chore: refresh sample app dependencies by dluces · Pull Request #262 · microsoft/SharePoint-Embedded-Samples

Diego Luces (dluces) · 2026-08-13T23:28:18Z

Summary

refresh current-major npm dependencies and lockfiles across all npm sample apps
refresh compatible NuGet dependencies across the .NET sample apps
add transitive security pins where upstream dependency ranges still resolve vulnerable releases
defer framework/API migrations such as Tailwind 4, Microsoft Graph 6, Azure AI Projects 1.x stable, and Azure Functions SDK migration to separate changes

Validation artifacts

Sample app	Commands	Result
`AI/mcp-server`	`npm run build`; `npm audit`	TypeScript build passed; 0 vulnerabilities
`AI/ocr`	`npm run build:backend`; `npm run build-cre`; `npm audit`	Backend build passed; Vite production build passed (3,089 modules); 0 vulnerabilities
`AI/agent-with-retrieval-sample-app`	`dotnet test --configuration Release`; `dotnet list package --vulnerable --include-transitive`	48 passed, 1 skipped, 0 failed; no vulnerable packages
`Custom Apps/boilerplate-aspnet-webservice`	`dotnet build --configuration Release`; `dotnet list package --vulnerable --include-transitive`	Build passed with 0 warnings and 0 errors; no vulnerable packages
`Custom Apps/boilerplate-react-azurefunction`	`npm run build --workspace raas-client-app`; `node --check` for all Azure Functions JavaScript files; `npm audit`	Client production build passed; all function files passed syntax validation. Audit reports 4 high findings, all from Vite/PostCSS resolving `nanoid@3.3.17`; npm offers only an incompatible major override in this workspace.
`Custom Apps/boilerplate-typescript-react`	`npm run build` in `function-api` and `react-client`; `npm audit` in both packages	API TypeScript build passed; client production build passed; 0 vulnerabilities in both packages
`Custom Apps/legal-docs`	`npm run lint`; `npm run build`; `npm audit`	Lint passed with 0 errors and 17 existing warnings; production build passed; 0 vulnerabilities
`Custom Apps/project-management`	`npm run lint`; `npm run build`; `npm audit`	Lint passed with 0 errors and 17 existing warnings; production build passed; 0 vulnerabilities
`Custom Apps/webhook`	`node --check server.js`; `npm audit`	Syntax validation passed; 0 vulnerabilities
`Tools/migrate-from-blob-storage`	`dotnet build --configuration Release`; `dotnet list package --vulnerable --include-transitive`	Build passed with 0 warnings and 0 errors; no vulnerable packages

Update completeness

npm-check-updates --target minor reports every npm manifest current within its existing major versions.
The ASP.NET and migration projects report no compatible NuGet updates remaining.
Azure AI retrieval runtime updates are deferred because the current feed resolves their new transitive dependencies to .NET 10 abstractions, causing package downgrade conflicts in the .NET 8 sample. Test dependencies were updated and the full test suite passes.
Tools/sample-validation is repository validation infrastructure, not a sample app, and was intentionally excluded.

Update compatible npm and NuGet dependencies across the sample apps, refresh lockfiles, and pin patched transitive packages where needed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR refreshes npm and NuGet dependencies across the repository’s sample applications, aiming to stay within existing major versions while adding targeted security pinning via npm overrides and updated lockfiles.

Changes:

Updated NuGet dependencies for .NET samples (Azure SDK, Microsoft Graph, Identity/Web, test SDKs).
Updated npm dependencies across multiple sample apps (MSAL, React/Vite ecosystem, axios, tooling) and refreshed lockfiles.
Added npm overrides in several workspaces to force patched transitive versions.

