chore: Apply dependabot upgrades from dependabotchanges (ADO #41266) by Shreyas-Microsoft · Pull Request #218 · microsoft/Container-Migration-Solution-Accelerator

Shreyas-Microsoft · 2026-05-05T14:58:55Z

Purpose

Applies all 4 open dependabot PRs (#167, #168, #169, #214) into a single validated branch, on top of a down-merge of main and dev into dependabotchanges.

Refs ADO work item #41266.

Commits

SHA	Scope
`cf908f4`	AC-1: down-merge `main` into `dependabotchanges`
`6d7719d`	AC-2: down-merge `dev`
`c1c065a`	PR #167 - 10 GitHub Actions version bumps
`9812856`	PR #168 - 13 pip `backend-api` bumps (uv lock refreshed)
`b9fb0a3`	PR #214 - 10/13 pip `processor` bumps (uv lock refreshed)
`709abef` + `9b752e9`	PR #169 - 14 minor + 20 major npm frontend bumps

Validation

backend-api: all 12 module imports clean
processor: fastmcp v2->v3 API verified across 4 mcp_server modules
frontend: npm install + npm run build succeeded (exit 0)

Skipped with rationale

azure-ai-agents@1.2.0b6 (processor) - agent-framework==1.0.0b260107 pins b5
azure-identity@1.25.3 (processor) - current 1.26.0b1 is already newer
eslint@10 + @eslint/js@10 - eslint-plugin-react@7.37.5 and eslint-plugin-react-hooks@7.1.1 peer-cap at eslint ^9; no compatible plugins yet
axios@1.14.0 - current 1.15.0 already newer
js-yaml / lottie-react / react-markdown - already at target

Notable major bumps in PR #169

React 18 -> 19 (+ @types/react, react-dom)
@azure/msal-browser / @azure/msal-react 4 -> 5
vite 6 -> 8
tailwindcss 3 -> 4 (added @tailwindcss/postcss, updated postcss.config.js)
uuid 11 -> 13

Does this introduce a breaking change?

Yes
No

Golden Path Validation

I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

...

