feat(build): enable npm pinning enforcement in dependency scan by WilliamBerryiii · Pull Request #838 · microsoft/hve-core

WilliamBerryiii · 2026-03-02T04:37:57Z

Description

Enabled npm pinning enforcement in the CI dependency-pinning scan workflow. Updated the workflow default to scan github-actions,npm,workflow-npm-commands, activating automatic detection of unpinned npm commands in GitHub Actions workflow run: blocks.

Three PowerShell functions were added to Test-DependencyPinning.ps1:

Test-NpmCommandLine — regex-based detection of unpinned npm commands (npm install, npm i, npm update, npm install-test) while excluding safe variants (npm ci, npm run, npm test, npm audit)
Get-WorkflowNpmCommandViolations — indentation-aware YAML parser that tracks nesting depth to confine detection to actual shell content and avoid flagging comments
New-NpmCommandViolation — constructs violation objects with Medium severity and remediation guidance

Pester test coverage was added with fixture files for both safe and unsafe npm command patterns.

Scope Change: npm Exact-Version Enforcement

This PR introduces a strategic departure from SHA-pinning for npm dependencies. Unlike GitHub Actions (which use 40-character commit SHAs for immutable references), npm dependencies use exact-version enforcement (X.Y.Z with no ^, ~, *, or range operators).

Rationale for exact-version enforcement over SHA-pinning:

Factor	GitHub Actions (SHA)	npm (Exact Version)
Registry model	Git repositories with mutable tags	Immutable registry artifacts
Integrity verification	SHA pins to specific commit	Lockfile integrity hashes (SHA-512)
Audit compatibility	N/A	`npm audit` requires semver versions
Reproducibility	SHA guarantees exact code	Lockfile + exact version guarantees exact code
Human readability	40-char hex strings	Semantic version numbers

The validation regex enforces exact versions: ^\d+\.\d+\.\d+$ — no ranges, no prefixes, no wildcards.

Follow-Up Hardening (commit `b8bd099`)

Additional improvements shipped on this branch:

pip ExcludePatterns — Virtual environment directories (.venv, venv, .tox, .nox, __pypackages__) are now excluded from pip dependency scanning to avoid false positives
SARIF integration tests — Expanded from 1 weak assertion to 8 focused tests validating SARIF 2.1.0 schema compliance, severity mapping (High→error, Medium→warning), location structure, and metadata properties
Dependency pinning documentation — New docs/security/dependency-pinning.md page documenting all pinning strategies with rationale, validation rules, CI integration flowchart, and a dedicated comparison of SHA-pinning vs exact-version enforcement for npm

Related Issue(s)

Closes #526

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder agent and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot agent (.github/agents/*.agent.md)
Copilot skill (.github/skills/*/SKILL.md)

Other:

Script/automation (.ps1, .sh, .py)
Other (please describe):

Testing

Validated with 100 Pester tests covering:

Detected 4 violations in multi-command fixture (install, update, install-test, shorthand i)
Returned zero violations for safe-only workflow (ci, run, test, audit)
Handled nonexistent files gracefully
Excluded commented-out commands
Detected violations in multi-line run blocks with mixed safe/unsafe commands
SARIF 2.1.0 output: version, schema, tool driver, result count, severity mapping (High→error, Medium→warning), location structure, metadata properties (8 tests)
pip ExcludePatterns for virtual environment directories

Checklist

Required Checks

Documentation is updated (if applicable)
Files follow existing naming conventions
Changes are backwards compatible (if applicable)
Tests added for new functionality (if applicable)

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Skill structure validation: npm run validate:skills
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps
Plugin freshness: npm run plugin:generate

Security Considerations

This PR does not contain any sensitive or NDA information
Any new dependencies have been reviewed for security issues
Security-related scripts follow the principle of least privilege

Additional Notes

This PR enforces npm dependency pinning using exact-version enforcement rather than SHA-pinning. The scanner uses regex-only analysis with no code execution, and Test-Path -LiteralPath guards all file reads. Test count increased from 93 to 100 with comprehensive SARIF integration coverage.

