Merge main into release/stable - #1328
Open
Rishabh Jain (MrRishabhJain) wants to merge 45 commits into
Open
Conversation
Co-authored-by: Rishabh Jain <rishjain@microsoft.com>
* Updated brace-expansion version to 2.0.2 * updated with brace version * updated packages
* Update overview.md * Update nuget.json
* Update pac CLI to 1.49.4 * Add back pac CLI 1.44 release note line alongside 1.49 * Add pac CLI 1.44 release note to the overview --------- Co-authored-by: Rishabh Jain <rishjain@microsoft.com>
* Override electron-to-chromium * pinned version 1.5.191
* Override electron-to-chromium * pinned version 1.5.191 * Updated electron to chromium version
* Override electron-to-chromium * pinned version 1.5.191 * Updated electron to chromium version * update package dependencies
Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.1.1 and updates ancestor dependency [gulp-mocha](https://github.com/sindresorhus/gulp-mocha). These dependencies need to be updated together. Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) Updates `gulp-mocha` from 8.0.0 to 10.0.1 - [Release notes](https://github.com/sindresorhus/gulp-mocha/releases) - [Commits](sindresorhus/gulp-mocha@v8.0.0...v10.0.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect - dependency-name: gulp-mocha dependency-version: 10.0.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
* Added claude skiils and updated dependencies * updated tar fix * updated with fixes
* Updated claude skills and dependencies * updated package lock
* Add download-code-site and upload-code-site Azure DevOps tasks Add new build tool tasks for Power Pages Code Site download and upload, following the same pattern as existing download-paportal/upload-paportal tasks. These tasks wrap the downloadCodeSite and uploadCodeSite actions from the CLI wrapper. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix CI build: increase heap size and add task metadata - Bump --max-old-space-size from 5120 to 8192 in package.json to fix OOM during webpack compile with 34 task entry points - Add download-code-site and upload-code-site entries to extension/task-metadata.json with new GUIDs for all stages Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Rishabh Jain <rishjain@microsoft.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Jayanth Reddy Bujula (jbujula)
approved these changes
Mar 18, 2026
…lls (#1340) * Updated claude skills and dependencies * updated package lock * fix: update OfficialBuild pipeline to Node 20.x and add claude agents - Bump NodeTool from 16.x to 20.x in OfficialBuild.yml — cli-spinners@3.4.0 uses `with {type: 'json'}` import attribute syntax (Node 20+ only), which broke the set-version step running release-it - Add .claude/agents/ subagent prompts for PR, debug, dependencies, PAC CLI, work items, review, knowledge-sync workflows - Add .claude/knowledge/architecture.md reference - Update security-alerts.md to query both ADO area paths in parallel - Add debug-agent.md command Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor: consolidate .claude/ to skills/ structure Migrated from three duplicated directories (commands/, agents/, knowledge/) to a single .claude/skills/<name>/SKILL.md layout matching the CDS repo pattern. Each SKILL.md has frontmatter (name, description, allowed-tools, user-invocable) which registers it as both a slash command and a subagent type — eliminating the duplication where agents/ and commands/ held near-identical content. Cross-reference fixes: - /update-pac-cli → /pac-cli-update (create-pr, review) - /create-pr → /pr (fix-dependencies, security-alerts, workitem, review, debug-agent) - /review-pr → /review, /implement-workitem → /workitem (knowledge-sync) - File path refs in knowledge-sync Step 7 updated to skills/ paths - Invocation /debug-pipeline → /debug-agent Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: rename pr skill to create-pr; fix skill frontmatter - Rename skills/pr/ → skills/create-pr/ for clarity - Update all /pr references to /create-pr across skills - Remove unsupported 'allowed-tools' frontmatter attribute