Other Information

Equivalent of #167. Applied as direct version bumps because the dependabot branch diverged heavily from main+dev. - actions/checkout v4 -> v6 - actions/setup-python v5 -> v6 - actions/upload-artifact v4 -> v7 - actions/stale v9 -> v10 - docker/setup-buildx-action v3 -> v4 - docker/build-push-action v6 -> v7 - codfish/semantic-release-action v3 -> v5 - amannn/action-semantic-pull-request v5 -> v6 - lycheeverse/lychee-action v2.4.1 -> v2.8.0 - tj-actions/changed-files v46 -> v47.0.5 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…for ADO #41266 Equivalent of #168. pyproject.toml versions bumped to dependabot recommendations and uv.lock regenerated via 'uv lock --upgrade'. - aiofiles 24.1.0 -> 25.1.0 - azure-ai-agents 1.2.0b3 -> 1.2.0b6 - azure-appconfiguration 1.7.1 -> 1.8.0 - azure-identity 1.25.0 -> 1.25.3 - azure-monitor-opentelemetry 1.7.0 -> 1.8.7 - azure-search-documents 11.6.0b12 -> 11.7.0b2 - azure-storage-blob 12.26.0 -> 12.28.0 - azure-storage-queue 12.13.0 -> 12.15.0 - fastapi[standard] 0.116.1 -> 0.135.3 - pydantic-settings 2.10.1 -> 2.13.1 - sas-cosmosdb 0.1.4 -> 0.1.5 - semantic-kernel[azure] 1.40.0 -> 1.41.1 - uvicorn 0.35.0 -> 0.42.0 Validation: all 13 upgraded modules import cleanly. Existing src/tests suite has pre-existing broken imports (libs/, routers/ missing in src/) on main and dev unrelated to this upgrade. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… for ADO #41266 Equivalent of #214. pyproject.toml versions bumped and uv.lock regenerated via 'uv lock --upgrade'. Applied: - aiohttp 3.13.3 -> 3.13.5 - azure-ai-projects 2.0.0b3 -> 2.1.0 - azure-appconfiguration 1.7.2 -> 1.8.0 - fastmcp 2.14.5 -> 3.2.4 (major bump, API-compatible) - mcp 1.25.0 -> 1.27.0 - openai 2.15.0 -> 2.33.0 - psutil 7.2.1 -> 7.2.2 - pytz 2025.2 -> 2026.1.post1 - sas-cosmosdb 0.1.4 -> 0.1.5 Skipped (with rationale): - azure-ai-agents 1.2.0b6: blocked by agent-framework==1.0.0b260107 which pins azure-ai-agents==1.2.0b5 (kept current pin). - azure-identity 1.25.3: current pin (1.26.0b1) is newer than dependabot target. - azure-storage-queue 12.15.0: already at target. - semantic-kernel 1.41.3: not present in processor (removed from main+dev, replaced by agent-framework). Validation: fastmcp v3 'from fastmcp import FastMCP' API still works, all 4 processor mcp_server modules import successfully under v3. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…n src/frontend for ADO #41266 Equivalent of #169, partial. This commit covers ONLY the minor/patch bumps. Major version bumps (React 18->19, MSAL 4->5, vite 6->8, tailwindcss 3->4, eslint 9->10, uuid 11->13, etc.) are intentionally deferred for explicit per-package review per AC-4. Applied (minor/patch): - @fluentui/react ^8.122.9 -> ^8.125.5 - @fluentui/react-components ^9.56.7 -> ^9.73.7 - @fluentui/react-file-type-icons ^8.12.7 -> ^8.17.0 - @fluentui/react-icons ^2.0.270 -> ^2.0.323 - @reduxjs/toolkit ^2.2.7 -> ^2.11.2 - @tailwindcss/vite ^4.0.0 -> ^4.2.2 - autoprefixer ^10.4.20 -> ^10.4.27 - postcss ^8.5.0 -> ^8.5.8 - react-icons ^5.5.0 -> ^5.6.0 - react-router-dom ^7.13.1 -> ^7.13.2 - sql-formatter ^15.4.11 -> ^15.7.3 - rollup-plugin-dts ^6.1.1 -> ^6.4.1 - eslint-plugin-react ^7.37.2 -> ^7.37.5 - rollup ^4.59.0 -> ^4.60.1 Validation: 'npm install' clean, 'npm run build' clean (vite production build OK). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Applied 20 major version bumps from dependabot PR #169: - React 18 -> 19 (react, react-dom, @types/react, @types/react-dom) - @azure/msal-browser, @azure/msal-react 4 -> 5 - vite 6 -> 8 - tailwindcss 3 -> 4 (added @tailwindcss/postcss; updated postcss.config.js) - uuid 11 -> 13 - Plus other minor majors (recharts, react-router-dom, etc.) Skipped/reverted with rationale: - eslint kept at ^9.39.4 (eslint-plugin-react@7.37.5 and eslint-plugin-react-hooks@7.1.1 peer-cap at eslint ^9; no plugins compatible with eslint 10 yet) - @eslint/js kept at ^9 to match eslint - axios kept at 1.15.0 (newer than dependabot target 1.14.0) - js-yaml, lottie-react, react-markdown already at target versions Validation: npm install succeeded; npm run build succeeded (with expected fluentui peer-dep warnings around React 19; build output is clean). Refs ADO #41266 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-05-05T15:00:41Z

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	3097	208	93%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
588	0 💤	0 ❌	0 🔥	22.816s ⏱️

Copilot

Pull request overview

This PR consolidates multiple Dependabot upgrades (GitHub Actions, Python/uv dependencies for backend-api and processor, and npm dependencies for frontend) into a single branch intended to be validated and merged.

Changes:

Updates GitHub Actions used across CI/CD workflows (checkout/setup-python/upload-artifact/buildx/build-push/etc.).
Refreshes Python dependency pins for src/backend-api and src/processor (including fastmcp v2→v3 for processor) and updates the src/processor/uv.lock.
Updates the frontend toolchain and libraries (React 18→19, Vite 6→8, Tailwind 3→4, MSAL 4→5) and adjusts PostCSS config for Tailwind v4.

