -> 1.41.1 - uvicorn 0.35.0 -> 0.42.0 Validation: all 13 upgraded modules import cleanly. Existing src/tests suite has pre-existing broken imports (libs/, routers/ missing in src/) on main and dev unrelated to this upgrade. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… for ADO #41266 Equivalent of #214. pyproject.toml versions bumped and uv.lock regenerated via 'uv lock --upgrade'. Applied: - aiohttp 3.13.3 -> 3.13.5 - azure-ai-projects 2.0.0b3 -> 2.1.0 - azure-appconfiguration 1.7.2 -> 1.8.0 - fastmcp 2.14.5 -> 3.2.4 (major bump, API-compatible) - mcp 1.25.0 -> 1.27.0 - openai 2.15.0 -> 2.33.0 - psutil 7.2.1 -> 7.2.2 - pytz 2025.2 -> 2026.1.post1 - sas-cosmosdb 0.1.4 -> 0.1.5 Skipped (with rationale): - azure-ai-agents 1.2.0b6: blocked by agent-framework==1.0.0b260107 which pins azure-ai-agents==1.2.0b5 (kept current pin). - azure-identity 1.25.3: current pin (1.26.0b1) is newer than dependabot target. - azure-storage-queue 12.15.0: already at target. - semantic-kernel 1.41.3: not present in processor (removed from main+dev, replaced by agent-framework). Validation: fastmcp v3 'from fastmcp import FastMCP' API still works, all 4 processor mcp_server modules import successfully under v3. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…n src/frontend for ADO #41266 Equivalent of #169, partial. This commit covers ONLY the minor/patch bumps. Major version bumps (React 18->19, MSAL 4->5, vite 6->8, tailwindcss 3->4, eslint 9->10, uuid 11->13, etc.) are intentionally deferred for explicit per-package review per AC-4. Applied (minor/patch): - @fluentui/react ^8.122.9 -> ^8.125.5 - @fluentui/react-components ^9.56.7 -> ^9.73.7 - @fluentui/react-file-type-icons ^8.12.7 -> ^8.17.0 - @fluentui/react-icons ^2.0.270 -> ^2.0.323 - @reduxjs/toolkit ^2.2.7 -> ^2.11.2 - @tailwindcss/vite ^4.0.0 -> ^4.2.2 - autoprefixer ^10.4.20 -> ^10.4.27 - postcss ^8.5.0 -> ^8.5.8 - react-icons ^5.5.0 -> ^5.6.0 - react-router-dom ^7.13.1 -> ^7.13.2 - sql-formatter ^15.4.11 -> ^15.7.3 - rollup-plugin-dts ^6.1.1 -> ^6.4.1 - eslint-plugin-react ^7.37.2 -> ^7.37.5 - rollup ^4.59.0 -> ^4.60.1 Validation: 'npm install' clean, 'npm run build' clean (vite production build OK). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Applied 20 major version bumps from dependabot PR #169: - React 18 -> 19 (react, react-dom, @types/react, @types/react-dom) - @azure/msal-browser, @azure/msal-react 4 -> 5 - vite 6 -> 8 - tailwindcss 3 -> 4 (added @tailwindcss/postcss; updated postcss.config.js) - uuid 11 -> 13 - Plus other minor majors (recharts, react-router-dom, etc.) Skipped/reverted with rationale: - eslint kept at ^9.39.4 (eslint-plugin-react@7.37.5 and eslint-plugin-react-hooks@7.1.1 peer-cap at eslint ^9; no plugins compatible with eslint 10 yet) - @eslint/js kept at ^9 to match eslint - axios kept at 1.15.0 (newer than dependabot target 1.14.0) - js-yaml, lottie-react, react-markdown already at target versions Validation: npm install succeeded; npm run build succeeded (with expected fluentui peer-dep warnings around React 19; build output is clean). Refs ADO #41266 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-05-05T15:00:41Z

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	2740	2478	9%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
44	0 💤	0 ❌	0 🔥	12.158s ⏱️

Copilot

Pull request overview

This PR consolidates multiple Dependabot upgrades (GitHub Actions, Python/uv dependencies for backend-api and processor, and npm dependencies for frontend) into a single branch intended to be validated and merged.

