Skip to content

chore(deps): bump the npm_and_yarn group across 7 directories with 9 updates - #2402

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/samples/autonomous-pipeline/npm_and_yarn-f69f6b8094
Open

chore(deps): bump the npm_and_yarn group across 7 directories with 9 updates#2402
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/samples/autonomous-pipeline/npm_and_yarn-f69f6b8094

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 6, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 6 updates in the /samples/autonomous-pipeline directory:

Package From To
@github/copilot 0.0.414 1.0.107
@vitest/mocker 4.1.10 5.1.0
protobufjs 7.5.4 7.6.6
vite 8.1.5 8.3.6
ws 8.19.0 8.22.1
zod 4.3.6 4.6.7

Bumps the npm_and_yarn group with 3 updates in the /samples/cost-aware-router directory: @vitest/mocker, vite and zod.
Bumps the npm_and_yarn group with 2 updates in the /samples/hello-squad directory: @vitest/mocker and vite.
Bumps the npm_and_yarn group with 2 updates in the /samples/hook-governance directory: @vitest/mocker and vite.
Bumps the npm_and_yarn group with 1 update in the /samples/storage-provider-azure directory: @azure/msal-node.
Bumps the npm_and_yarn group with 3 updates in the /samples/streaming-chat directory: @vitest/mocker, source-map-js and vite.
Bumps the npm_and_yarn group with 1 update in the /test-fixtures/dogfood/node-monorepo/packages/core directory: vitest.

Updates @github/copilot from 0.0.414 to 1.0.107

Release notes

Sourced from @​github/copilot's releases.