- add Get-WorkflowNpmCommandViolations with indentation-aware run-block parsing - add Test-NpmCommandLine and New-NpmCommandViolation helpers - add workflow-npm-commands to DependencyPatterns and default IncludeTypes - add Pester tests with fixture workflows for install and ci-only scenarios 🔒 - Generated by Copilot

- update dependency-types default to include npm and workflow-npm-commands 🔒 - Generated by Copilot

github-actions · 2026-03-02T04:38:11Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

codecov-commenter · 2026-03-02T04:40:24Z

Codecov Report

❌ Patch coverage is 93.18182% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.88%. Comparing base (a2f18e3) to head (c5c81c6).
⚠️ Report is 14 commits behind head on main.

Files with missing lines	Patch %	Lines
scripts/security/Test-DependencyPinning.ps1	93.18%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #838      +/-   ##
==========================================
+ Coverage   85.47%   85.88%   +0.41%     
==========================================
  Files          27       27              
  Lines        5128     5152      +24     
==========================================
+ Hits         4383     4425      +42     
+ Misses        745      727      -18

Flag	Coverage Δ
pester	`85.88% <93.18%> (+0.41%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
scripts/security/Modules/SecurityClasses.psm1	`97.22% <ø> (ø)`
scripts/security/Test-DependencyPinning.ps1	`89.66% <93.18%> (+5.22%)`	⬆️

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

- rewrite Get-FilesToScan with Get-ChildItem for cross-platform glob support - replace SHA-pinning with Test-NpmExactVersion for npm dependencies - fix SARIF line number computation and guard against Line=0 - add type-specific ExcludePatterns to skip node_modules and test fixtures - pin all caret-range versions in root and docusaurus package.json 🔧 - Generated by Copilot

- add pip ExcludePatterns for virtual env directories - replace single SARIF test with 8 focused integration tests - add dependency-pinning docs page with npm scope change rationale - update security README with dependency pinning reference 🔧 - Generated by Copilot

- resolve conflict in docs/docusaurus/package.json with exact-version pinning for new jest-axe packages - resolve conflict in docs/security/README.md retaining both dependency-pinning and sbom-verification rows 🔀 - Generated by Copilot

…d docs - rename ~30 'SHA pinning' references to 'dependency pinning' across 13 files - add workflow npm commands and shell downloads sections to dependency-pinning.md - add pip ExcludePatterns unit tests verifying virtual env directory exclusion 🔧 - Generated by Copilot

…riptions - expand Test-ShellDownloadSecurity from 2 to 12 tests across 4 contexts - add shell-downloads ExcludePatterns tests for Fixtures exclusion - broaden ViolationType descriptions to cover all dependency types - add secure-download.sh fixture for checksum verification tests 🧪 - Generated by Copilot

