[Rick Brighenti (rbrighenti)]

Summary

Minimal dependency bumps in Node.js samples to clear all 8 open Dependabot security alerts. Only the vulnerable direct dependency is changed in each package.json. None of these samples has a committed lockfile, so I didn't add any.

Alert	Severity	Package	Sample	Change	Advisory
#43	high	@azure/msal-node	nodejs/autonomous/github-trending	^5.1.5 → ^7.1.0	GHSA-xcx6-jx8p-x3h5
#42	high	zod	nodejs/perplexity/sample-agent	^3.23.8 → ^4.6.6	GHSA-mrhx-c7xc-m3w5
#41	medium	@opentelemetry/core	nodejs/perplexity/sample-agent	2.1.0 → 2.8.0	GHSA-8988-4f7v-96qf
#40	medium	@opentelemetry/core	nodejs/devin/sample-agent	2.1.0 → 2.8.0	GHSA-8988-4f7v-96qf
#39	medium	@opentelemetry/core	nodejs/copilot-studio/sample-agent	2.1.0 → 2.8.0	GHSA-8988-4f7v-96qf
#38	medium	uuid	nodejs/langchain/quickstart-before	^9.0.0 → ^11.1.1	GHSA-w5hq-g745-h8pq
#37	medium	uuid	nodejs/vercel-sdk/sample-agent	^9.0.0 → ^11.1.1	GHSA-w5hq-g745-h8pq
#36	medium	uuid	nodejs/langchain/sample-agent	^9.0.0 → ^11.1.1	GHSA-w5hq-g745-h8pq

Each package moves to the first patched version listed in its advisory.

Compatibility notes

• @azure/msal-node 5 → 7: The only breaking changes in v6 and v7 affect acquireTokenInteractive (the responseMode and loopbackClient options). This sample only uses ConfidentialClientApplication with acquireTokenByClientCredential, so it isn't affected. msal-node 7 requires Node 20 or later, the same as v5. github-trending doesn't depend on @microsoft/agents-hosting, so no other package pins msal-node here.
• @opentelemetry/core 2.1.0 → 2.8.0: @microsoft/agents-a365-observability@2.0.0 already declares @opentelemetry/core ^2.6.0. The old 2.1.0 pin was already out of line with it, and 2.8.0 brings it back in range. The peer dependency @opentelemetry/api >=1.0.0 <1.10.0 is unchanged.
• uuid 9 → 11 and zod 3 → 4: These are major-version bumps, but no source file in these samples imports uuid or zod. They're declared but unused, so the API changes don't affect them. uuid 11 is the lowest patched line and still ships CommonJS (12 and later are ESM-only).
• Transitive zod: @microsoft/agents-hosting pins zod@3.25.75 exactly. That's a transitive dependency of the SDK and can't be overridden here without a lockfile or overrides. It isn't one of the open alerts, but it should be fixed upstream in agents-hosting.

Validation

For each of the 7 touched samples I ran a clean npm install --no-package-lock and then npm run build (tsc). Packages came from the internal npm proxy through a command-line flag; no registry configuration was committed.

• All 7 samples installed and built successfully.
• npm ls confirms the resolved versions: msal-node 7.1.2, zod 4.6.7, @opentelemetry/core 2.8.0 (×3) and uuid 11.1.1 (×3).
• Each bumped package loads with require() from its sample.
• None of these samples defines test or lint scripts.
• I didn't run any sample end to end: they need live Entra and model credentials.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@azure/msal-node	^7.1.0	Unknown	Unknown
npm/@opentelemetry/core	2.8.0	🟢 7.3	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dependency-Update-Tool 🟢 10 update tool detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 License 🟢 10 license file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Vulnerabilities ⚠️ 1 9 existing vulnerabilities detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. SAST 🟢 10 SAST tool is run on all commits Security-Policy 🟢 10 security policy file detected Fuzzing ⚠️ 0 project is not fuzzed CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 40 contributing companies or organizations
npm/@opentelemetry/core	2.8.0	🟢 7.3	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dependency-Update-Tool 🟢 10 update tool detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 License 🟢 10 license file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Vulnerabilities ⚠️ 1 9 existing vulnerabilities detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. SAST 🟢 10 SAST tool is run on all commits Security-Policy 🟢 10 security policy file detected Fuzzing ⚠️ 0 project is not fuzzed CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 40 contributing companies or organizations
npm/uuid	^11.1.1	Unknown	Unknown
npm/uuid	^11.1.1	Unknown	Unknown
npm/@opentelemetry/core	2.8.0	🟢 7.3	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dependency-Update-Tool 🟢 10 update tool detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 License 🟢 10 license file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Vulnerabilities ⚠️ 1 9 existing vulnerabilities detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. SAST 🟢 10 SAST tool is run on all commits Security-Policy 🟢 10 security policy file detected Fuzzing ⚠️ 0 project is not fuzzed CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 40 contributing companies or organizations
npm/zod	^4.6.6	Unknown	Unknown
npm/uuid	^11.1.1	Unknown	Unknown

Scanned Files

• nodejs/autonomous/github-trending/package.json
• nodejs/copilot-studio/sample-agent/package.json
• nodejs/devin/sample-agent/package.json
• nodejs/langchain/quickstart-before/package.json
• nodejs/langchain/sample-agent/package.json
• nodejs/perplexity/sample-agent/package.json
• nodejs/vercel-sdk/sample-agent/package.json

[Copilot]

🟢 Approval recommended

No active review issues block the dependency updates intended to address the reported Dependabot alerts.

No open issues 🎉

What changed in this PR

Updates direct dependencies across seven Node.js samples to address eight reported Dependabot alerts. Changes are limited to package manifests; no source code or lockfiles are changed.

Changes:

• Bumps @azure/msal-node, zod, @opentelemetry/core, and uuid to the advisory-listed patched versions.
• Preserves CommonJS compatibility by using uuid 11.
• Reports successful clean installs and TypeScript builds for all seven samples; end-to-end validation remains untested.

File	Description
nodejs/​vercel-sdk/​sample-agent/​package.json	Bumps uuid to ^11.1.1.
nodejs/​perplexity/​sample-agent/​package.json	Bumps OpenTelemetry core to 2.8.0 and zod to ^4.6.6.
nodejs/​langchain/​sample-agent/​package.json	Bumps uuid to ^11.1.1.
nodejs/​langchain/​quickstart-before/​package.json	Bumps uuid to ^11.1.1.
nodejs/​devin/​sample-agent/​package.json	Bumps OpenTelemetry core to 2.8.0.
nodejs/​copilot-studio/​sample-agent/​package.json	Bumps OpenTelemetry core to 2.8.0.
nodejs/​autonomous/​github-trending/​package.json	Bumps @azure/msal-node to ^7.1.0.

_{Review effort: Balanced}