1.0.107

2026-11-06

  • Rex terminals render inline images using Kitty direct placements.
  • Add /code command to open the current session in VS Code
  • Add a Fusion tier setting to copilot config.
  • Make /settings open the unified dashboard for all users and add global search across settings and local resources.
  • Interactive CLI reports program status to supporting terminals, including when attention is needed.
  • Add opt-in session management tools and @​mentions for opted-in local sessions
  • Add COPILOT_SESSION_CWD for launching and expanding LSP and local MCP server configs
  • Add GPT-6.1 Terra as a selectable model under New models when available to your account
  • Add a Sandbox extensions setting to run extension processes inside the sandbox
  • Add MATS telemetry for Entra authentication through OneAuth, respecting client telemetry opt-out.
  • An image removed from the prompt with Ctrl+U, Ctrl+K or Ctrl+W, or replaced by a recalled history entry, is no longer sent with the message, and Ctrl+S can stash the prompt afterwards.
  • Pasted text containing NEL, Unicode line or paragraph separators now fills separate prompt lines, and pasted DEL and C1 control characters are dropped, instead of being kept in the prompt and cutting characters off the end of the row.
  • In copilot -p --plan, the agent is no longer told to suggest Shift+Tab to leave plan mode, which only works in the interactive interface, and is asked to include the plan's key points in its reply instead.
  • copilot --resume <id> no longer waits with no output and no end when the Copilot task service does not respond; the task lookup now gives up after 10 seconds and resolution continues.
  • Sandboxed grep, rg, and glob now report Windows launch failures instead of silent no-match results
  • Model picker shows context window size for flat, unpriced, and single-tier models
  • Sandboxed local MCP servers respect relative filesystem permissions from the session directory, even when configured with a different working directory.
  • PowerShell commands work on Windows when the CLI is installed in a long directory path
  • Switching sessions while other sessions are busy no longer crashes the CLI and leaves a blank terminal
  • Keep readable image attachments when retrying a prompt that contains a corrupt image
  • MCP Entra authentication now falls back to the VS Code registration when Copilot CLI preauthorization is unavailable.
  • Sandboxed local MCP servers now start correctly when configured with a relative cwd.
  • On Windows, sandboxed sessions in nested Git directories can change to and write at the repository root
  • Autopilot no longer starts implementing its own recommendation after a request that only asked for a review or analysis
  • Suppress unnecessary MCP reload summaries when plugin servers remain unchanged
  • A model request that Copilot's service answers with an empty 404 while under load is now retried instead of ending the turn with "Execution failed: 404".
  • copilot help config now lists every setting the settings catalog offers, including the ones that were missing from its hand-written text, such as askUser, effortLevel, planModel, toolSearch and worktreeBaseRef
  • ACP clients can switch a session started with --yolo out of autopilot, and allow-all stays on, instead of the switch failing as blocked by policy and a second attempt turning allow-all off.
  • The @ file picker now underlines a name with a capital dotted I, such as İstanbul.txt, when the query is typed without the dot, and no longer shortens that row's matched folder.
  • The @ file picker now underlines matches in names stored with decomposed accents or found by a query typed without accents, and no longer shortens such a row's matched folder.
  • Up and Down in a multi-line prompt keep the column you started from when they pass through a shorter line, instead of leaving the caret near the start of the line.
  • Ctrl+Y and /share research skip research folder entries that are not readable files, such as a broken link or a folder named like a report, instead of failing or offering them.
  • Show each agent's selection ID in /agent when multiple agents share a display name.
  • The edit tool now fails at once on a named pipe, socket or device instead of waiting forever for the other end of a FIFO, which stalled the turn.
  • An empty plan.md no longer shows the ctrl+y plan hint or Plan: yes in /session, and ctrl+y opens the research report instead, matching /session plan.
  • The footer keeps the "N scheduled", sandbox, YOLO and CI status items whole on narrow terminals by shortening the directory and branch first, instead of cutting the items off the end of the row.
  • Pull request, issue and gist details, and their load errors, no longer let escape sequences in titles, names, branches, gist files or server messages restyle the terminal.
  • Show the saved paused goal and continuation guidance when resuming an autopilot session.
  • Issues and pull requests picked with # are no longer dropped from the message when another one is picked in front of them, and an issue picked twice is sent once.
  • copilot help billing now says the footer shows the AI credits used in this session (nothing by default on the legacy billing platform), and that the /statusline quota item is off by default and ai-used is on.
  • copilot help config now says copyOnSelect is on by default on macOS, that /keep-alive changes only the current session, that logLevel is set in the /settings dialog or settings.json rather than copilot config, and that trustedFolders lives in config.json and is filled by the folder-trust prompt.
  • copilot help environment now says a COPILOT_AUTO_TIER value of "fast" is ignored with a notice rather than rejected, and that USE_TGREP=true does not override whether indexed search is available for your account or USE_BUILTIN_RIPGREP=false.
  • copilot help config, copilot help environment and copilot help acp no longer name the hidden --prefer-version, --server and --stdio options.
  • copilot help limits shows a status example at the real minimum AI credit limit and says the final-call warning appears when 10% or less of the limit remains
  • copilot help monitoring now says an http:// OTLP endpoint disables export only when an OTLP CA certificate or client certificate/key variable is set, not for every http:// endpoint.
  • copilot help permissions now documents glob patterns in write(path) and read(path) rules, lists the read and memory kinds, and explains that an unscoped write rule approves shell output redirection but not the command itself; it no longer says wildcard matching is coming in the future.
  • copilot --help and copilot help --help now list the acp help topic, and copilot help --help no longer prints its description and topic list with stray indentation.

... (truncated)

Changelog

Sourced from @​github/copilot's changelog.

1.0.107 - 2026-11-06

  • Rex terminals render inline images using Kitty direct placements.
  • Add /code command to open the current session in VS Code
  • Add a Fusion tier setting to copilot config.
  • Make /settings open the unified dashboard for all users and add global search across settings and local resources.
  • Interactive CLI reports program status to supporting terminals, including when attention is needed.
  • Add opt-in session management tools and @​mentions for opted-in local sessions
  • Add COPILOT_SESSION_CWD for launching and expanding LSP and local MCP server configs
  • Add GPT-6.1 Terra as a selectable model under New models when available to your account
  • Add a Sandbox extensions setting to run extension processes inside the sandbox
  • Add MATS telemetry for Entra authentication through OneAuth, respecting client telemetry opt-out.
  • An image removed from the prompt with Ctrl+U, Ctrl+K or Ctrl+W, or replaced by a recalled history entry, is no longer sent with the message, and Ctrl+S can stash the prompt afterwards.
  • Pasted text containing NEL, Unicode line or paragraph separators now fills separate prompt lines, and pasted DEL and C1 control characters are dropped, instead of being kept in the prompt and cutting characters off the end of the row.
  • In copilot -p --plan, the agent is no longer told to suggest Shift+Tab to leave plan mode, which only works in the interactive interface, and is asked to include the plan's key points in its reply instead.
  • copilot --resume <id> no longer waits with no output and no end when the Copilot task service does not respond; the task lookup now gives up after 10 seconds and resolution continues.
  • Sandboxed grep, rg, and glob now report Windows launch failures instead of silent no-match results
  • Model picker shows context window size for flat, unpriced, and single-tier models
  • Sandboxed local MCP servers respect relative filesystem permissions from the session directory, even when configured with a different working directory.
  • PowerShell commands work on Windows when the CLI is installed in a long directory path
  • Switching sessions while other sessions are busy no longer crashes the CLI and leaves a blank terminal
  • Keep readable image attachments when retrying a prompt that contains a corrupt image
  • MCP Entra authentication now falls back to the VS Code registration when Copilot CLI preauthorization is unavailable.
  • Sandboxed local MCP servers now start correctly when configured with a relative cwd.
  • On Windows, sandboxed sessions in nested Git directories can change to and write at the repository root
  • Autopilot no longer starts implementing its own recommendation after a request that only asked for a review or analysis
  • Suppress unnecessary MCP reload summaries when plugin servers remain unchanged
  • A model request that Copilot's service answers with an empty 404 while under load is now retried instead of ending the turn with "Execution failed: 404".
  • copilot help config now lists every setting the settings catalog offers, including the ones that were missing from its hand-written text, such as askUser, effortLevel, planModel, toolSearch and worktreeBaseRef
  • ACP clients can switch a session started with --yolo out of autopilot, and allow-all stays on, instead of the switch failing as blocked by policy and a second attempt turning allow-all off.
  • The @ file picker now underlines a name with a capital dotted I, such as İstanbul.txt, when the query is typed without the dot, and no longer shortens that row's matched folder.
  • The @ file picker now underlines matches in names stored with decomposed accents or found by a query typed without accents, and no longer shortens such a row's matched folder.
  • Up and Down in a multi-line prompt keep the column you started from when they pass through a shorter line, instead of leaving the caret near the start of the line.
  • Ctrl+Y and /share research skip research folder entries that are not readable files, such as a broken link or a folder named like a report, instead of failing or offering them.
  • Show each agent's selection ID in /agent when multiple agents share a display name.
  • The edit tool now fails at once on a named pipe, socket or device instead of waiting forever for the other end of a FIFO, which stalled the turn.
  • An empty plan.md no longer shows the ctrl+y plan hint or Plan: yes in /session, and ctrl+y opens the research report instead, matching /session plan.
  • The footer keeps the "N scheduled", sandbox, YOLO and CI status items whole on narrow terminals by shortening the directory and branch first, instead of cutting the items off the end of the row.
  • Pull request, issue and gist details, and their load errors, no longer let escape sequences in titles, names, branches, gist files or server messages restyle the terminal.
  • Show the saved paused goal and continuation guidance when resuming an autopilot session.
  • Issues and pull requests picked with # are no longer dropped from the message when another one is picked in front of them, and an issue picked twice is sent once.
  • copilot help billing now says the footer shows the AI credits used in this session (nothing by default on the legacy billing platform), and that the /statusline quota item is off by default and ai-used is on.
  • copilot help config now says copyOnSelect is on by default on macOS, that /keep-alive changes only the current session, that logLevel is set in the /settings dialog or settings.json rather than copilot config, and that trustedFolders lives in config.json and is filled by the folder-trust prompt.
  • copilot help environment now says a COPILOT_AUTO_TIER value of "fast" is ignored with a notice rather than rejected, and that USE_TGREP=true does not override whether indexed search is available for your account or USE_BUILTIN_RIPGREP=false.
  • copilot help config, copilot help environment and copilot help acp no longer name the hidden --prefer-version, --server and --stdio options.
  • copilot help limits shows a status example at the real minimum AI credit limit and says the final-call warning appears when 10% or less of the limit remains
  • copilot help monitoring now says an http:// OTLP endpoint disables export only when an OTLP CA certificate or client certificate/key variable is set, not for every http:// endpoint.
  • copilot help permissions now documents glob patterns in write(path) and read(path) rules, lists the read and memory kinds, and explains that an unscoped write rule approves shell output redirection but not the command itself; it no longer says wildcard matching is coming in the future.
  • copilot --help and copilot help --help now list the acp help topic, and copilot help --help no longer prints its description and topic list with stray indentation.
  • Form and settings text fields show the control characters of a stored value, such as an MCP server command, instead of letting them recolor or hide its text.