# feat(coding-standards): add Rust coding standards instructions Added **Rust coding standards** to the coding-standards collection, providing a comprehensive 689-line instructions file that GitHub Copilot applies automatically when editing `**/*.rs` files. > The Rust instructions follow the same prescriptive approach as the existing C#, Python, and Terraform instruction files — taking clear positions on crate choices and conventions rather than surveying alternatives. ## Description ### New Rust Instructions Introduced `.github/instructions/coding-standards/rust/rust.instructions.md` targeting the Rust 2021 edition. The file covers: - **Project structure** with standard crate layout and scaling guidance - **Cargo.toml conventions** including dependency management and release profile optimization - **Naming conventions** with a reference table mapping Rust idioms (PascalCase for types, snake_case for functions, kebab-case for crate names) - **Error handling** using `thiserror` for library error enums and `anyhow` restricted to application-level main/CLI - **Async patterns** with Tokio runtime selection, `tokio::select!`, `async-trait`, and `spawn_blocking` - **Observability** via the `tracing` crate with OpenTelemetry integration - **Serialization** patterns using serde derive macros - **Resilience** via `tokio_retry` with exponential backoff - **Testing conventions** including naming patterns, async test support, and fixture preferences - **Anti-patterns** to avoid, with an explicit list of common mistakes - A **complete working example** demonstrating all conventions in a `PollingService` ### Collection and Plugin Propagation Updated all collection manifests, plugin outputs, marketplace metadata, and README tables to register the new Rust instruction: - Added `rust` tag and instruction item to *coding-standards.collection.yml* and *hve-core-all.collection.yml* - Updated description strings from "bash, Bicep, C#, Python, and Terraform" to "bash, Bicep, C#, Python, Rust, and Terraform" across all touchpoints - Added symlinks in *plugins/coding-standards/instructions/* and *plugins/hve-core-all/instructions/* - Updated the Language and Technology table and directory tree in *.github/instructions/README.md* ### Example Fix Replaced an invalid `namespace example not applicable` line in the complete example section with a valid Rust comment. ## Related Issue(s) #801 ## Type of Change Select all that apply: **Code & Documentation:** * [ ] Bug fix (non-breaking change fixing an issue) * [x] New feature (non-breaking change adding functionality) * [ ] Breaking change (fix or feature causing existing functionality to change) * [x] Documentation update **Infrastructure & Configuration:** * [ ] GitHub Actions workflow * [ ] Linting configuration (markdown, PowerShell, etc.) * [ ] Security configuration * [ ] DevContainer configuration * [ ] Dependency update **AI Artifacts:** * [ ] Reviewed contribution with `prompt-builder` agent and addressed all feedback * [x] Copilot instructions (`.github/instructions/*.instructions.md`) * [ ] Copilot prompt (`.github/prompts/*.prompt.md`) * [ ] Copilot agent (`.github/agents/*.agent.md`) * [ ] Copilot skill (`.github/skills/*/SKILL.md`) > **Note for AI Artifact Contributors**: > > * **Agents**: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review `.github/agents/` before creating new ones. > * **Skills**: Must include both bash and PowerShell scripts. See [Skills](../docs/contributing/skills.md). > * **Model Versions**: Only contributions targeting the **latest Anthropic and OpenAI models** will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected. > * See [Agents Not Accepted](../docs/contributing/custom-agents.md#agents-not-accepted) and [Model Version Requirements](../docs/contributing/ai-artifacts-common.md#model-version-requirements). **Other:** * [ ] Script/automation (`.ps1`, `.sh`, `.py`) * [ ] Other (please describe): ## Sample Prompts (for AI Artifact Contributions) **User Request:** Ask Copilot to generate or edit Rust code in any `.rs` file. The instructions apply automatically via the `applyTo: '**/*.rs'` pattern. **Execution Flow:** 1. User opens or edits a `.rs` file 2. GitHub Copilot loads `rust.instructions.md` based on the glob match 3. Suggestions follow Rust 2021 edition conventions: `thiserror` error handling, `tracing` for observability, Tokio async patterns, and standard naming conventions **Output Artifacts:** Rust code suggestions that conform to the conventions defined in the instructions — proper error types, structured logging, async patterns, and test structure. **Success Indicators:** - Generated Rust code uses `thiserror` for error enums rather than manual `impl Display` - Logging uses `tracing` macros (`info!`, `error!`) rather than `println!` - Async code follows Tokio patterns with proper runtime selection - Test functions follow the `given_when_then` naming convention ## Testing - Ran `npm run plugin:generate` successfully — plugins regenerated with 0 markdown lint errors - Verified all collection manifests, plugin outputs, and README tables were updated consistently - Confirmed alphabetical ordering maintained across all description strings and tag lists - Identified and fixed an invalid line in the complete example section (non-compilable `namespace example not applicable` replaced with a valid Rust comment) - Manual testing of instruction application was not performed ## Checklist ### Required Checks * [x] Documentation is updated (if applicable) * [x] Files follow existing naming conventions * [x] Changes are backwards compatible (if applicable) * [ ] Tests added for new functionality (if applicable) ### AI Artifact Contributions  * [x] Used `/prompt-analyze` to review contribution * [x] Addressed all feedback from `prompt-builder` review * [x] Verified contribution follows common standards and type-specific requirements ### Required Automated Checks The following validation commands must pass before merging: * [x] Markdown linting: `npm run lint:md` * [x] Spell checking: `npm run spell-check` * [x] Frontmatter validation: `npm run lint:frontmatter` * [x] Skill structure validation: `npm run validate:skills` * [x] Link validation: `npm run lint:md-links` --------- Signed-off-by: Marcel Bindseil <marcelbindseil@gmail.com> Co-authored-by: Bill Berry <WilliamBerryiii@users.noreply.github.com> Co-authored-by: Bill Berry <wbery@microsoft.com> Co-authored-by: Jordan Knight <jakkaj@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Vaughan Knight <vaughan@vaughanknight.com> Co-authored-by: Bill Berry <wberry@microsoft.com>

