Repository navigation
chore(deps): bump @vitest/mocker, @vitest/coverage-v8 and vitest in /src/500-application/516-chat-with-your-factory/services/chat-with-your-factory - #904
Closed
Closed
Conversation
Bumps [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) to 4.1.12 and updates ancestor dependencies [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker), [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). These dependencies need to be updated together. Updates `@vitest/mocker` from 4.1.11 to 4.1.12 - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.12/packages/mocker) Updates `@vitest/coverage-v8` from 4.1.11 to 4.1.12 - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.12/packages/coverage-v8) Updates `vitest` from 4.1.11 to 4.1.12 - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.12/packages/vitest) --- updated-dependencies: - dependency-name: "@vitest/mocker" dependency-version: 4.1.12 dependency-type: indirect - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.12 dependency-type: direct:development - dependency-name: vitest dependency-version: 4.1.12 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
6 of 29 tasks
Katrien De Graeve (katriendg)
added a commit
that referenced
this pull request
Oct 27, 2026
…tests (#907) ## Description Updated `docusaurus-tests.yml` with `persist-credentials: false` to address the checkout-credential requirement in #859. All other workflow configuration is unchanged. The branch also took in dependency vulnerability fixes after the failed security checks on #884 exposed repository-wide blockers. These updates address fixable findings needed for CI to pass; final validation remains with CI, and the upstream Zod finding is still unresolved. ## Related Issue Relates to #859. This PR addresses the Docusaurus checkout-credential gap only; it does not complete the Merge Queue rollout or close the issue. Related CI failure: #884. ## Type of Change <!-- What type of change does this PR introduce? Mark relevant options with 'x' --> - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] Blueprint modification or addition - [x] Component modification or addition - [ ] Documentation update - [x] CI/CD pipeline change - [x] Other (please describe): Dependency security updates and Dependabot consolidation ## Implementation Details <!-- Describe the implementation details and approach taken --> - Disabled credential persistence on the existing Docusaurus test checkout without changing its action pin, triggers, permissions, or other workflow settings. - Updated Tokio to 1.54.1 across ten affected Rust lockfiles to address RUSTSEC-2026-0386. - Updated affected npm dependency constraints and lockfiles for `body-parser`, `undici`, `fast-uri`, `ip-address`, and `serialize-javascript`. - Updated MSAL Node to 7.1.1 and aligned the Azure Identity transitive dependency with that patched version. - Consolidated the Microsoft Graph Go SDK update from #906, the Vitest updates from #904, and the certifi update from #905. - Retained the existing security thresholds and advisory policy. ## Testing Performed <!-- Describe the testing you have performed or plan to perform --> <!-- For bug fixes: A regression test verifies the fix and prevents the issue from recurring --> - [ ] Terraform plan/apply - [ ] Blueprint deployment test - [x] Unit tests - [ ] Integration tests - [ ] Bug fix includes regression test (see [Test Policy](https://github.com/microsoft/edge-ai/blob/main/docs/contributing/testing-validation.md)) - [ ] Manual validation - [x] Other: Rust dependency audits, chat server compilation, Go module verification, workflow permission validation, and patch hygiene - All 22 Rust lockfiles passed `cargo audit --deny warnings` with the repository's existing advisory and yanked-package policy. - The chat server TypeScript build and all 38 tests passed after the MSAL update, before the final Vitest patch update. CI must validate the final locked test-tool versions. - `go mod verify` passed for the updated Microsoft Graph dependency. - Workflow permission validation passed for all 38 scanned workflows. - `git diff --check origin/main...HEAD` passed. - Full builds, Go vulnerability analysis, browser and deployment tests, and final security scans remain for CI. ## Validation Steps <!-- Provide steps that reviewers should follow to validate your changes --> 1. Confirm the only workflow change is `persist-credentials: false` on the Docusaurus test checkout. 2. Verify Docusaurus tests, dependency review, Cargo Audit, and Security Scan results on the final branch commit. 3. Confirm the chat application builds and its tests pass with the final npm lockfile. 4. Keep #859 open for the remaining trust gates, hosted activation, and live Merge Queue proof. ## Checklist <!-- Mark relevant options with 'x' --> - [ ] I have updated the documentation accordingly - [ ] I have added tests to cover my changes - [ ] All new and existing tests passed - [ ] I have run `terraform fmt` on all Terraform code - [ ] I have run `terraform validate` on all Terraform code - [ ] I have run `az bicep format` on all Bicep code - [ ] I have run `az bicep build` to validate all Bicep code - [ ] I have checked for any sensitive data/tokens that should not be committed - [ ] Lint checks pass (run applicable linters for changed file types) ## Security Review - [ ] No credentials, secrets, or tokens are hardcoded or logged - [ ] RBAC and identity changes follow least-privilege principles - [ ] No new network exposure or public endpoints introduced without justification - [ ] Dependency additions or updates have been reviewed for known vulnerabilities - [ ] Container image changes use pinned digests or SHA references ## Additional Notes <!-- Add any other context about the PR here --> - Zod remains a known security-scan blocker because the upstream Agents SDK requires v3. A forced v4 override was not applied because its schema API is incompatible. - The Checkov portion of #905 was not included because it introduces `ecdsa`, which has an unpatched high-severity advisory. - No security checks were disabled, and these changes do not assert that hosted CI has passed. ## Screenshots (if applicable) <!-- Add screenshots to show the changes, if applicable --> Not applicable. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Author
|
Looks like these dependencies are up-to-date now, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/multi-a4e871beb4
branch
October 27, 2026 12:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps @vitest/mocker to 4.1.12 and updates ancestor dependencies @vitest/mocker, @vitest/coverage-v8 and vitest. These dependencies need to be updated together.
Updates
@vitest/mockerfrom 4.1.11 to 4.1.12Commits
4766ce1chore: release v4.1.12 (#11610)b825313fix(mocker): harden manual and redirect mocks [backport to v4] (#11580)Updates
@vitest/coverage-v8from 4.1.11 to 4.1.12Commits
4766ce1chore: release v4.1.12 (#11610)Updates
vitestfrom 4.1.11 to 4.1.12Commits
4766ce1chore: release v4.1.12 (#11610)5bf2197chore: delete wdio folder from v4 branch to avoid falsy release (#11581)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.