from all SKILL.md files - Replace unsupported 'args:' blocks with 'argument-hint:' strings (workitem, pac-cli-update, review, debug-agent) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: fix stale /pr refs and skill clarity issues - workitem: /pr → /create-pr (frontmatter, step 7 header + body) - knowledge-sync: skills/pr/ → skills/create-pr/; /fix-dependencies → /pac-cli-update in auto-invoke list - debug-agent: rename duplicate section 2c → 2d - review: remove "Step " prefix from sub-headings 3a/3b/3c - create-pr: stripped branch-setup and build-verify steps (belong in callers) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
April 8, 2026 23:41 — with 
GitHub Pages
Inactive
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 2.0.2 to 2.0.3. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 2.0.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
April 9, 2026 00:45 — with
GitHub Pages
Inactive
Bumps [basic-ftp](https://github.com/patrickjuchli/basic-ftp) from 5.2.0 to 5.2.1. - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.2.0...v5.2.1) --- updated-dependencies: - dependency-name: basic-ftp dependency-version: 5.2.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
April 9, 2026 00:54 — with
GitHub Pages
Inactive
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.4.1 to 3.4.2. - [Commits](WebReflection/flatted@v3.4.1...v3.4.2) --- updated-dependencies: - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
April 9, 2026 01:00 — with
GitHub Pages
Inactive
…igning (#1349) Filters out pac/_rels/.rels and pac_linux/_rels/.rels when copying the pac CLI bin folder into the tool-installer staging directory. These OPC metadata artifacts are left behind when the pac CLI NuGet packages are extracted. When vsixsigntool.exe (ESRP) encounters them inside the VSIX (itself an OPC container), the OPC parser fails with error 0x80510005 because the .rels files reference non-existent targets. Fixes: ICM 779156496 Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
April 16, 2026 19:09 — with
GitHub Pages
Inactive
#1354) Non-LIVE stages (BETA, DEV, EXPERIMENTAL) share the same extension manifest as LIVE, causing 'duplicate contribution id' errors in the Marketplace when all four stage packages are published simultaneously. For non-LIVE stages, suffix the service endpoint contribution id and properties.name with the lowercase stage name, and append the stage label to displayName. Also update each task's connectedService input type to reference the stage-specific endpoint id so tasks bind to the correct service endpoint type at runtime. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
April 23, 2026 18:52 — with
GitHub Pages
Inactive
Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.1.0 to 10.2.0. - [Commits](https://github.com/beaugunderson/ip-address/commits) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1. - [Commits](lodash/lodash@4.17.23...4.18.1) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
Bumps [defu](https://github.com/unjs/defu) from 6.1.4 to 6.1.6. - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.6) --- updated-dependencies: - dependency-name: defu dependency-version: 6.1.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
May 20, 2026 20:51 — with
GitHub Pages
Inactive
…46) (#1386) Adds security validation to BuildToolsRunnerParams.runnersDir to ensure the PAC CLI path read from POWERPLATFORMTOOLS_PACCLIPATH points to the official PowerPlatformToolInstaller task directory. A low-trust build step could previously overwrite the mutable job-scoped variable to redirect protected tasks to an attacker-controlled PAC binary, allowing credential theft via the service-connection auth flow. The fix validates that: 1. The path is under the agent's _tasks directory 2. The path contains a known ToolInstaller task GUID (LIVE/BETA/DEV/EXPERIMENTAL) If either check fails, the task fails closed before materializing any service-connection credentials. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
May 22, 2026 21:06 — with
GitHub Pages
Inactive