- normalize Severity from 'warning' to 'Medium' in shell-download and npm functions - set ViolationType to 'Unpinned' in all violation-producing functions - add Severity and ViolationType assertions to existing tests 🔧 - Generated by Copilot

…m-pinning-enforcement

…rrors - remove duplicate 'workflow-npm-commands' key in scan type hash - remove unused $Recursive parameter from all functions - fix duplicate 'File Scope' heading in dependency-pinning.md - correct ms.topic frontmatter from 'conceptual' to 'concept' - fix Severity assertion from 'warning' to 'Medium' in tests 🔧 - Generated by Copilot

📝 - Generated by Copilot

…pell check words - remove Recursive parameter from dependency-pinning-scan workflow splat - add coreutils, dgst, pypackages, retargeted to cspell dictionary - exclude docs/docusaurus/build from spell check scope 🔧 - Generated by Copilot

- update is-network-error from 1.3.0 to 1.3.1 in package-lock.json 🔧 - Generated by Copilot

- revert job name to 'Validate SHA Pinning Compliance' to match branch protection rule 🔧 - Generated by Copilot

- broaden dependency-pinning-scan.yml description beyond GitHub Actions - update Test-DependencyPinning.ps1 checks to include npm exact versions 📝 - Generated by Copilot

📐 - Generated by Copilot

- resolve package.json conflict keeping exact-version pinning - include markdownlint-rule-search-replace from main 🔀 - Generated by Copilot

- replace em-dash characters in dependency-pinning.md - regenerate plugin README tables after merge with main 🔧 - Generated by Copilot

- resolve merge conflicts in generated plugin READMEs - regenerate plugins with updated collection manifests - format markdown tables 🔀 - Generated by Copilot

🤖 I have created a release *beep* *boop* --- ## [3.2.0](hve-core-v3.1.46...hve-core-v3.2.0) (2026-03-20) ### ✨ Features * add -OutputPath parameter to Validate-MarkdownFrontmatter.ps1 ([#1134](#1134)) ([fdf1bcf](fdf1bcf)), closes [#1006](#1006) * add action version consistency scan workflow ([#1127](#1127)) ([4229df1](4229df1)) * **agent:** MVE Experiment Designer ([#976](#976)) ([70f86ca](70f86ca)) * **agents:** add ADO Backlog Manager orchestrator agent ([#800](#800)) ([fae3987](fae3987)) * **agents:** add meeting analyst agent for transcript analysis using work-iq ([#502](#502)) ([5345b5b](5345b5b)) * **agents:** add quick-reference line to RPI Phase 5 suggestions ([#897](#897)) ([9a90f39](9a90f39)) * **agents:** add RAI Planner, enhance SSSC Planner, and redesign Security Planner ([#979](#979)) ([06f826c](06f826c)) * **agents:** add symmetric cross-system handoff to GitHub Backlog Manager ([#952](#952)) ([ba34a35](ba34a35)) * **agents:** Functional Code Review Agent — pre-PR functional correctness reviewer ([#733](#733)) ([9cf63b7](9cf63b7)) * **build:** add Python extensions and uv 0.10.8 to devcontainer ([#920](#920)) ([9ca0579](9ca0579)) * **build:** add uv ecosystem to Dependabot configuration ([#913](#913)) ([2a4bd39](2a4bd39)) * **build:** enable npm pinning enforcement in dependency scan ([#838](#838)) ([4e9e31f](4e9e31f)) * **build:** migrate attestation actions to v4.1.0 and add SBOM verification docs ([#841](#841)) ([ca1e65b](ca1e65b)) * **collections:** add four new validator checks (orphan, duplicate, companion, coverage) ([#869](#869)) ([1a96b73](1a96b73)) * **devcontainer,security:** add enterprise artifact hub configuration ([#1032](#1032)) ([1d56d25](1d56d25)) * **docs:** add Rust coding standards and guidelines ([#809](#809)) ([d4c4899](d4c4899)) * **extension:** add Microsoft logo icon to VS Code Marketplace listings ([#906](#906)) ([82aca41](82aca41)) * **github:** add declarative label management ([#953](#953)) ([a1a6845](a1a6845)) * **instructions:** add ADO backlog shared infrastructure ([#786](#786)) ([1914078](1914078)) * **instructions:** add ADO backlog sprint planning and capacity tracking ([#788](#788)) ([d6fb77d](d6fb77d)) * **instructions:** add ADO triage workflow and prompt ([#787](#787)) ([cde0190](cde0190)) * **instructions:** add shared story quality conventions and sprint planning ([#803](#803)) ([a2f18e3](a2f18e3)) * **prompts:** add ADO discovery and work item prompts with agent routing ([#790](#790)) ([7e74523](7e74523)) * **prompts:** add security review prompts ([#1118](#1118)) ([ad30967](ad30967)) * **scripts:** add dynamic Python skill discovery for lint/test ([#957](#957)) ([0a90f57](0a90f57)) * **scripts:** add Get-StandardTimestamp utility to CIHelpers module ([#1126](#1126)) ([b273a4b](b273a4b)) * **scripts:** add Python copyright header validation ([#905](#905)) ([67df902](67df902)) * **scripts:** add Python skill support to Validate-SkillStructure ([#903](#903)) ([68479d9](68479d9)) * **scripts:** add workflow npm command scanning to dependency pinning ([#837](#837)) ([6b5ae06](6b5ae06)) * **security:** add basic security reviewer agent with owasp skills ([#1008](#1008)) ([cb1fd05](cb1fd05)) * **security:** add sigstore attestation bundles and fix component-detection action ([#1148](#1148)) ([f79c272](f79c272)) * **skills:** add Atheris fuzz harness with CI workflow integration ([#1102](#1102)) ([d337e1d](d337e1d)) * **skills:** add PowerPoint automation skill with YAML-driven deck generation ([#868](#868)) ([00465cd](00465cd)) * **skills:** convert hve-core-installer agent to self-contained skill ([#846](#846)) ([1d821fb](1d821fb)) * **skills:** enhance pr-reference skill with flexible filtering and base branch detection ([#1095](#1095)) ([26a32ea](26a32ea)) * **workflows:** add devcontainer infrastructure change log workflow ([#899](#899)) ([8aca446](8aca446)) * **workflows:** add milestone auto-close on stable and pre-release publishes ([#834](#834)) ([79362b1](79362b1)) * **workflows:** add ms.date documentation freshness checking ([#969](#969)) ([3ed441c](3ed441c)) * **workflows:** add Python linting CI workflow with Ruff ([#951](#951)) ([f89f0eb](f89f0eb)) * **workflows:** add Python testing CI workflow with pytest and Codecov ([#934](#934)) ([5e8306f](5e8306f)) * **workflows:** add uv and Python package sync to copilot-setup-steps ([#921](#921)) ([45d517d](45d517d)) ### 🐛 Bug Fixes * **build:** override Linguist vendored flag for Python skill files ([#1155](#1155)) ([0eee5b6](0eee5b6)) * **build:** override serialize-javascript to >=7.0.3 for RCE fix ([#876](#876)) ([e49039a](e49039a)) * **build:** resolve Pinned-Dependencies alerts for vsce npm commands in extension workflows ([#782](#782)) ([89dad9d](89dad9d)) * **build:** update undici and yauzl