fix(deps): remediate npm audit vulnerabilities and add local Puppeteer Edge fallback - #2753
Merged
Hector Hernandez (hectorhdzg) merged 4 commits intoAug 11, 2026
Conversation
Add/raise pnpm globalOverrides for transitive advisories and regenerate the shared Rush pnpm lockfile: - brace-expansion >=5.0.7 (DoS x3), fast-uri >=3.1.4 (host confusion x3), ip-address >=10.3.1 (SSRF), linkify-it >=5.0.2 (ReDoS), morgan >=1.11.0 (log forging); js-yaml raised >=4.2.0 -> >=4.3.0 <5.0.0 (quadratic-CPU DoS, kept in 4.x). pnpm audit now reports 0 vulnerabilities.
…ge fallback Dependency vulnerabilities (npm audit: 12 -> 0) - Update root package.json overrides to patched versions: - js-yaml ^4.3.1 (+ nested grunt js-yaml ^3.15.1) - omap quadratic-CPU DoS - linkify-it ^5.0.2 - mailto validator ReDoS - tar >=7.5.22 - uncontrolled recursion stack-overflow DoS - fast-xml-parser >=5.10.1 - DOCTYPE entity-limit reset - fast-uri >=3.1.5 - host confusion via backslash authority - ip-address >=10.4.0 - SSRF / trust-boundary bypass - morgan ^1.11.0 - log forging via control characters - brace-expansion ^1.1.18 scoped under minimatch - expansion DoS - All affected packages are transitive dev/build tooling deps; grunt and rush still load, no shipped SDK code changes. Puppeteer executable resolution (gruntfile.js) - Add CI-gated _getBrowserExecutablePath() helper wired into both Puppeteer QUnit blocks. Honors PUPPETEER_EXECUTABLE_PATH, returns undefined in CI/official builds (TF_BUILD/CI/BUILD_BUILDID) so bundled Chromium is used unchanged, and only falls back to installed Microsoft Edge on local managed dev machines where Defender/WDAC blocks the downloaded Chromium.
Copilot started reviewing on behalf of
Hector Hernandez (hectorhdzg)
August 11, 2026 17:23
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Updates build/dev-tooling dependency overrides to eliminate npm audit vulnerabilities and adds a local-only Puppeteer executable resolution fallback (favoring PUPPETEER_EXECUTABLE_PATH, otherwise using Microsoft Edge on managed dev machines while preserving CI behavior).
Changes:
- Updated root
package.jsonoverridesto patched versions for several transitive tooling dependencies. - Added a
gruntfile.jshelper to resolve Puppeteer’sexecutablePath(explicit env var → CI unchanged → local Edge fallback). - Updated Rush/pnpm override configuration and lockfile to reflect the dependency changes.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
package.json |
Updates npm overrides to patched transitive tooling dependency versions. |
gruntfile.js |
Adds Puppeteer executable resolution helper and wires it into QUnit/perf Puppeteer options. |
common/config/rush/pnpm-config.json |
Updates Rush pnpm global overrides to remediate vulnerable transitive deps. |
common/config/rush/pnpm-lock.yaml |
Refreshes pnpm lockfile to reflect the updated override resolutions. |
Files not reviewed (1)
- common/config/rush/pnpm-lock.yaml: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…ble range Addresses PR review: the rush globalOverrides allowed brace-expansion to resolve to v5+ (engines node 20 || >=22), which would break the Node 18 CI matrix. Constrain to '>=1.1.18 <5.0.0' so it resolves to 4.0.1 (engines node >=18). Also align the remaining security minimums in common/config/rush/pnpm-config.json with the root package.json overrides: tar >=7.5.22, js-yaml >=4.3.1, fast-uri >=3.1.5, ip-address >=10.4.0. Lockfile regenerated: brace-expansion 5.0.9 -> 4.0.1, balanced-match 4.0.4 -> 3.0.1 (node >=16).
…patible) The previous '>=1.1.18 <5.0.0' bound broke the build: minimatch@10.2.5 requires brace-expansion ^5.0.5, so forcing 4.0.1 broke its glob matching. brace-expansion 5.0.8+ dropped Node 18 (engines '20 || >=22'); 5.0.7 is the last 5.x that still supports Node 18 and is the patched/secure floor. Pin to '>=5.0.7 <5.0.8' so it resolves to 5.0.7, satisfying the Node 18 CI matrix, minimatch's ^5.0.5 requirement, and the security fix. Lockfile: brace-expansion 4.0.1 -> 5.0.7, balanced-match 3.0.1 -> 4.0.4.
Jackson Weber (JacksonWeber)
approved these changes
Aug 11, 2026
Hector Hernandez (hectorhdzg)
merged commit Aug 11, 2026
0535091
into
microsoft:main
9 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves all outstanding
npm auditfindings (12 → 0) in the build/dev tooling and prevents Puppeteer's downloaded Chromium from being blocked by Defender/WDAC on managed dev machines — without changing official/CI build behavior.Dependency vulnerabilities (npm audit: 12 → 0)
Updated the
overridesin rootpackage.jsonto patched versions:^4.3.1(+ nested gruntjs-yaml ^3.15.1)mailto:validator ReDoS^5.0.2>=7.5.22>=5.10.1>=3.1.5>=10.4.0^1.11.0^1.1.18(scoped underminimatch)grunt(needs js-yaml 3.x) andrushboth still load;brace-expansionis scoped underminimatchso 2.x consumers are unaffected.npm auditnow reports 0 vulnerabilities.Puppeteer executable resolution (
gruntfile.js)Added a CI-gated
_getBrowserExecutablePath()helper, wired into both Puppeteer QUnit blocks (unit + perf). Resolution order:PUPPETEER_EXECUTABLE_PATHif explicitly set (works anywhere).undefinedwhenTF_BUILD/CI/BUILD_BUILDIDis set → CI and official OneBranch/ADO builds use bundled Chromium exactly as before.