…, #6430957) (#1389) * fix: mask SPN clientSecret and password via tl.setSecret (#6430957) MSRC 117102: Power Platform Build Tools previously read clientSecret and password from the service connection without registering them with task-lib. As a result they appeared unmasked in pipeline logs and in task-lib debug output (e.g. `auth param clientSecret = <VALUE>` when System.Debug=true). Call tl.setSecret() on clientSecret and password immediately after reading them in getClientCredentials() and getUsernamePassword() so task-lib masks them everywhere they are echoed. The existing pattern was already in place for the OIDC PAC_ADO_ID_TOKEN_REQUEST_TOKEN value. The remaining /proc/<pid>/cmdline and PAC_CLI_SPN_SECRET env-var leaks are in @microsoft/powerplatform-cli-wrapper (pac auth create invocation) and must be addressed upstream. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: also mask base64-encoded form of clientSecret and password (#6430957) Per review on #1389: the cli-wrapper passes the secret to pac as `data:text/plain;base64,<base64>`. Without registering the base64 form with task-lib, the encoded value would not be masked in pipeline logs even though the raw value is. Register both forms with tl.setSecret(). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Brad Flood (brflood)
temporarily deployed
to
github-pages
May 27, 2026 01:07 — with
GitHub Pages
Inactive
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
June 2, 2026 23:55 — with
GitHub Pages
Inactive
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
June 5, 2026 16:47 — with
GitHub Pages
Inactive
…#1399) Closes 4 PPBT S360 work items on KPI 240c2bea (BIC Component Governance): - ADO #6364952 brace-expansion 1.1.12 -> 1.1.15 (target 1.1.13, CVE-2026-33750) - ADO #6364953 brace-expansion 2.0.2 -> 2.0.3 (CVE-2026-33750) - ADO #6364954 picomatch 2.3.1 -> 2.3.2 (CVE-2026-33672) - ADO #6364955 brace-expansion 5.0.4 -> 5.0.6 (target 5.0.5, CVE-2026-33750) - ADO #6408700 brace-expansion 5.0.4 -> 5.0.6 (CVE-2026-45149, same package paths) Mechanism: - package.json overrides: minimatch -> brace-expansion ^5.0.6 (handles 5.x paths in cli-wrapper, tfx-cli, glob, mocha, readdir-glob). - package.json existing brace-expansion dep at ^2.0.3 (handles root 2.x hoist). - Lock-file patches for inBundle: true paths that npm overrides cannot reach: - @microsoft/powerplatform-cli-wrapper bundled brace-expansion 5.0.4 -> 5.0.6 - azure-pipelines-task-lib bundled minimatch@3.x's brace-expansion 1.1.12 -> 1.1.15 - hoisted picomatch (inBundle=true) 2.3.1 -> 2.3.2 Verification: - npm audit no longer reports brace-expansion or picomatch findings - compile + lint + pac CLI 2.7.4 restore pass - Pre-existing Node 24 unit-test ts-strip incompatibility is unrelated to this change
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
June 8, 2026 23:36 — with
GitHub Pages
Inactive
…ceeds (#1402) The official build pipeline now creates a published GitHub Release automatically on successful run (PR #1399's tooling change). Update both skills so contributors know to look for the release at /releases/tag/v<version> after their PR ships: - create-pr SKILL.md: Step 4 prompt now mentions the auto-release URL and what to do if it doesn't appear (token scope / SSO check). - pac-cli-update SKILL.md: Step 9 final summary now includes the same guidance.
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
June 8, 2026 23:54 — with
GitHub Pages
Inactive
Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.5 to 0.2.7. - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.5...v0.2.7) --- updated-dependencies: - dependency-name: tmp dependency-version: 0.2.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jayanth Reddy Bujula <137358312+jbujula@users.noreply.github.com>
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
June 17, 2026 23:41 — with
GitHub Pages
Inactive
