version bumps to handle CVE's

[thomas-temby]

Description

Mandatory Checklist

• Please choose the target release of Azure PowerShell. (⚠️Target release is a different concept from API readiness. Please click below links for details.)

  • General release
  • Public preview
  • Private preview
  • Engineering build
  • No need for a release

• Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

• SHOULD update ChangeLog.md file(s) appropriately
  • Update src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.
    • A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense.
  • Should not change ChangeLog.md if no new release is required, such as fixing test case only.
• SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
• SHOULD have proper test coverage for changes in pull request.
• SHOULD NOT adjust version of module manually in pull request

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.

[thomas-temby]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Copilot]

Pull request overview

This PR aims to address security CVEs by bumping dependency versions used by the repo’s tooling and build/test infrastructure.

Changes:

• Updated fast-uri version metadata under the ajv entry in the MCP tool’s package-lock.json.
• Bumped System.Security.Cryptography.Xml from 8.0.3 to 8.0.4 in Az.nonprod.props (used by net8.0 tool/test builds).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
tools/Mcp/package-lock.json	Adjusts transitive dependency version metadata for the MCP tool’s npm lockfile.
tools/Az.nonprod.props	Updates a .NET package reference used by non-production/tooling builds.

Files not reviewed (1)

• tools/Mcp/package-lock.json: Generated file

[a0x1ab]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[a0x1ab]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• tools/Mcp/package-lock.json: Generated file

Comments suppressed due to low confidence (1)

tools/Mcp/package-lock.json:40

• These lockfile entries use an internal Azure DevOps feed URL and a sha1 integrity hash, while the rest of the lockfile uses registry.npmjs.org URLs with sha512 integrity. This can make installs fail for contributors/CI environments without access to that feed and weakens package integrity verification. Regenerate the lockfile using the standard registry (or ensure all entries consistently use the intended registry) so npm records a sha512 integrity for this package.