Skip to content

fix(deps): remediate npm audit vulnerabilities and add local Puppeteer Edge fallback - #2753

Merged
Hector Hernandez (hectorhdzg) merged 4 commits into
microsoft:mainfrom
hectorhdzg:fix/deps-vuln-overrides-puppeteer-edge-fallback
Aug 11, 2026
Merged

fix(deps): remediate npm audit vulnerabilities and add local Puppeteer Edge fallback#2753
Hector Hernandez (hectorhdzg) merged 4 commits into
microsoft:mainfrom
hectorhdzg:fix/deps-vuln-overrides-puppeteer-edge-fallback

Conversation

@hectorhdzg

Copy link
Copy Markdown
Member

Resolves all outstanding npm audit findings (12 → 0) in the build/dev tooling and prevents Puppeteer's downloaded Chromium from being blocked by Defender/WDAC on managed dev machines — without changing official/CI build behavior.

Dependency vulnerabilities (npm audit: 12 → 0)

Updated the overrides in root package.json to patched versions:

Package Advisory Fix
js-yaml omap quadratic-CPU DoS ^4.3.1 (+ nested grunt js-yaml ^3.15.1)
linkify-it mailto: validator ReDoS ^5.0.2
tar uncontrolled recursion stack-overflow DoS >=7.5.22
fast-xml-parser DOCTYPE entity-limit reset >=5.10.1
fast-uri host confusion via backslash authority >=3.1.5
ip-address SSRF / trust-boundary bypass >=10.4.0
morgan log forging via control characters ^1.11.0
brace-expansion expansion DoS ^1.1.18 (scoped under minimatch)
  • All affected packages are transitive dev/build tooling dependencies — no shipped SDK code changes.
  • grunt (needs js-yaml 3.x) and rush both still load; brace-expansion is scoped under minimatch so 2.x consumers are unaffected.
  • npm audit now reports 0 vulnerabilities.

Puppeteer executable resolution (gruntfile.js)

Added a CI-gated _getBrowserExecutablePath() helper, wired into both Puppeteer QUnit blocks (unit + perf). Resolution order:

  1. Uses PUPPETEER_EXECUTABLE_PATH if explicitly set (works anywhere).
  2. Returns undefined when TF_BUILD / CI / BUILD_BUILDID is set → CI and official OneBranch/ADO builds use bundled Chromium exactly as before.
  3. Local managed dev only: falls back to installed, IT-approved Microsoft Edge to avoid the Defender/WDAC block on the downloaded Chromium.

Add/raise pnpm globalOverrides for transitive advisories and regenerate the shared Rush pnpm lockfile:

- brace-expansion >=5.0.7 (DoS x3), fast-uri >=3.1.4 (host confusion x3), ip-address >=10.3.1 (SSRF), linkify-it >=5.0.2 (ReDoS), morgan >=1.11.0 (log forging); js-yaml raised >=4.2.0 -> >=4.3.0 <5.0.0 (quadratic-CPU DoS, kept in 4.x). pnpm audit now reports 0 vulnerabilities.
…ge fallback

Dependency vulnerabilities (npm audit: 12 -> 0)
- Update root package.json overrides to patched versions:
  - js-yaml ^4.3.1 (+ nested grunt js-yaml ^3.15.1) - omap quadratic-CPU DoS
  - linkify-it ^5.0.2 - mailto validator ReDoS
  - tar >=7.5.22 - uncontrolled recursion stack-overflow DoS
  - fast-xml-parser >=5.10.1 - DOCTYPE entity-limit reset
  - fast-uri >=3.1.5 - host confusion via backslash authority
  - ip-address >=10.4.0 - SSRF / trust-boundary bypass
  - morgan ^1.11.0 - log forging via control characters
  - brace-expansion ^1.1.18 scoped under minimatch - expansion DoS
- All affected packages are transitive dev/build tooling deps; grunt and rush
  still load, no shipped SDK code changes.

Puppeteer executable resolution (gruntfile.js)
- Add CI-gated _getBrowserExecutablePath() helper wired into both Puppeteer
  QUnit blocks. Honors PUPPETEER_EXECUTABLE_PATH, returns undefined in
  CI/official builds (TF_BUILD/CI/BUILD_BUILDID) so bundled Chromium is used
  unchanged, and only falls back to installed Microsoft Edge on local managed
  dev machines where Defender/WDAC blocks the downloaded Chromium.
Copilot AI lite review requested due to automatic review settings August 11, 2026 17:22
@hectorhdzg
Hector Hernandez (hectorhdzg) requested a review from a team as a code owner August 11, 2026 17:22

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates build/dev-tooling dependency overrides to eliminate npm audit vulnerabilities and adds a local-only Puppeteer executable resolution fallback (favoring PUPPETEER_EXECUTABLE_PATH, otherwise using Microsoft Edge on managed dev machines while preserving CI behavior).

Changes:

  • Updated root package.json overrides to patched versions for several transitive tooling dependencies.
  • Added a gruntfile.js helper to resolve Puppeteer’s executablePath (explicit env var → CI unchanged → local Edge fallback).
  • Updated Rush/pnpm override configuration and lockfile to reflect the dependency changes.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

File Description
package.json Updates npm overrides to patched transitive tooling dependency versions.
gruntfile.js Adds Puppeteer executable resolution helper and wires it into QUnit/perf Puppeteer options.
common/config/rush/pnpm-config.json Updates Rush pnpm global overrides to remediate vulnerable transitive deps.
common/config/rush/pnpm-lock.yaml Refreshes pnpm lockfile to reflect the updated override resolutions.
Files not reviewed (1)
  • common/config/rush/pnpm-lock.yaml: Generated file

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread gruntfile.js
Comment thread common/config/rush/pnpm-config.json Outdated
Comment thread common/config/rush/pnpm-lock.yaml Outdated
…ble range

Addresses PR review: the rush globalOverrides allowed brace-expansion to
resolve to v5+ (engines node 20 || >=22), which would break the Node 18 CI
matrix. Constrain to '>=1.1.18 <5.0.0' so it resolves to 4.0.1 (engines
node >=18). Also align the remaining security minimums in
common/config/rush/pnpm-config.json with the root package.json overrides:
tar >=7.5.22, js-yaml >=4.3.1, fast-uri >=3.1.5, ip-address >=10.4.0.
Lockfile regenerated: brace-expansion 5.0.9 -> 4.0.1, balanced-match
4.0.4 -> 3.0.1 (node >=16).
…patible)

The previous '>=1.1.18 <5.0.0' bound broke the build: minimatch@10.2.5
requires brace-expansion ^5.0.5, so forcing 4.0.1 broke its glob matching.
brace-expansion 5.0.8+ dropped Node 18 (engines '20 || >=22'); 5.0.7 is the
last 5.x that still supports Node 18 and is the patched/secure floor.
Pin to '>=5.0.7 <5.0.8' so it resolves to 5.0.7, satisfying the Node 18 CI
matrix, minimatch's ^5.0.5 requirement, and the security fix.
Lockfile: brace-expansion 4.0.1 -> 5.0.7, balanced-match 3.0.1 -> 4.0.4.
@hectorhdzg
Hector Hernandez (hectorhdzg) merged commit 0535091 into microsoft:main Aug 11, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants