Repository navigation
fix(deps): resolve Component Governance and Dependabot alerts - #4399
Merged
microsoft-github-policy-service[bot] merged 3 commits intoOct 27, 2026
Merged
Conversation
Update transitive dependencies flagged by GitHub Dependabot, Component Governance, and yarn npm audit after the recent dependency removals: - basic-ftp 5.3.1 -> 6.2.3 via a narrow resolution (GHSA-c475-qrg2-pj4r) - fast-uri 3.1.8 -> 3.1.9 - undici 7.29.1 -> 7.30.1 - launch-editor 2.14.1 -> 2.14.2 - http-cache-semantics 4.2.0 -> 4.3.0 Every new version satisfies the 7-day package age gate and is served by the Office feed. body-parser (GHSA-27r3-jxmh-p828) stays on 1.20.8 and 2.3.0 until its fixed releases pass the gate. Give the private tester-win32 workspace version 0.0.0 and an MIT license so Component Governance stops matching it to the public 0.1.0 package, which has no license metadata. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6f34858-06bf-4230-8be7-1f65402b208a
Run yarn dedupe --strategy highest so yarn dedupe --check is clean again. The recent dependency removals left 31 descriptors that can share a version already present in the lockfile. This only collapses onto existing versions: no new package versions are added, and 20 stale duplicate resolutions are removed (for example @babel/types 7.29.7, acorn 8.15.0, ws 8.21.2, picomatch 4.0.5). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6f34858-06bf-4230-8be7-1f65402b208a
qs.stringify with arrayFormat 'comma' threw an uncaught TypeError on array elements with a non-callable own toString (>= 6.7.0, <= 6.16.0). The advisory was published 2026-10-27; 6.16.1 (published 2026-10-14) is past the 7-day age gate and satisfies both existing ranges (^6.15.2, ~6.16.0), so this is a lockfile-only update. qs is reached only through body-parser, which uses qs.parse. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6f34858-06bf-4230-8be7-1f65402b208a
Jason Morse (JasonVMo)
added
the
Type: Dependencies
microsoft-github-policy-service
Bot
added
the
AutoMerge 🔁
Contributor
Bundle size reportTree-shaken, minified production esbuild bundles with React and React Native runtimes externalized.
The job is advisory: size changes are reported but do not fail the pull request. Bundle or analysis errors still fail. |
Vladimir Morozov (vmoroz)
approved these changes
Oct 27, 2026
Ruriko Araki (rurikoaraki)
approved these changes
Oct 27, 2026
microsoft-github-policy-service
Bot
merged commit Oct 27, 2026
beffe4b
into
main
31 of 33 checks passed
2 of 10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Platforms Impacted
No platform runtime code changes. This updates transitive development-tooling dependencies in
yarn.lockand workspace metadata for the private Win32 test app.Description of changes
Fixes the open security advisories for the dependency set that remains after the recent dependency removals. Every new version is at least 7 days old (
npmMinimalAgeGate: 7dis unchanged) and was confirmed to be served by the Office feed.fast-uriresolutionsundiciresolutionslaunch-editorresolutionsandyarn up -Rbasic-ftpbasic-ftp@npm:^5.3.1http-cache-semanticsyarn up -R(lockfile only)qsyarn up -R(lockfile only)Dependabot alerts fixed: 552, 553, 554, 560, 561, 562, 563, 564, 566, 568.
By file:
package.json: rootresolutionsforfast-uri,undici,launch-editorand the newbasic-ftpentry.basic-ftpis only reached throughget-uri(themarkdown-link-checkproxy-agent chain). The 6.x line rejects a PASV reply that names a different non-loopback host by default.yarn.lock: regenerated by Yarn. Compared withmainit adds exactly the six versions above and removes their six predecessors plus 20 stale duplicate resolutions (see the dedupe commit).chore(deps): dedupe yarn.lock after dependency removals(separate commit,yarn.lockonly):yarn dedupe --strategy highestcollapses 31 duplicate candidates created by the dependency removals onto versions already in the lockfile. No new versions are introduced, and the commit can be dropped without affecting the fixes.apps/win32/package.json: version0.1.0→0.0.0and"license": "MIT", to address the Component Governance legal-information alert for@fluentui-react-native/tester-win32@0.1.0(that name and version also exist on public npm without license metadata). This is a best-effort fix; a Component Governance re-scan will confirm it..changeset/component-governance-alerts.md: empty changeset, since no published package changes.Not fixed here:
body-parser(GHSA-27r3-jxmh-p828, Dependabot alerts 558 and 559): the fixed versions 1.20.9 and 2.4.0 were published 2026-10-22, so the 7-day age gate (also enforced by the Office feed) still blocks them until about 2026-10-29T11:39Z. Both copies come from@react-native-community/cli-server-api(development-server tooling). Follow-up: raise thebody-parser@npm:^1.20.3resolution to 1.20.9, thenyarn up -R body-parserfor 2.4.0.http-cache-semantics(Dependabot alert 548): 4.3.0 is outside the advisory's affected range (<=4.2.0), but upstream lists no patched release and itsmax-stalehandling is unchanged, so this clears version-based scanners without changing that behavior. The alert may stay open. It is reached only throughmake-fetch-happen's local HTTP cache.yarn.lockand should clear on the next scan ofmain. Thebraces@3.0.3alert maps to GHSA-vfj7-8cjw-p6xm, which was withdrawn with no fix.Verification
Run on Windows against the final tree:
yarn npm audit --all --recursive --json --no-deprecationsyarn dedupe --checkyarn install --immutable --mode=skip-buildyarn change:checkyarn clean-lage-cache, thenyarn lage buildci --continue --concurrency 4check-package-contentsreportsspawnSync yarn ENOENTon Windows becausescripts/src/tasks/checkPackageContentsTask.tscallsexecFileSync('yarn')without a shell. That predates this PR; with a session-only preload that launchesyarn.cmd,node ./scripts/src/cli.ts check-package-contentsverified all 8 guided packages.yarn testinpackages/agentic/storybook-desktop--concurrency 4.Manual checks:
yarn.lockagainstmainadds exactly the six versions above.basic-ftp@6.2.3through the realget-uri@8.0.1FTP path against an in-process FTP server: MDTM download, MLSD fallback, 550 → not-found, and direct list and download results matched 5.3.1.qs@6.16.1: parse output is unchanged, and the advisory'sstringifyinput no longer throws.body-parser@1.20.9and2.4.0returned 404 (age-gated).Test repo linkswas re-run once after transient HTTP 403 responses from Microsoft sites in markdown files this PR does not touch. Not run: a Component Governance re-scan and native builds.yarn npm auditreports 15 advisories across 7 packagesPull request checklist
This PR has considered (when applicable):
Documentation, accessibility and internationalization items do not apply to this dependency-only change.