…1410) Resolves all 9 high-severity npm-audit findings plus Dependabot alerts across transitive dev/runtime deps. Strategy: - Bump existing overrides to patched versions: basic-ftp ^6.0.1, serialize-javascript ^7.0.5, postcss ^8.5.15, qs ^6.15.2 - New flat overrides (single-major, single-instance, safe): tmp ^0.2.7, undici ^6.24.0, defu ^6.1.7, flatted ^3.4.2, form-data ^2.5.6, ip-address ^10.2.0, js-yaml ^4.2.0, lodash ^4.18.1 - Scoped overrides to avoid forcing inBundle siblings: tinyglobby>picomatch ^4.0.4 (leaves inBundle picomatch 2.3.2), tfx-cli>uuid ^13.0.1 (leaves inBundle uuid 3.4.0 under azure-pipelines-task-lib) - Direct dep bump: tar ^7.5.16 - Lock-file patch (Strategy C) for follow-redirects 1.15.11 -> 1.16.0; overrides cannot reach it (inBundle via bundled cli-wrapper subtree) Remaining 8 (down from 28) are documented accepted-risk/deferred: - 6 low: elliptic chain (GHSA-848j-6mx2-7j84, dev-only, no patch) - 2 moderate: uuid 3.4.0 bundled in azure-pipelines-task-lib (requires uuid ^3.0.1) -> needs upstream fix; cannot override a bundled subtree Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
June 18, 2026 18:54 — with
GitHub Pages
Inactive
* Update CLI version to 1.44.2 (#1181) Co-authored-by: Rishabh Jain <rishjain@microsoft.com> * Users/jbujula/cliversion1.46.1 release (#1215) * Update overview.md * Update nuget.json * Revert "Users/jbujula/cliversion1.46.1 release (#1215)" (#1219) This reverts commit 26f9ff2. * [release] Update Pac CLI to 1.49.4 (#1251) * Replicate diff from PR #1250: bump pac CLI to 1.49.4 and add 2.0.94 block * Fix formatting in overview.md by removing extra blank line * Update extension/overview.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Rishabh Jain <rishjain@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Override electron-to-chromium (#1270) * pinned version to 1.5.191 (#1271) * updated node version (#1274) * Users/jbujula/update dependencies electon to chromium release 2 (#1276) * pinned version to 1.5.191 * Update electron-to-chromium * Users/jbujula/update dependencies electon to chromium release 2 (#1277) * pinned version to 1.5.191 * Update electron-to-chromium * Update webpack version to match ado upstream * Updated cli version to 1.52.1 (#1302) * Merge main into release/stable for pipeline build and package publish (#1331) Includes download-code-site and upload-code-site tasks (#1318), claude skills, dependency updates (webpack ^5.105.4, security overrides), and pac CLI 1.52.1. Co-authored-by: Rishabh Jain <rishjain@microsoft.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: update OfficialBuild pipeline to Node 20.x; add claude agent skills (#1340) (#1341) * Updated claude skills and dependencies * updated package lock * fix: update OfficialBuild pipeline to Node 20.x and add claude agents - Bump NodeTool from 16.x to 20.x in OfficialBuild.yml — cli-spinners@3.4.0 uses `with {type: 'json'}` import attribute syntax (Node 20+ only), which broke the set-version step running release-it - Add .claude/agents/ subagent prompts for PR, debug, dependencies, PAC CLI, work items, review, knowledge-sync workflows - Add .claude/knowledge/architecture.md reference - Update security-alerts.md to query both ADO area paths in parallel - Add debug-agent.md command * refactor: consolidate .claude/ to skills/ structure Migrated from three duplicated directories (commands/, agents/, knowledge/) to a single .claude/skills/<name>/SKILL.md layout matching the CDS repo pattern. Each SKILL.md has frontmatter (name, description, allowed-tools, user-invocable) which registers it as both a slash command and a subagent type — eliminating the duplication where agents/ and commands/ held near-identical content. Cross-reference fixes: - /update-pac-cli → /pac-cli-update (create-pr, review) - /create-pr → /pr (fix-dependencies, security-alerts, workitem, review, debug-agent) - /review-pr → /review, /implement-workitem → /workitem (knowledge-sync) - File path refs in knowledge-sync Step 7 updated to skills/ paths - Invocation /debug-pipeline → /debug-agent * chore: rename pr skill to create-pr; fix skill frontmatter - Rename skills/pr/ → skills/create-pr/ for clarity - Update all /pr references to /create-pr across skills - Remove unsupported 'allowed-tools' frontmatter attribute from all SKILL.md files - Replace unsupported 'args:' blocks with 'argument-hint:' strings (workitem, pac-cli-update, review, debug-agent) * chore: fix stale /pr refs and skill clarity issues - workitem: /pr → /create-pr (frontmatter, step 7 header + body) - knowledge-sync: skills/pr/ → skills/create-pr/; /fix-dependencies → /pac-cli-update in auto-invoke list - debug-agent: rename duplicate section 2c → 2d - review: remove "Step " prefix from sub-headings 3a/3b/3c - create-pr: stripped branch-setup and build-verify steps (belong in callers) --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: exclude nested _rels/.rels files from VSIX bin folder for ESRP signing (#1350) Filters out pac/_rels/.rels and pac_linux/_rels/.rels when copying the pac CLI bin folder into the tool-installer staging directory. These OPC metadata artifacts are left behind when the pac CLI NuGet packages are extracted. When vsixsigntool.exe (ESRP) encounters them inside the VSIX (itself an OPC container), the OPC parser fails with error 0x80510005 because the .rels files reference non-existent targets. Fixes: ICM 779156496 Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: make service endpoint contributions unique per stage in VSIX pack (#1355) Non-LIVE stages (BETA, DEV, EXPERIMENTAL) share the same extension manifest as LIVE, causing 'duplicate contribution id' errors in the Marketplace when all four stage packages are published simultaneously. For non-LIVE stages, suffix the service endpoint contribution id and properties.name with the lowercase stage name, and append the stage label to displayName. Also update each task's connectedService input type to reference the stage-specific endpoint id so tasks bind to the correct service endpoint type at runtime. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: publish non-LIVE stage extensions publicly to VS Marketplace (#1357) BETA, DEV, and EXPERIMENTAL stage VSIXs were marked public=false, keeping them unlisted on the Marketplace. Setting public=true makes them discoverable so testers and preview users can install them without needing a direct install link. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: update create-pr skill with dual-PR and build prompt workflow (#1359) - Step 2: capture branch/SHAs before creating main PR - Step 3: auto cherry-pick to release/stable, push, open paired PR - Step 4: prompt user to queue pipeline 21491 with required variables (GITHUB_TOKEN, AZ_DevOps_Read_PAT, isEsrpEnabled, PUBLISH_TO_MARKETPLACE) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: update pac CLI to 2.6.4 (#1363) * fix: add Override entries to VSIX [Content_Types].xml for extension-less pac CLI files (#1367) * chore: update pac CLI to 2.7.4 (#1377) * fix: validate PAC CLI path to prevent mutable variable hijack (#6414246) (#1387) Adds security validation to BuildToolsRunnerParams.runnersDir to ensure the PAC CLI path read from POWERPLATFORMTOOLS_PACCLIPATH points to the official PowerPlatformToolInstaller task directory. A low-trust build step could previously overwrite the mutable job-scoped variable to redirect protected tasks to an attacker-controlled PAC binary, allowing credential theft via the service-connection auth flow. The fix validates that: 1. The path is under the agent's _tasks directory 2. The path contains a known ToolInstaller task GUID (LIVE/BETA/DEV/EXPERIMENTAL) If either check fails, the task fails closed before materializing any service-connection credentials. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: mask SPN clientSecret and password via tl.setSecret (MSRC 117102, #6430957) (#1390) * fix: mask SPN clientSecret and password via tl.setSecret (#6430957) MSRC 117102: Power Platform Build Tools previously read clientSecret and password from the service connection without registering them with task-lib. As a result they appeared unmasked in pipeline logs and in task-lib debug output (e.g. `auth param clientSecret = <VALUE>` when System.Debug=true). Call tl.setSecret() on clientSecret and password immediately after reading them in getClientCredentials() and getUsernamePassword() so task-lib masks them everywhere they are echoed. The existing pattern was already in place for the OIDC PAC_ADO_ID_TOKEN_REQUEST_TOKEN value. The remaining /proc/<pid>/cmdline and PAC_CLI_SPN_SECRET env-var leaks are in @microsoft/powerplatform-cli-wrapper (pac auth create invocation) and must be addressed upstream. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: also mask base64-encoded form of clientSecret and password (#6430957) Per review on #1389: the cli-wrapper passes the secret to pac as `data:text/plain;base64,<base64>`. Without registering the base64 form with task-lib, the encoded value would not be masked in pipeline logs even though the raw value is. Register both forms with tl.setSecret(). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: update pac CLI to 2.8.1 (#1395) * revert: pac CLI 2.8.1 -> 2.7.4 due to upstream bug (#1398) * fix: bump brace-expansion + picomatch to patched versions (S360 CVEs) (#1400) Closes 4 PPBT S360 work items on KPI 240c2bea (BIC Component Governance): - ADO #6364952 brace-expansion 1.1.12 -> 1.1.15 (target 1.1.13, CVE-2026-33750) - ADO #6364953 brace-expansion 2.0.2 -> 2.0.3 (CVE-2026-33750) - ADO #6364954 picomatch 2.3.1 -> 2.3.2 (CVE-2026-33672) - ADO #6364955 brace-expansion 5.0.4 -> 5.0.6 (target 5.0.5, CVE-2026-33750) - ADO #6408700 brace-expansion 5.0.4 -> 5.0.6 (CVE-2026-45149, same package paths) Mechanism: - package.json overrides: minimatch -> brace-expansion ^5.0.6 (handles 5.x paths in cli-wrapper, tfx-cli, glob, mocha, readdir-glob). - package.json existing brace-expansion dep at ^2.0.3 (handles root 2.x hoist). - Lock-file patches for inBundle: true paths that npm overrides cannot reach: - @microsoft/powerplatform-cli-wrapper bundled brace-expansion 5.0.4 -> 5.0.6 - azure-pipelines-task-lib bundled minimatch@3.x's brace-expansion 1.1.12 -> 1.1.15 - hoisted picomatch (inBundle=true) 2.3.1 -> 2.3.2 Verification: - npm audit no longer reports brace-expansion or picomatch findings - compile + lint + pac CLI 2.7.4 restore pass - Pre-existing Node 24 unit-test ts-strip incompatibility is unrelated to this change * docs(skills): document auto-created GitHub Release after pipeline succeeds (#1403) The official build pipeline now creates a published GitHub Release automatically on successful run (PR #1399's tooling change). Update both skills so contributors know to look for the release at /releases/tag/v<version> after their PR ships: - create-pr SKILL.md: Step 4 prompt now mentions the auto-release URL and what to do if it doesn't appear (token scope / SSO check). - pac-cli-update SKILL.md: Step 9 final summary now includes the same guidance. * chore: fix dependency vulnerabilities (28 -> 8, all highs resolved) Resolves all 9 high-severity npm-audit findings plus Dependabot alerts across transitive dev/runtime deps. Strategy: - Bump existing overrides to patched versions: basic-ftp ^6.0.1, serialize-javascript ^7.0.5, postcss ^8.5.15, qs ^6.15.2 - New flat overrides (single-major, single-instance, safe): tmp ^0.2.7, undici ^6.24.0, defu ^6.1.7, flatted ^3.4.2, form-data ^2.5.6, ip-address ^10.2.0, js-yaml ^4.2.0, lodash ^4.18.1 - Scoped overrides to avoid forcing inBundle siblings: tinyglobby>picomatch ^4.0.4 (leaves inBundle picomatch 2.3.2), tfx-cli>uuid ^13.0.1 (leaves inBundle uuid 3.4.0 under azure-pipelines-task-lib) - Direct dep bump: tar ^7.5.16 - Lock-file patch (Strategy C) for follow-redirects 1.15.11 -> 1.16.0; overrides cannot reach it (inBundle via bundled cli-wrapper subtree) Remaining 8 (down from 28) are documented accepted-risk/deferred: - 6 low: elliptic chain (GHSA-848j-6mx2-7j84, dev-only, no patch) - 2 moderate: uuid 3.4.0 bundled in azure-pipelines-task-lib (requires uuid ^3.0.1) -> needs upstream fix; cannot override a bundled subtree Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: fix uuid vulnerability (CVE-2026-41907) by upgrading azure-pipelines-task-lib Upgrade azure-pipelines-task-lib 5.2.8 -> 5.277.0, which drops its transitive dependency on the vulnerable uuid@3.4.0 (CVE-2026-41907). uuid no longer appears in the tree via azure-pipelines-task-lib. npm audit no longer reports the moderate uuid finding. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Rishabh Jain <rishabhmj21@gmail.com> Co-authored-by: Rishabh Jain <rishjain@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Brad Flood <63075802+brflood@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
