[Liangying.Wei (vicancy)]

Why

Azure/azure-webpubsub has 75 open Dependabot alerts (11 high, 50 moderate, 14 low). None of them can be fixed by Dependabot itself: every one is a transitive dependency inside a lockfile, so the scheduled version-update PRs never touch them.

This PR sweeps everything that can be fixed safely today — 39 of the 75 alerts — in a single change, and documents concrete reasons for the 36 that are deliberately left alone.

What is fixed (39 alerts)

Package	From → To	Alerts	Where
webpack-dev-server deps via webpack	5.90.0 → 5.104.1	9	experimental/sdk/y-azure-webpubsub-client, samples/csharp/logstream/sdk/logstream, tools/vscode-azurewebpubsub
express	~4.17.1 → ^4.22.2	8	4 socket.io examples
lodash	4.17.21 → 4.18.0	6	root workspace (already merged in #1050) + tools/awps-tunnel/client
@azure/identity	^2.0.1 / ^3.3.0 → ^4.13.2	3	entra-id sample, chat-with-negotiate, awps-tunnel bundle
serialize-javascript	6.0.2 → 7.1.0	4	samples/javascript/scoreboard, website/src/plugins/...
@octokit/request / -error / endpoint / plugin-paginate-rest	8.4.0→8.4.1, 5.1.0→5.1.1, 9.0.5→9.0.6, 11.3.1→11.4.4-cjs.2	4	eng/copilot
minimatch (via @microsoft/api-extractor)	3.0.8 → 10.2.3	1	sdk/webpubsub-socketio-extension
nanoid	3.3.17 → 3.3.18	1	tools/azure-socketio-admin-ui
picomatch	2.3.1 → 2.3.2	1	samples/javascript/scoreboard
passport	^0.4.1 → ^0.7.0	1	samples/javascript/githubchat
esbuild	^0.27.3 → ^0.28.2	1	sdk/webpubsub-chat-client

Plus a small CI cleanup: .github/workflows/build.yml had duplicate push/pull_request path filters introduced when #1050 landed alongside the dorny/paths-filter refactor. The filter set is verified set-identical before and after.

Three traps worth knowing about

1. A stale pin can be the vulnerability. Both the root workspace and tools/awps-tunnel/client pinned lodash: 4.17.21 in resolutions. The advisory range is >= 4.0.0, <= 4.17.23, patched in 4.18.0 — so the pin was actively holding lodash on a vulnerable version. A sweep has to re-validate existing pins, not just look for missing ones.

2. @microsoft/api-extractor's latest dist-tag points at 8.0.0, published 2019-02-18. The real newest release is 7.58.13 (2026-08-20). npm install @microsoft/api-extractor@latest silently downgrades you six years. Bumping to 7.58.13 removes lodash from that dependency tree entirely and takes minimatch from 3.0.8 to 10.2.3, clearing 4 alerts from one devDependency change.

3. @octokit/plugin-paginate-rest@11.4.1 (Dependabot's suggested fix) breaks the peer requirement. It declares @octokit/core >= 6, but @octokit/rest@20 uses core 5. The correct fix is just refreshing the lockfile: @octokit/rest@20.1.2 is already inside the declared ^20.1.1 range and pins @octokit/plugin-paginate-rest@11.4.4-cjs.2, which is patched and stays on core 5. No resolutions entry needed.

A note on lockfile hygiene

The internal package proxy no longer returns dist.integrity, only a SHA-1 shasum. Regenerating any lockfile through it therefore downgrades new entries from sha512- to sha1- and rewrites URLs to internal feed hosts.

Every lockfile entry touched here is written back with the canonical registry.yarnpkg.com URL and real sha512 integrity, recomputed from the tarball bytes. Verified: npm ci (which validates integrity per package) passes in tools/vscode-azurewebpubsub, and yarn install --frozen-lockfile passes everywhere else.

Net effect versus main:

• sdk/webpubsub-socketio-extension/yarn.lock: sha1- entries 2 → 0, internal-feed URLs 734 → 714
• eng/copilot/yarn.lock: stays fully clean (0 internal URLs, 0 sha1-)
• the three package-lock.json files: 0 → 0 sha1- entries

Deliberately NOT included (36 alerts)

Package	Alerts	Why not
webpack-dev-server	12	Advisories cover <= 5.2.5, so the only fix is 5.2.6. react-scripts@5.0.1 declares webpack-dev-server@^4.6.0 and its config/webpackDevServer.config.js uses https: (L102), onBeforeSetupMiddleware (L112) and onAfterSetupMiddleware (L123) — all removed in v5. Forcing it would keep CI green (react-scripts build never loads the dev server) while silently breaking react-scripts start.
uuid	5	Requires 11.1.1 — three majors up from the installed 8.3.2, and v9 removed the default export. All usages are transitive. The vulnerability (GHSA-w5hq-g745-h8pq) only triggers when v3()/v5()/v6() are called with a caller-supplied output buffer.
image-size	4 (all high)	No patched version exists. Range is <= 2.0.2 and 2.0.2 is the latest release. Nothing to upgrade to.
react-router + react-router-dom	6	Needs a real v6 → v7 migration; react-router-dom@^6.30.4 is a direct dependency of tools/awps-tunnel/client and react-router-dom has no patched version at all.
vue, vuetify, echarts, element-plus, vue-template-compiler	7	All require Vue 2 → Vue 3 (vuetify 2.7.2 → 3.0.0, element-plus → 2.0.6, echarts 5 → 6). That is a rewrite of tools/azure-socketio-admin-ui, not a dependency bump.
@tootallnate/once	2 (low)	Parent http-proxy-agent@^4.0.1 declares @tootallnate/once@1; the fix is 2.0.1.

Validation

Everything below was run locally, not inferred:

• tools/vscode-azurewebpubsub — npm ci clean (906 packages), webpack resolves to 5.104.1
• sdk/webpubsub-socketio-extension — clean yarn install --frozen-lockfile, yarn build, yarn extract-api with no review/ diff
• sdk/webpubsub-chat-client — the full CI job sequence: install --frozen-lockfile → build → build:bundle → extract-api → git diff --exit-code -- review/ → test:unit (8/8 pass)
• samples/javascript/scoreboard — yarn build:client succeeds with serialize-javascript@7.1.0 under webpack/terser
• samples/javascript/chatapp-microsoft-entra-id — npm install + tsc: 180 pre-existing errors before and after, all inside the repo-root @types/react*, 0 referencing the sample's own sources. @azure/identity v4's only breaking change is dropping Node 16, and CI runs Node 20/22.
• eng/copilot — @octokit/rest still loads and octokitFunctions.js still exports all 10 functions
• tools/awps-tunnel/client — yarn build, yarn test (1/1), yarn lint

Supersedes

Closes #1054, #1055, #1056 — all three are folded into this branch.