overrides for security audit ([#1030](#1030)) ([2c2f92f](2c2f92f)) * **docs:** add CLI Plugins to install.md navigation surfaces ([#902](#902)) ([79d6595](79d6595)) * **docs:** add sidebar ordering for Design Thinking documentation ([#832](#832)) ([551fddc](551fddc)), closes [#830](#830) * **docs:** graduate design-thinking to preview and correct stale collection references ([#831](#831)) ([5110e35](5110e35)) * **docs:** include project-planning in UX Designer install guidance ([#908](#908)) ([e7aa9bc](e7aa9bc)) * **docs:** remediate writing-style convention violations ([#865](#865)) ([68b04bc](68b04bc)) * **docs:** remove draft content announcement banner ([#825](#825)) ([b45de80](b45de80)) * **docs:** remove unbounded path-to-regexp override breaking SSG ([#1153](#1153)) ([d810018](d810018)) * **docs:** use actual clone paths instead of folder display names in multi-root workspace settings ([#984](#984)) ([5dbab82](5dbab82)) * **instructions:** replace black with ruff in uv-projects ([#898](#898)) ([b0c06d9](b0c06d9)) * **scripts:** cover .github/ skill files in copyright header validation ([#1055](#1055)) ([#1098](#1098)) ([27fbd33](27fbd33)) * **scripts:** eliminate phantom git changes from plugin generation ([#1035](#1035)) ([e49a1b5](e49a1b5)) * **scripts:** enable JSON log output for lint:version-consistency ([#1033](#1033)) ([52b0885](52b0885)) * **security:** calculate compliance score from total scanned dependencies ([#930](#930)) ([c112c3d](c112c3d)) * **skills:** add AST validation and namespace restriction for content-extra.py ([#1027](#1027)) ([c50c7a3](c50c7a3)) * **skills:** add depth limits to recursive PowerPoint processing functions ([#1028](#1028)) ([bf08994](bf08994)) * **skills:** harden XML parsing and blob writes in powerpoint extract ([#1053](#1053)) ([89d24b1](89d24b1)) * **skills:** resolve ruff lint and format violations in powerpoint skill ([#1048](#1048)) ([17bbe7a](17bbe7a)) * **workflows:** add uv.lock dependencies submission have fork-skip condition ([#1109](#1109)) ([dec56ac](dec56ac)) * **workflows:** automate weekly SHA staleness check with issue creation ([#975](#975)) ([1ea4caa](1ea4caa)) * **workflows:** close Codecov integration gaps for Pester and pytest flags ([#1106](#1106)) ([cca29b7](cca29b7)) * **workflows:** propagate uv sync errors in copilot-setup-steps ([#961](#961)) ([df88d7c](df88d7c)) * **workflows:** resolve release-please skip cascade and Python project discovery ([#1043](#1043)) ([79993e2](79993e2)) * **workflows:** scan only commit subjects for breaking change detection ([#1157](#1157)) ([a38a657](a38a657)) ### 📚 Documentation * clarify HVE Core Extension vs Installer messaging across documentation ([#965](#965)) ([0fceb8f](0fceb8f)) * **docs:** add ADO integration user documentation ([#935](#935)) ([ec89302](ec89302)) * **docs:** add Project Planning agent documentation ([#936](#936)) ([3a3a0fd](3a3a0fd)) * **onboarding:** overhaul marketplace onboarding and documentation site ([#982](#982)) ([4309e10](4309e10)) ### ♻️ Refactoring * **build:** merge code-review collection into coding-standards ([#863](#863)) ([8027e7b](8027e7b)) * **workflows:** rename release pipeline workflows and add marketplace automation triggers ([#829](#829)) ([b6397f4](b6397f4)) ### 🔧 Maintenance * **build:** add clean:logs npm script ([#1122](#1122)) ([f85fe02](f85fe02)), closes [#988](#988) * **build:** add JSON reporter for cspell ([#1123](#1123)) ([6d59f67](6d59f67)) * **ci:** add multi-arch support to copilot-setup-steps binary downloads ([#955](#955)) ([8d0c706](8d0c706)) * **deps-dev:** bump cspell from 9.6.4 to 9.7.0 in the npm-dependencies group ([#839](#839)) ([3fa16ff](3fa16ff)) * **deps:** bump actions/dependency-review-action from 4.8.3 to 4.9.0 in the github-actions group across 1 directory ([#942](#942)) ([1a9b858](1a9b858)) * **deps:** bump cairosvg from 2.8.2 to 2.9.0 in /.github/skills/experimental/powerpoint ([#1025](#1025)) ([f4deda7](f4deda7)) * **deps:** bump dompurify from 3.3.1 to 3.3.2 in /docs/docusaurus ([#924](#924)) ([d2060d6](d2060d6)) * **deps:** bump svgo from 3.3.2 to 3.3.3 in /docs/docusaurus ([#880](#880)) ([6dc2406](6dc2406)) * **deps:** bump the github-actions group across 1 directory with 4 updates ([#1100](#1100)) ([2290dc0](2290dc0)) * **deps:** bump the github-actions group with 6 updates ([#840](#840)) ([f57bc01](f57bc01)) * **docs:** correct New-MsDateReport table rendering and refresh stale docs ([#1114](#1114)) ([c2b806f](c2b806f)) * **settings:** remove orphaned Checkov config and stale gitignore entries ([#870](#870)) ([98fcd74](98fcd74)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: hve-core-release-please[bot] <254602402+hve-core-release-please[bot]@users.noreply.github.com> Co-authored-by: Bill Berry <wberry@microsoft.com>