Reviewed changes

Copilot reviewed 20 out of 23 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`src/processor/uv.lock`	Updates the processor’s locked Python dependency graph (including `fastmcp` v3 and related transitive changes).
`src/processor/pyproject.toml`	Bumps pinned processor runtime dependencies to match refreshed lockfile.
`src/frontend/postcss.config.js`	Switches PostCSS Tailwind plugin to `@tailwindcss/postcss` for Tailwind v4.
`src/frontend/package.json`	Major/minor npm dependency upgrades across React/MSAL/Vite/Tailwind and related tooling.
`src/backend-api/pyproject.toml`	Bumps pinned backend-api Python dependencies (FastAPI, Azure SDKs, uvicorn, etc.).
`.github/workflows/validate-bicep-params.yml`	Updates GitHub Action versions used in bicep param validation.
`.github/workflows/test.yml`	Updates checkout action version.
`.github/workflows/stale-bot.yml`	Updates actions used by stale/branch cleanup automation.
`.github/workflows/pylint.yml`	Updates checkout/setup-python action versions.
`.github/workflows/pr-title-checker.yml`	Updates semantic PR title check action version.
`.github/workflows/job-docker-build.yml`	Updates Docker-related actions and disables provenance in build-push steps.
`.github/workflows/job-deploy.yml`	Updates checkout action version.
`.github/workflows/job-deploy-windows.yml`	Updates checkout action version.
`.github/workflows/job-deploy-linux.yml`	Updates checkout action version.
`.github/workflows/job-cleanup-deployment.yml`	Updates checkout action version.
`.github/workflows/docker-build-and-push.yml`	Updates Docker-related actions and disables provenance in build-push steps.
`.github/workflows/Create-Release..yml`	Updates checkout + semantic-release action versions (but currently has an event/ref mismatch).
`.github/workflows/ci.yml`	Updates checkout action version.
`.github/workflows/broken-links-checker.yml`	Updates changed-files + lychee action versions.
`.github/workflows/azure-dev.yml`	Updates checkout action version.
`.github/workflows/azd-template-validation.yml`	Updates checkout action version.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Fix lottie-react double-default CJS interop in processPage and progressModal - Fix highlight.js language registration with unwrap helper for rolldown - Remove sql-formatter and sql language registration - Switch Dockerfile build stage to node:20-slim (rolldown needs Node >=20.19) - Use npm ci instead of npm install in Dockerfile - Revert react-syntax-highlighter to v15.6.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Keep our dependabot package versions, take dev code changes. Reapplied lottie-react unwrap fix and kept sql-formatter removed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 25 out of 28 changed files in this pull request and generated 4 comments.

Resolve conflicts with origin/dev (ADO #41266): - backend-api/pyproject.toml: restore python-dotenv==1.2.2 pin; bump python-multipart 0.0.22 -> 0.0.27; bump urllib3 2.6.3 -> 2.7.0; add requests==2.33.0, werkzeug==3.1.4, pygments==2.20.0 to override-deps - processor/pyproject.toml: bump pytest 9.0.2 -> 9.0.3 - frontend/package.json: keep lucide-react ^1.7.0; bump mermaid ^11.13.0 -> ^11.15.0; bump uuid ^13.0.0 -> ^14.0.0 - .github/workflows/test.yml: keep actions/checkout@v6 + setup-python@v6 bumps; align processor_tests job to same versions - regenerated uv.lock and package-lock.json Validated: npm run build succeeds; uv lock resolves cleanly for both backend-api (156 packages) and processor (202 packages). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- frontend/requirements.txt: python-dotenv 1.1.1 -> 1.2.2 (closes #202) - processor/package-lock.json: refresh transitive deps for mermaid + lodash-es ecosystem (chevrotain, etc.); covers #235, #236 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-05-19T05:45:56Z

Processor Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	5725	719	87%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
812	0 💤	0 ❌	0 🔥	20.660s ⏱️

Copilot

Pull request overview

Copilot reviewed 26 out of 30 changed files in this pull request and generated 4 comments.

Files not reviewed (1)

src/processor/package-lock.json: Language not supported

Previous --legacy-peer-deps regen omitted typescript@6.0.3 (peer dep of rollup-plugin-dts) from the lockfile, causing `npm ci` to fail inside the frontend Dockerfile with "Missing: typescript@6.0.3 from lock file". Regenerated with --include=peer so all peer deps are pinned and CI's build-and-push (ContentProcessorWeb) succeeds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Create-Release..yml: drop misleading ref override on push trigger (github.event.workflow_run.head_sha is empty on push events; let actions/checkout default to the pushed SHA) - batchView.tsx: register SQL language for the Light SyntaxHighlighter so getFileLanguageAndType()='sql' renders correctly - modernizationPage.tsx: register SQL language for the Light SyntaxHighlighter so translated SQL is highlighted instead of potentially erroring on the unregistered language - processPage.tsx: fix comment typo (missing space before hyphen) - package.json: declare highlight.js as a direct dependency since the Light highlighter imports highlight.js/lib/languages/* directly; pinned to ^10.7.3 to match the version already resolved transitively via react-syntax-highlighter Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 26 out of 30 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

src/processor/package-lock.json: Language not supported

Shreyas-Microsoft and others added 7 commits May 5, 2026 18:04

AC-1: Down-merge main into feature branch (psl-sw/41266) for ADO #41266

cf908f4

AC-2: Down-merge dev into feature branch (psl-sw/41266) for ADO #41266

6d7719d

Copilot AI review requested due to automatic review settings May 5, 2026 14:58

Shreyas-Microsoft requested review from Avijit-Microsoft, Dongbumlee, Prajwal-Microsoft, Roopan-Microsoft, Vinay-Microsoft, aniaroramsft, dgp10801, nchandhi, sethsteenken and toherman-msft as code owners May 5, 2026 14:58