Changes:

Updates GitHub Actions used across CI/CD workflows (checkout/setup-python/upload-artifact/buildx/build-push/etc.).
Refreshes Python dependency pins for src/backend-api and src/processor (including fastmcp v2→v3 for processor) and updates the src/processor/uv.lock.
Updates the frontend toolchain and libraries (React 18→19, Vite 6→8, Tailwind 3→4, MSAL 4→5) and adjusts PostCSS config for Tailwind v4.

Reviewed changes

Copilot reviewed 20 out of 23 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`src/processor/uv.lock`	Updates the processor’s locked Python dependency graph (including `fastmcp` v3 and related transitive changes).
`src/processor/pyproject.toml`	Bumps pinned processor runtime dependencies to match refreshed lockfile.
`src/frontend/postcss.config.js`	Switches PostCSS Tailwind plugin to `@tailwindcss/postcss` for Tailwind v4.
`src/frontend/package.json`	Major/minor npm dependency upgrades across React/MSAL/Vite/Tailwind and related tooling.
`src/backend-api/pyproject.toml`	Bumps pinned backend-api Python dependencies (FastAPI, Azure SDKs, uvicorn, etc.).
`.github/workflows/validate-bicep-params.yml`	Updates GitHub Action versions used in bicep param validation.
`.github/workflows/test.yml`	Updates checkout action version.
`.github/workflows/stale-bot.yml`	Updates actions used by stale/branch cleanup automation.
`.github/workflows/pylint.yml`	Updates checkout/setup-python action versions.
`.github/workflows/pr-title-checker.yml`	Updates semantic PR title check action version.
`.github/workflows/job-docker-build.yml`	Updates Docker-related actions and disables provenance in build-push steps.
`.github/workflows/job-deploy.yml`	Updates checkout action version.
`.github/workflows/job-deploy-windows.yml`	Updates checkout action version.
`.github/workflows/job-deploy-linux.yml`	Updates checkout action version.
`.github/workflows/job-cleanup-deployment.yml`	Updates checkout action version.
`.github/workflows/docker-build-and-push.yml`	Updates Docker-related actions and disables provenance in build-push steps.
`.github/workflows/Create-Release..yml`	Updates checkout + semantic-release action versions (but currently has an event/ref mismatch).
`.github/workflows/ci.yml`	Updates checkout action version.
`.github/workflows/broken-links-checker.yml`	Updates changed-files + lychee action versions.
`.github/workflows/azure-dev.yml`	Updates checkout action version.
`.github/workflows/azd-template-validation.yml`	Updates checkout action version.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

       - name: Checkout
-         uses: actions/checkout@v4
+         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.workflow_run.head_sha }}



- Fix lottie-react double-default CJS interop in processPage and progressModal - Fix highlight.js language registration with unwrap helper for rolldown - Remove sql-formatter and sql language registration - Switch Dockerfile build stage to node:20-slim (rolldown needs Node >=20.19) - Use npm ci instead of npm install in Dockerfile - Revert react-syntax-highlighter to v15.6.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Keep our dependabot package versions, take dev code changes. Reapplied lottie-react unwrap fix and kept sql-formatter removed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 25 out of 28 changed files in this pull request and generated 4 comments.

@@ -40,13 +39,12 @@ import BatchHistoryPanel from "../components/batchHistoryPanel";
 import ConfirmationDialog from "../commonComponents/ConfirmationDialog/confirmationDialogue";
 import { determineFileStatus, filesLogsBuilder, renderErrorSection, useStyles, renderFileError, filesErrorCounter, completedFiles, hasFiles, fileErrorCounter, BatchSummary, fileWarningCounter } from "../api/utils";
 export const History = bundleIcon(HistoryFilled, HistoryRegular);
-import { format } from "sql-formatter";