Bill Berry added 2 commits March 1, 2026 18:21

chore(workflows): enable npm pinning enforcement in dependency scan

e465ae9

- update dependency-types default to include npm and workflow-npm-commands 🔒 - Generated by Copilot

WilliamBerryiii requested a review from a team as a code owner March 2, 2026 04:37

WilliamBerryiii added 2 commits March 2, 2026 09:53

WilliamBerryiii mentioned this pull request Mar 2, 2026

npm dependency pinning uses exact-version enforcement instead of SHA-pinning #855

Open

nguyena2 approved these changes Mar 2, 2026

View reviewed changes

Bill Berry and others added 17 commits March 2, 2026 13:18

build(docs): merge main into feature branch

0f7d122

- resolve conflict in docs/docusaurus/package.json with exact-version pinning for new jest-axe packages - resolve conflict in docs/security/README.md retaining both dependency-pinning and sbom-verification rows 🔀 - Generated by Copilot

Merge remote-tracking branch 'origin/main' into feature/526-enable-np…

91712ee

…m-pinning-enforcement

style(docs): normalize markdown table formatting

a4221a8

📝 - Generated by Copilot

fix(build): regenerate docusaurus lock file for is-network-error update

563625b

- update is-network-error from 1.3.0 to 1.3.1 in package-lock.json 🔧 - Generated by Copilot

Merge branch 'main' into feature/526-enable-npm-pinning-enforcement

eac3aa8

fix(workflows): restore required check job name for branch protection

3e3a25b

- revert job name to 'Validate SHA Pinning Compliance' to match branch protection rule 🔧 - Generated by Copilot

docs: update workflows.md to reflect expanded dependency pinning scope

5fd2b4a

- broaden dependency-pinning-scan.yml description beyond GitHub Actions - update Test-DependencyPinning.ps1 checks to include npm exact versions 📝 - Generated by Copilot

style(docs): format markdown tables in workflows.md

dac8c4e

📐 - Generated by Copilot

build: merge main into feature branch

c31e621

- resolve package.json conflict keeping exact-version pinning - include markdownlint-rule-search-replace from main 🔀 - Generated by Copilot

fix(docs): replace em-dashes and regenerate plugin tables

7e88436

- replace em-dash characters in dependency-pinning.md - regenerate plugin README tables after merge with main 🔧 - Generated by Copilot

chore(build): merge origin/main and regenerate plugins

c5c81c6

- resolve merge conflicts in generated plugin READMEs - regenerate plugins with updated collection manifests - format markdown tables 🔀 - Generated by Copilot

WilliamBerryiii merged commit 4e9e31f into main Mar 5, 2026
24 checks passed

This was referenced Mar 5, 2026

chore(main): pre-release 3.1.69 #879

Closed

chore(main): release hve-core 3.2.0 #843

Closed

chore(main): pre-release 3.1.70 #881

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(build): enable npm pinning enforcement in dependency scan#838

feat(build): enable npm pinning enforcement in dependency scan#838
WilliamBerryiii merged 21 commits intomainfrom
feature/526-enable-npm-pinning-enforcement

WilliamBerryiii commented Mar 2, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 2, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Mar 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

WilliamBerryiii commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Scope Change: npm Exact-Version Enforcement

Follow-Up Hardening (commit b8bd099)

Related Issue(s)

Type of Change

Testing

Checklist

Required Checks

Required Automated Checks

Security Considerations

Additional Notes

Uh oh!

github-actions bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Uh oh!

codecov-commenter commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

WilliamBerryiii commented Mar 2, 2026 •

edited

Loading

Follow-Up Hardening (commit `b8bd099`)

github-actions bot commented Mar 2, 2026 •

edited

Loading

codecov-commenter commented Mar 2, 2026 •

edited

Loading