July 8, 2026 23:50 — with
GitHub Pages
Inactive
#1420) PR #1418 merged azure-pipelines-task-lib@^5.277.0, but the official pipeline (PowerPlatform-DPX-Tools-GitHub-BT-Official) restores from the DPX-Tools-Upstream Azure Artifacts feed, which does not carry 5.277.0 (npm 404). The feed does carry 5.276.0, which likewise drops the transitive uuid@3.4.0 dependency, keeping CVE-2026-41907 fixed. Pinned exactly (no caret) so npm cannot re-resolve to the feed-missing 5.277.0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
July 9, 2026 00:24 — with
GitHub Pages
Inactive
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Rishabh Jain <rishjain@microsoft.com> Copilot-Session: 5a0fd990-27f4-4a2a-8df7-3b81302917c1
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
July 29, 2026 18:43 — with
GitHub Pages
Inactive
…#1433) * Fix GHSA-73rr-hh4g-fpgx: bump diff (jsdiff) override ^5.2.0 -> ^8.0.3 Resolves the S360 SDL action item 6014425 (jsdiff parsePatch DoS/ReDoS, GHSA-73rr-hh4g-fpgx), patched in jsdiff 8.0.3. Lockfile resolves to 8.0.4. Build passes; local mocha suite is blocked by a pre-existing Node 24 TypeScript-loader issue present on origin/main, unrelated to this change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: de0407b8-fb71-416c-8f0c-d03c0a7e0ef7 * chore: fix dependency vulnerabilities (S360 + Dependabot + npm audit) Fixed: - tar ^7.5.16 -> ^7.5.22 (critical: GHSA-w8wr-v893-vjvp, GHSA-23hp-3jrh-7fpw, GHSA-8x88-c5mf-7j5w, GHSA-gvwx-54wh-qm9j, GHSA-r292-9mhp-454m) - postcss ^8.5.15 -> ^8.5.25 (high: GHSA-r28c-9q8g-f849, GHSA-fxqj-rqcc-2cmp) - ip-address ^10.2.0 -> ^10.3.1 (high: GHSA-mwp4-54f8-5fhr, GHSA-4xrf-jv44-h6hh, GHSA-22jq-vg5j-6vgg) - js-yaml ^4.2.0 -> ^4.3.0 (high: GHSA-52cp-r559-cp3m / CVE-2025-64718, S360 6587259) - adm-zip ^0.5.16 -> ^0.6.0 (high: GHSA-xcpc-8h2w-3j85) - undici ^6.24.0 -> ^6.28.0 (moderate: GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcm) - brace-expansion v5 ^5.0.6 -> ^5.0.8, v2 ^2.0.3 -> ^2.1.3, v1 1.1.15 -> 1.1.17 (high: GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg; S360 6587257/6587260/6587261) The two bundled brace-expansion copies (under @microsoft/powerplatform-cli-wrapper and minimatch) are inBundle and cannot be reached by npm overrides, so they are patched directly in package-lock.json. Accepted risk (no published fix): - brace-expansion GHSA-rgw5-rvv9-x895 - patched version 5.0.9 is not published; 5.0.8 is the latest available. Remaining "high" audit entries are all transitive paths to this single advisory. - elliptic GHSA-848j-6mx2-7j84 - dev-only, no patched version (permanent accepted risk). Verified: npm run ci -> compile + lint pass. Unit tests fail locally with a pre-existing ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX error under Node v24 that reproduces on the unmodified dependency tree; not caused by this change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292 * fix(security): take fully-patched brace-expansion, js-yaml and nanoid The 1ES feed mirror has caught up, so versions that were unreachable last week are now installable. This closes the advisories that were previously left open. brace-expansion 2.1.3 -> 2.1.4, 5.0.8 -> 5.0.9, 1.1.17 -> 1.1.18 closes GHSA-rgw5-rvv9-x895 (CVE-2026-69152), previously recorded as unfixable js-yaml 4.3.0 -> 4.3.1 closes GHSA-5p4m-2wfm-xmqj nanoid 3.3.11 -> 3.3.17 closes GHSA-2v37-7h3g-55p8 and GHSA-28wg-ghj8-5hjv the override pinned nanoid to an exact 3.3.11, which was blocking the fix postcss stays at 8.5.25, which already exceeds the highest patched version (8.5.23). npm audit high/moderate/critical count is now zero; the 6 remaining low findings are the documented dev-only elliptic/rewiremock accepted risk. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: de0407b8-fb71-416c-8f0c-d03c0a7e0ef7 Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292
Jayanth Reddy Bujula (jbujula)
temporarily deployed
to
github-pages
August 13, 2026 22:17 — with
GitHub Pages
Inactive
* chore: automate dependency security fixes Dependabot cannot read or update the npm `overrides` block, and almost every vulnerability in this repo is transitive and pinned through `overrides`. That gap is why the same S360/Component Governance alerts are re-raised every week and have to be fixed by hand. Adds: - scripts/audit-overrides.js - resolves `npm audit` output against the GitHub Advisory DB, compares each advisory against every installed copy in the lock file, and raises the `overrides` range only when the patched version is actually published. Reports (rather than guesses at) bundled copies, packages spanning several major lines, and advisories with no published fix. - (workflow file .github/workflows/dependency-security.yml is added in a follow-up; the push token lacks the `workflow` OAuth scope) - dependabot.yml - grouped minor/patch updates, github-actions ecosystem, and ignores for the deliberately pinned `ajv` and `azure-pipelines-task-lib`. Key finding driving the design: most alerts are a stale lock file rather than a too-low range. `postcss` at `^8.5.15` already permitted the patched `8.5.25`, and the same was true for `tar`, `ip-address` and `undici` - `npm update` alone fixes those, with no manifest edit. Validated against the unfixed tree on main: the script independently reproduced the manual fix plan (stale-lock refresh for tar/postcss/ip-address/undici, a real bump for adm-zip) and correctly refused to emit a flat `brace-expansion` override, which would have downgraded the 2.x and 5.x copies to 1.1.17. Also records both learnings in the security-alerts skill. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292 * chore: request review on dependency PRs via CODEOWNERS Dependabot's eviewers: option was retired in 2025 in favour of CODEOWNERS, and this repo had no CODEOWNERS file, so dependency PRs were raised with no reviewer requested and no notification to anyone. Scoped to the dependency and security-automation files only, so unrelated PRs are not affected. Nothing auto-merges - every PR still needs a human to merge it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292 * chore: assign dependency PR reviews to managed-app-devops-team Verified the team has \maintain\ (push) on this repo; CODEOWNERS silently ignores teams without write access. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292 * chore: add weekly dependency security refresh workflow Runs npm ci -> npm update -> scripts/audit-overrides.js --write -> npm install -> npm run ci, and opens a PR only if the build is green. Reviewers come from .github/CODEOWNERS. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292 * chore: distinguish feed-mirror lag from a genuinely missing fix The 1ES feed mirror can trail the public npm registry by days. brace-expansion 1.1.18 / 2.1.4 / 5.0.9 were published upstream and picked up by Dependabot (#1437) while \ pm view\ against our mirror still reported 5.0.8 as latest, which made an available fix look like an unfixable advisory. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292 * chore: have CODEOWNERS cover every workflow file dependabot.yml enables the github-actions ecosystem, which raises PRs against any workflow (PullRequest.yml, codeql.yml, post-release.yml). CODEOWNERS only listed dependency-security.yml, so those PRs would have landed with no reviewer requested. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292 * fix: escape backslashes when quoting Windows command arguments CodeQL js/incomplete-sanitization: escaping only the quote character left a trailing backslash able to escape the closing quote. Backslash runs that precede a quote (or end the argument) are now doubled per Windows command-line parsing rules. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Requested by Jayanth Reddy Bujula (@jbujula)