Shreyas-Microsoft had a problem deploying to production May 5, 2026 14:59 — with GitHub Actions Error

Shreyas-Microsoft temporarily deployed to production May 5, 2026 14:59 — with GitHub Actions Inactive

Shreyas-Microsoft temporarily deployed to production May 5, 2026 15:00 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Shreyas-Microsoft May 5, 2026 15:00 View session

Copilot AI reviewed May 5, 2026

View reviewed changes

Comment thread .github/workflows/Create-Release..yml

Shreyas-Microsoft temporarily deployed to production May 5, 2026 15:09 — with GitHub Actions Inactive

Shreyas-Microsoft changed the title ~~chore(deps): Apply dependabot upgrades from dependabotchanges (ADO #41266)~~ chore: Apply dependabot upgrades from dependabotchanges (ADO #41266) May 5, 2026

Shreyas-Microsoft and others added 2 commits May 7, 2026 21:35

Merge branch 'dev' into psl-sw/41266-dependabot-upgrades

59d1afc

Keep our dependabot package versions, take dev code changes. Reapplied lottie-react unwrap fix and kept sql-formatter removed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 7, 2026 16:07

Shreyas-Microsoft temporarily deployed to production May 7, 2026 16:08 — with GitHub Actions Inactive

Shreyas-Microsoft had a problem deploying to production May 7, 2026 16:08 — with GitHub Actions Failure

Copilot started reviewing on behalf of Shreyas-Microsoft May 7, 2026 16:08 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

Comment thread src/frontend/src/pages/batchView.tsx

Comment thread src/backend-api/pyproject.toml Outdated

Comment thread src/frontend/src/pages/processPage.tsx Outdated

Comment thread src/frontend/src/pages/modernizationPage.tsx

Shreyas-Microsoft had a problem deploying to production May 19, 2026 05:43 — with GitHub Actions Failure

Shreyas-Microsoft temporarily deployed to production May 19, 2026 05:44 — with GitHub Actions Inactive

Shreyas-Microsoft temporarily deployed to production May 19, 2026 05:45 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings May 19, 2026 05:45

Shreyas-Microsoft had a problem deploying to production May 19, 2026 05:45 — with GitHub Actions Failure

Shreyas-Microsoft temporarily deployed to production May 19, 2026 05:47 — with GitHub Actions Inactive

Shreyas-Microsoft temporarily deployed to production May 19, 2026 05:49 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Shreyas-Microsoft May 19, 2026 05:49 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Comment thread src/frontend/src/pages/batchView.tsx

Comment thread src/frontend/package.json

Comment thread src/frontend/src/pages/processPage.tsx Outdated

Comment thread src/frontend/src/pages/modernizationPage.tsx

Shreyas-Microsoft temporarily deployed to production May 19, 2026 05:59 — with GitHub Actions Inactive

Shreyas-Microsoft temporarily deployed to production May 19, 2026 07:46 — with GitHub Actions Inactive

Shreyas-Microsoft temporarily deployed to production May 19, 2026 07:51 — with GitHub Actions Inactive

Shreyas-Microsoft temporarily deployed to production May 19, 2026 07:57 — with GitHub Actions Inactive

Shreyas-Microsoft temporarily deployed to production May 19, 2026 08:09 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings May 19, 2026 08:52

Shreyas-Microsoft temporarily deployed to production May 19, 2026 08:53 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Shreyas-Microsoft May 19, 2026 08:55 View session

Shreyas-Microsoft temporarily deployed to production May 19, 2026 08:55 — with GitHub Actions Inactive

Copilot AI reviewed May 19, 2026

View reviewed changes

Comment thread src/frontend/src/pages/batchView.tsx

Comment thread src/frontend/src/pages/processPage.tsx

Comment thread src/frontend/src/commonComponents/ProgressModal/progressModal.tsx

Shreyas-Microsoft temporarily deployed to production May 19, 2026 09:04 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: Apply dependabot upgrades from dependabotchanges (ADO #41266)#218

chore: Apply dependabot upgrades from dependabotchanges (ADO #41266)#218
Shreyas-Microsoft wants to merge 13 commits into
devfrom
psl-sw/41266-dependabot-upgrades

Shreyas-Microsoft commented May 5, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented May 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Shreyas-Microsoft commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Commits

Validation

Skipped with rationale

Notable major bumps in PR #169

Does this introduce a breaking change?

Golden Path Validation

Deployment Validation

What to Check

Other Information

Uh oh!

github-actions Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Shreyas-Microsoft commented May 5, 2026 •

edited

Loading

github-actions Bot commented May 5, 2026 •

edited

Loading

github-actions Bot commented May 19, 2026 •

edited

Loading