... (truncated)

Commits
  • 841e7a5 Update changelog.md for version 1.0.106
  • e192829 Publish a Copilot CLI server container image on release (#5308)
  • 84ee80e Update changelog.md for version 1.0.105
  • 8f18bec Update changelog.md for version 1.0.104
  • 7ea98df Update changelog.md for version 1.0.103
  • 17631dc Update changelog.md for version 1.0.102
  • c66d206 Update changelog.md for version 1.0.101
  • 84a2bd3 Update changelog.md for version 1.0.100
  • c01c663 Update changelog.md for version 1.0.98
  • 76c3172 Update changelog.md for version 1.0.97
  • Additional commits viewable in compare view

Updates @vitest/mocker from 4.1.10 to 5.1.0

Release notes

Sourced from @​vitest/mocker's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates protobufjs from 7.5.4 to 7.6.6

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.6.6

7.6.6 (2026-08-27)

Bug Fixes

protobufjs: v7.6.5

7.6.5 (2026-07-04)

Bug Fixes

protobufjs: v7.6.4

7.6.4 (2026-06-12)

Bug Fixes

protobufjs: v7.6.3

7.6.3 (2026-06-09)

Bug Fixes

  • Avoid name collisions in generated code (#2311) (78a9576)
  • Preserve null conversion behavior for fieldless messages (#2312) (df91652)

protobufjs: v7.6.2

7.6.2 (2026-05-30)

Bug Fixes

  • Backport consistency and correctness fixes (#2294) (a92f72e)

protobufjs: v7.6.1

7.6.1 (2026-05-22)

Bug Fixes

... (truncated)

Changelog

Sourced from protobufjs's changelog.

7.6.6 (2026-08-27)

Bug Fixes

7.6.5 (2026-07-04)

Bug Fixes

7.6.4 (2026-06-12)

Bug Fixes

7.6.3 (2026-06-09)

Bug Fixes

  • Avoid name collisions in generated code (#2311) (78a9576)
  • Preserve null conversion behavior for fieldless messages (#2312) (df91652)

7.6.2 (2026-05-30)

Bug Fixes

  • Backport consistency and correctness fixes (#2294) (a92f72e)

7.6.1 (2026-05-22)

Bug Fixes

7.6.0 (2026-05-18)

Features

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for protobufjs since your current version.


Updates vite from 8.1.5 to 8.3.6

Release notes

Sourced from vite's releases.

v8.3.6

Bug Fixes

  • await overlapping plugin container close calls (#23935) (175bbeb)
  • build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
  • build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
  • bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
  • bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
  • deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
  • deps: update all non-major dependencies (#23896) (46b91c5)
  • deps: update all non-major dependencies (#23966) (b3cb057)
  • deps: update rolldown-related dependencies (#23868) (a63eb87)
  • deps: update rolldown-related dependencies (#23967) (0105733)
  • dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
  • html: remove adjacent module tags on the first line (#23823) (eab1dc2)
  • ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
  • optimizer: detect cache dir precisely (#23912) (cc9bc21)
  • optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
  • respect build.sourcemap from environment (#23879) (82e7aa0)
  • server: escape HTML attributes (#23995) (a270391)
  • server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
  • ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
  • use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
  • wasm: reject .wasm outside server.fs (#23914) (64e2467)
  • watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
  • worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

Miscellaneous Chores

Build System

  • generate sourcemaps in import-meta-current-dirname plugin (#23904) (20d355a)

v8.3.5

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
  • bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.6 (2026-11-05)

Bug Fixes

@dependabot
chore(deps): bump the npm_and_yarn group across 7 directories with 9 …
c0746f4 
…updates

Bumps the npm_and_yarn group with 6 updates in the /samples/autonomous-pipeline directory:

| Package | From | To |
| --- | --- | --- |
| [@github/copilot](https://github.com/github/copilot-cli) | `0.0.414` | `1.0.107` |
| [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `4.1.10` | `5.1.0` |
| [protobufjs](https://github.com/protobufjs/protobuf.js) | `7.5.4` | `7.6.6` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.3.6` |
| [ws](https://github.com/websockets/ws) | `8.19.0` | `8.22.1` |
| [zod](https://github.com/colinhacks/zod) | `4.3.6` | `4.6.7` |

Bumps the npm_and_yarn group with 3 updates in the /samples/cost-aware-router directory: [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [zod](https://github.com/colinhacks/zod).
Bumps the npm_and_yarn group with 2 updates in the /samples/hello-squad directory: [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Bumps the npm_and_yarn group with 2 updates in the /samples/hook-governance directory: [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Bumps the npm_and_yarn group with 1 update in the /samples/storage-provider-azure directory: [@azure/msal-node](https://github.com/AzureAD/microsoft-authentication-library-for-js).
Bumps the npm_and_yarn group with 3 updates in the /samples/streaming-chat directory: [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker), [source-map-js](https://github.com/7rulnik/source-map-js) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Bumps the npm_and_yarn group with 1 update in the /test-fixtures/dogfood/node-monorepo/packages/core directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `@github/copilot` from 0.0.414 to 1.0.107
- [Release notes](https://github.com/github/copilot-cli/releases)
- [Changelog](https://github.com/github/copilot-cli/blob/main/changelog.md)
- [Commits](github/copilot-cli@v0.0.414...v1.0.107)

Updates `@vitest/mocker` from 4.1.10 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/mocker)

Updates `protobufjs` from 7.5.4 to 7.6.6
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.6/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-v7.5.4...protobufjs-v7.6.6)

Updates `vite` from 8.1.5 to 8.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite)

Updates `ws` from 8.19.0 to 8.22.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.19.0...8.22.1)

Updates `zod` from 4.3.6 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.3.6...v4.6.7)

Updates `@vitest/mocker` from 4.1.11 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/mocker)

Updates `vite` from 8.2.2 to 8.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite)

Updates `zod` from 4.3.6 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.3.6...v4.6.7)

Updates `@vitest/mocker` from 4.1.11 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/mocker)

Updates `vite` from 8.2.2 to 8.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite)

Updates `@vitest/mocker` from 4.1.10 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/mocker)

Updates `vite` from 8.1.5 to 8.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite)

Updates `@azure/msal-node` from 5.4.2 to 7.2.0
- [Release notes](https://github.com/AzureAD/microsoft-authentication-library-for-js/releases)
- [Commits](AzureAD/microsoft-authentication-library-for-js@msal-node-v5.4.2...msal-node-v7.2.0)

Updates `@vitest/mocker` from 4.1.9 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/mocker)

Updates `source-map-js` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2)

Updates `vite` from 8.0.16 to 8.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite)

Updates `vitest` from 0.34.6 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

---
updated-dependencies:
- dependency-name: "@github/copilot"
  dependency-version: 1.0.107
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 5.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: protobufjs
  dependency-version: 7.6.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.3.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.22.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 5.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.3.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 5.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.3.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 5.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.3.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@azure/msal-node"
  dependency-version: 7.2.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 5.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.3.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 6, 2026
Copilot AI auto review requested due to automatic review settings November 6, 2026 22:37
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Nov 6, 2026
This was referenced Nov 6, 2026
Closed
Closed
Closed
Copilot AI reviewed Nov 6, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Several samples still document and allow Node 20 while upgraded dependencies require Node 22 or newer, leaving their stated setup unsupported.