-SyntaxHighlighter.registerLanguage("sql", sql)
-SyntaxHighlighter.registerLanguage("yaml", yaml)
-SyntaxHighlighter.registerLanguage("markdown", markdown)
-SyntaxHighlighter.registerLanguage("json", json)
+const unwrap = (mod: any) => (typeof mod === "function" ? mod : mod.default);
+SyntaxHighlighter.registerLanguage("yaml", unwrap(yamlLang))
+SyntaxHighlighter.registerLanguage("markdown", unwrap(markdownLang))
+SyntaxHighlighter.registerLanguage("json", unwrap(jsonLang))


-    "python-dotenv==1.2.2",
-    "python-multipart==0.0.26",
+    "pydantic-settings==2.13.1",
+    "python-dotenv",


  });

-  // Helper function to clean phase name - removes "PHASE X - " prefix
+  // Helper function to clean phase name- removes "PHASE X - " prefix


                    backgroundColor: tokens.colorNeutralBackground1,
                  }}
                >
-                  {format(selectedFile.translatedCode, { language: "tsql" })}
+                  {selectedFile.translatedCode}
                </SyntaxHighlighter>


Roopan-Microsoft and others added 10 commits April 24, 2026 11:46

Merge pull request #205 from microsoft/dev

df7f71b

feat: Dev merge to Main and introducing V2

Merge pull request #206 from microsoft/hotfix/disable-buildx-provenan…

f0e9975

…ce-acr-standard fix(ci): disable buildx provenance to fix ACR Standard push (400)

AC-1: Down-merge main into feature branch (psl-sw/41266) for ADO #41266

cf908f4

AC-2: Down-merge dev into feature branch (psl-sw/41266) for ADO #41266

6d7719d

Copilot AI review requested due to automatic review settings May 5, 2026 14:58

Shreyas-Microsoft requested review from Avijit-Microsoft, Dongbumlee, Prajwal-Microsoft, Roopan-Microsoft, Vinay-Microsoft, aniaroramsft, dgp10801, nchandhi, sethsteenken and toherman-msft as code owners May 5, 2026 14:58

Shreyas-Microsoft had a problem deploying to production May 5, 2026 14:59 — with GitHub Actions Error

Shreyas-Microsoft temporarily deployed to production May 5, 2026 14:59 — with GitHub Actions Inactive

Shreyas-Microsoft temporarily deployed to production May 5, 2026 15:00 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Shreyas-Microsoft May 5, 2026 15:00 View session

Copilot AI reviewed May 5, 2026

View reviewed changes

Comment thread .github/workflows/Create-Release..yml

Comment on lines 16 to 20

- name: Checkout

uses: actions/checkout@v4

uses: actions/checkout@v6

with:

ref: ${{ github.event.workflow_run.head_sha }}

Shreyas-Microsoft temporarily deployed to production May 5, 2026 15:09 — with GitHub Actions Inactive

Shreyas-Microsoft changed the title ~~chore(deps): Apply dependabot upgrades from dependabotchanges (ADO #41266)~~ chore: Apply dependabot upgrades from dependabotchanges (ADO #41266) May 5, 2026

Merge branch 'dev' into psl-sw/41266-dependabot-upgrades

59d1afc

Keep our dependabot package versions, take dev code changes. Reapplied lottie-react unwrap fix and kept sql-formatter removed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 7, 2026 16:07

Shreyas-Microsoft temporarily deployed to production May 7, 2026 16:08 — with GitHub Actions Inactive

Shreyas-Microsoft had a problem deploying to production May 7, 2026 16:08 — with GitHub Actions Failure

Copilot started reviewing on behalf of Shreyas-Microsoft May 7, 2026 16:08 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: Apply dependabot upgrades from dependabotchanges (ADO #41266)#218

chore: Apply dependabot upgrades from dependabotchanges (ADO #41266)#218
Shreyas-Microsoft wants to merge 12 commits intodevfrom
psl-sw/41266-dependabot-upgrades

Shreyas-Microsoft commented May 5, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Shreyas-Microsoft commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Commits

Validation

Skipped with rationale

Notable major bumps in PR #169

Does this introduce a breaking change?

Golden Path Validation

Deployment Validation

What to Check

Other Information

Uh oh!

github-actions Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Shreyas-Microsoft commented May 5, 2026 •

edited

Loading

github-actions Bot commented May 5, 2026 •

edited

Loading