Reviewed changes

Copilot reviewed 14 out of 23 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
Tools/migrate-from-blob-storage/MigrateABStoSPE.csproj	Updates Azure SDK + Microsoft Graph packages; adds Kiota abstraction pin.
Custom Apps/webhook/src/package.json	Bumps axios dependency range.
Custom Apps/webhook/src/package-lock.json	Refreshes axios resolution and transitive deps in lockfile.
Custom Apps/project-management/package.json	Updates React/Vite ecosystem deps and adds overrides.
Custom Apps/legal-docs/package.json	Updates React/Vite ecosystem deps and adds overrides.
Custom Apps/boilerplate-typescript-react/react-client/package.json	Updates client dependencies and adds overrides for security pins.
Custom Apps/boilerplate-typescript-react/react-client/package-lock.json	Updates resolved versions and transitive dependency graph.
Custom Apps/boilerplate-typescript-react/package.json	Updates concurrently dev dependency.
Custom Apps/boilerplate-typescript-react/package-lock.json	Updates concurrently lockfile resolution.
Custom Apps/boilerplate-typescript-react/function-api/package.json	Updates MSAL/axios and adds override for brace-expansion.
Custom Apps/boilerplate-typescript-react/function-api/package-lock.json	Updates lockfile resolutions for updated dependencies.
Custom Apps/boilerplate-react-azurefunction/packages/client-app/package.json	Updates MSAL browser + Vite/React deps.
Custom Apps/boilerplate-react-azurefunction/packages/azure-functions/package.json	Updates MSAL node dependency.
Custom Apps/boilerplate-react-azurefunction/package.json	Updates workspace deps and expands overrides for security pinning.
Custom Apps/boilerplate-react-azurefunction/package-lock.json	Updates lockfile resolutions and transitive dependencies.
Custom Apps/boilerplate-aspnet-webservice/Demo.csproj	Updates ASP.NET Core/EF/Identity/Web + Graph and adds NuGet client libs.
AI/ocr/package.json	Updates frontend/backend dependencies and adds nanoid override.
AI/ocr/package-lock.json	Refreshes lockfile resolutions for updated dependency graph.
AI/mcp-server/package.json	Updates MSAL node, tsx, and types.
AI/mcp-server/package-lock.json	Refreshes lockfile resolutions for updated dependency graph.
AI/agent-with-retrieval-sample-app/SPEAgentWithRetrieval.Tests/SPEAgentWithRetrieval.Tests.csproj	Updates .NET test SDK + xUnit-related test dependencies.

Files not reviewed (7)

AI/mcp-server/package-lock.json: Generated file
AI/ocr/package-lock.json: Generated file
Custom Apps/boilerplate-react-azurefunction/package-lock.json: Generated file
Custom Apps/boilerplate-typescript-react/function-api/package-lock.json: Generated file
Custom Apps/boilerplate-typescript-react/package-lock.json: Generated file
Custom Apps/boilerplate-typescript-react/react-client/package-lock.json: Generated file
Custom Apps/webhook/src/package-lock.json: Generated file

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

    "node_modules/axios": {
-      "version": "1.18.1",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.1.tgz",
-      "integrity": "sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==",
+      "version": "1.19.0",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/axios/-/axios-1.19.0.tgz",
+      "integrity": "sha1-3fhk1MgjPA5oc3RqtZNhU30FrTk=",
      "license": "MIT",


    "node_modules/axios": {
-      "version": "1.18.1",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.1.tgz",
-      "integrity": "sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==",
+      "version": "1.19.0",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/axios/-/axios-1.19.0.tgz",
+      "integrity": "sha1-3fhk1MgjPA5oc3RqtZNhU30FrTk=",
      "license": "MIT",


    "node_modules/@azure/msal-common": {
-      "version": "16.11.2",
-      "resolved": "https://registry.npmjs.org/@azure/msal-common/-/msal-common-16.11.2.tgz",
-      "integrity": "sha512-yDhtBOGDCdK9ipQ9g3+wmlMEPnZx2pXaDicDd9jYyR1L+7lEbvEohTDmF5qejZDutZY3m9pWPxeYxzNC701A2w==",
+      "version": "16.12.0",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@azure/msal-common/-/msal-common-16.12.0.tgz",
+      "integrity": "sha1-XL1Y25GUj5I4LoxijzSlf0adOnQ=",
      "license": "MIT",


    "node_modules/vite": {
-      "version": "8.1.5",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.5.tgz",
-      "integrity": "sha512-7ULLwsCdYx/nRyrpiEwvqb5TFHrMVZyBt+rg/OAXT7rgj/z+DtTDyKFeLAdDkubDVDKD8jOsndmy7m55XcfUsw==",
+      "version": "8.2.1",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/vite/-/vite-8.2.1.tgz",
+      "integrity": "sha1-b8jYu4Q71SNTCR+sl44ZTU3lsx0=",
      "dev": true,


    "node_modules/undici": {
-      "version": "6.27.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz",
-      "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==",
+      "version": "8.10.0",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/undici/-/undici-8.10.0.tgz",
+      "integrity": "sha1-Z+18QIfw9A+6e+86RvK+gFcvJHM=",
      "dev": true,
      "license": "MIT",
      "engines": {
-        "node": ">=18.17"
+        "node": ">=22.19.0"
      }


+  "overrides": {
+    "nanoid": ">=6.0.1"
  }


+  "overrides": {
+    "brace-expansion": ">=5.0.9",
+    "nanoid": ">=6.0.1"
  }


+  "overrides": {
+    "brace-expansion": ">=5.0.9",
+    "nanoid": ">=6.0.1"
  }


+  "overrides": {
+    "brace-expansion": ">=5.0.9",
+    "dompurify": ">=3.4.13",
+    "nanoid": ">=6.0.1"
  }


+    "@microsoft/mgt-components": {
+      "dompurify": "3.4.13"
+    },
+    "ip-address": "10.4.0",
+    "undici": "8.10.0"
  }


Diego Luces (dluces) · 2026-08-14T00:04:42Z

Concrete validation artifacts

These artifacts were captured from commit 528288cb4a968677c4821fdd32caac0c05e08865. Browser checks used Tools/sample-validation/browser-smoke.mjs. The three auth-dependent UI bundles were built with non-secret placeholder app/tenant IDs so startup and unauthenticated rendering could be tested without claiming a tenant-authenticated flow.

`AI/mcp-server`

> npm run build
> tsc

GET http://127.0.0.1:4310/health
HTTP 200
{"status":"ok","service":"spe-mcp-server","version":"1.0.0"}

npm audit: {"info":0,"low":0,"moderate":0,"high":0,"critical":0,"total":0}

`AI/ocr`

> npm run build:backend
> tsc -p ./server/tsconfig.json

> npm run build-cre
✓ 3089 modules transformed.
✓ built in 1.90s

GET http://127.0.0.1:4311/api/echo
HTTP 200
server is running

Browser smoke passed for http://127.0.0.1:4320
npm audit: {"info":0,"low":0,"moderate":0,"high":0,"critical":0,"total":0}

`AI/agent-with-retrieval-sample-app`

Test run for SPEAgentWithRetrieval.Tests.dll (.NETCoreApp,Version=v8.0)
[SKIP] EndToEndTests.ChatPipeline_ReturnsGroundedAnswer_AgainstLiveServices

Passed! - Failed: 0, Passed: 48, Skipped: 1, Total: 49

dotnet list package --vulnerable --include-transitive
The given projects have no vulnerable packages given the current sources.

The live tenant/Foundry E2E test is intentionally opt-in and was skipped because this validation run did not use tenant credentials.

`Custom Apps/boilerplate-aspnet-webservice`

> dotnet build --configuration Release
Demo -> ...\bin\Release\net10.0\Demo.dll

Build succeeded.
    0 Warning(s)
    0 Error(s)

> dotnet list package --vulnerable --include-transitive
The given project `Demo` has no vulnerable packages given the current sources.

Runtime startup was attempted and correctly reached application initialization, but the local app cannot serve HTTP without its sample SQL connection string:

Application startup exception
System.InvalidOperationException: The ConnectionString property has not been initialized.
at Demo.Startup.Configure(...) in Startup.cs:line 141

`Custom Apps/boilerplate-react-azurefunction`

> npm run build --workspace raas-client-app
✓ 2029 modules transformed.
✓ built in 1.66s

PASS ...\AddContainerPermission\index.js
PASS ...\CreateContainer\index.js
PASS ...\DeleteContainerPermissionById\index.js
PASS ...\GetContainerPermissions\index.js
PASS ...\ListContainers\index.js
PASS ...\utils\auth.js

Browser smoke passed for http://127.0.0.1:4321

npm audit still reports four high findings, all in one unresolved chain: Vite -> PostCSS -> nanoid@3.3.17. The advisory requires nanoid >=3.3.18, but that compatible release is not available from the current feed; forcing nanoid@6 makes the workspace dependency invalid. This is recorded as an exception, not reported as passing:

{"info":0,"low":0,"moderate":0,"high":4,"critical":0,"total":4}

`Custom Apps/boilerplate-typescript-react`

function-api:
> npm run build
> tsc

react-client:
> npm run build
✓ 4233 modules transformed.
✓ built in 2.18s

Browser smoke passed for http://127.0.0.1:4322
function-api npm audit: 0 vulnerabilities
react-client npm audit: 0 vulnerabilities

`Custom Apps/legal-docs`

> npm run lint
✖ 17 problems (0 errors, 17 warnings)

> npm run build
✓ built in 2.56s

Browser smoke passed for http://127.0.0.1:4323
npm audit: {"info":0,"low":0,"moderate":0,"high":0,"critical":0,"total":0}

`Custom Apps/project-management`

> npm run lint
✖ 17 problems (0 errors, 17 warnings)

> npm run build
✓ built in 2.83s

Browser smoke passed for http://127.0.0.1:4324
npm audit: {"info":0,"low":0,"moderate":0,"high":0,"critical":0,"total":0}

`Custom Apps/webhook`

POST http://127.0.0.1:4312/webhook?validationToken=dependency-update-smoke
HTTP 200
dependency-update-smoke

npm audit: {"info":0,"low":0,"moderate":0,"high":0,"critical":0,"total":0}

`Tools/migrate-from-blob-storage`

> dotnet build --configuration Release
    33 Warning(s)
    0 Error(s)

> dotnet list package --vulnerable --include-transitive
The given project `MigrateABStoSPE` has no vulnerable packages given the current sources.

The warnings are existing nullable-reference/code-analysis warnings; the dependency update introduced no build errors.

chore: refresh sample app dependencies

528288c

Update compatible npm and NuGet dependencies across the sample apps, refresh lockfiles, and pin patched transitive packages where needed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Diego Luces (dluces) requested review from Gregory Joseph (gnjoseph) and a lite review from Copilot August 13, 2026 23:55

Copilot started reviewing on behalf of Diego Luces (dluces) August 13, 2026 23:56 View session

Copilot AI reviewed Aug 14, 2026

View reviewed changes

Diego Luces (dluces) closed this Aug 14, 2026

Diego Luces (dluces) deleted the user/dilucesr/dependency_updates branch August 14, 2026 16:52

Navigation Menu

Uh oh!

chore: refresh sample app dependencies - #262

chore: refresh sample app dependencies#262
Diego Luces (dluces) wants to merge 1 commit into
mainfrom
user/dilucesr/dependency_updates

Diego Luces (dluces) commented Aug 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Diego Luces (dluces) commented Aug 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Diego Luces (dluces) commented Aug 13, 2026

Summary

Validation artifacts

Update completeness

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Diego Luces (dluces) commented Aug 14, 2026

Concrete validation artifacts

AI/mcp-server

AI/ocr

AI/agent-with-retrieval-sample-app

Custom Apps/boilerplate-aspnet-webservice

Custom Apps/boilerplate-react-azurefunction

Custom Apps/boilerplate-typescript-react

Custom Apps/legal-docs

Custom Apps/project-management

Custom Apps/webhook

Tools/migrate-from-blob-storage

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

`AI/mcp-server`

`AI/ocr`

`AI/agent-with-retrieval-sample-app`

`Custom Apps/boilerplate-aspnet-webservice`

`Custom Apps/boilerplate-react-azurefunction`

`Custom Apps/boilerplate-typescript-react`

`Custom Apps/legal-docs`

`Custom Apps/project-management`

`Custom Apps/webhook`

`Tools/migrate-from-blob-storage`