6 open issues
6 files not reviewed
  • samples/autonomous-pipeline/package-lock.json: Generated file
  • samples/cost-aware-router/package-lock.json: Generated file
  • samples/hello-squad/package-lock.json: Generated file
  • samples/hook-governance/package-lock.json: Generated file
  • samples/storage-provider-azure/package-lock.json: Generated file
  • samples/streaming-chat/package-lock.json: Generated file
What changed in this PR

This dependency-maintenance pull request updates Vitest, Vite, Azure Identity, and related transitive dependencies across sample applications and the dogfood monorepo fixture.

Changes:

  • Upgrades Vitest to 5.1.0 across the samples and fixture.
  • Updates Azure Identity to 4.14.1 and refreshes authentication dependencies.
  • Regenerates lockfiles for Vitest, Vite, Rolldown, and related packages.
  • Several samples still document Node.js 20 support despite updated dependencies requiring Node.js 22 or later.

This pull request requires changes.

File Description
test-fixtures/​dogfood/​node-monorepo/​packages/​core/​package.json Updates the fixture's Vitest development dependency.
samples/​streaming-chat/​package.json Updates Vitest while retaining Node.js 20 support documentation.
samples/​storage-provider-azure/​package.json Updates Azure Identity; the documented Node.js 20 prerequisite conflicts with the updated dependency requirement.
samples/​storage-provider-azure/​package-lock.json Locks Azure Identity, MSAL, and related transitive dependency updates.
samples/​hook-governance/​package.json Updates Vitest while retaining Node.js 20 support documentation.
samples/​hook-governance/​package-lock.json Refreshes the Vitest 5 and Vite dependency tree.
samples/​hello-squad/​package.json Updates Vitest while retaining Node.js 20 support documentation.
samples/​hello-squad/​package-lock.json Refreshes the Vitest 5 and Vite dependency tree.
samples/​cost-aware-router/​package.json Updates Vitest while retaining the Node.js 20 engine declaration.
samples/​autonomous-pipeline/​package.json Updates Vitest while retaining the Node.js 20 engine declaration.

Review effort: Lite (auto)

Comment thread samples/autonomous-pipeline/package.json
"devDependencies": {
"typescript": "^5.7.0",
"vitest": "^4.1.9"
"vitest": "^5.1.0"
Comment thread samples/cost-aware-router/package.json
"devDependencies": {
"typescript": "^5.7.0",
"vitest": "^4.1.11"
"vitest": "^5.1.0"
Comment thread samples/hello-squad/package.json
"devDependencies": {
"tsx": "^4.0.0",
"vitest": "^4.1.11",
"vitest": "^5.1.0",
Comment thread samples/hook-governance/package.json
"devDependencies": {
"tsx": "^4.0.0",
"vitest": "^4.1.9",
"vitest": "^5.1.0",
Comment thread samples/storage-provider-azure/package.json
"@bradygaster/squad-sdk": "file:../../packages/squad-sdk",
"@azure/storage-blob": "^12.26.0",
"@azure/identity": "^4.5.0"
"@azure/identity": "^4.14.1"
Comment thread samples/streaming-chat/package.json
"tsx": "^4.22.4",
"typescript": "^5.7.0",
"vitest": "^4.1.9"
"vitest": "^5.1.0"

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@bradygaster bradygaster Awaiting requested review from bradygaster bradygaster is a code owner
@tamirdresher tamirdresher Awaiting requested review from tamirdresher tamirdresher is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant