From 74c2ffe556e7c05c3755d52bf4f225bf6728a0e2 Mon Sep 17 00:00:00 2001
From: Rick Brighenti <202984599+rbrighenti@users.noreply.github.com>
Date: Fri, 30 Oct 2026 15:15:54 +0000
Subject: [PATCH] Bump vulnerable npm dependencies in Node.js samples

Clears Dependabot alerts #36-#43:
- @azure/msal-node ^5.1.5 -> ^7.1.0 (github-trending)
- zod ^3.23.8 -> ^4.6.6 (perplexity)
- @opentelemetry/core 2.1.0 -> 2.8.0 (perplexity, devin, copilot-studio)
- uuid ^9.0.0 -> ^11.1.1 (langchain sample-agent, langchain quickstart-before, vercel-sdk)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 nodejs/autonomous/github-trending/package.json  | 2 +-
 nodejs/copilot-studio/sample-agent/package.json | 2 +-
 nodejs/devin/sample-agent/package.json          | 2 +-
 nodejs/langchain/quickstart-before/package.json | 2 +-
 nodejs/langchain/sample-agent/package.json      | 2 +-
 nodejs/perplexity/sample-agent/package.json     | 4 ++--
 nodejs/vercel-sdk/sample-agent/package.json     | 2 +-
 7 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/nodejs/autonomous/github-trending/package.json b/nodejs/autonomous/github-trending/package.json
index c79e00f1..033d5d5b 100644
--- a/nodejs/autonomous/github-trending/package.json
+++ b/nodejs/autonomous/github-trending/package.json
@@ -15,7 +15,7 @@
   "license": "MIT",
   "dependencies": {
     "@azure/identity": "^4.6.0",
-    "@azure/msal-node": "^5.1.5",
+    "@azure/msal-node": "^7.1.0",
     "@microsoft/opentelemetry": "1.0.0",
     "dotenv": "^17.2.3",
     "express": "^5.1.0",
diff --git a/nodejs/copilot-studio/sample-agent/package.json b/nodejs/copilot-studio/sample-agent/package.json
index dc8cb187..000d836d 100644
--- a/nodejs/copilot-studio/sample-agent/package.json
+++ b/nodejs/copilot-studio/sample-agent/package.json
@@ -25,7 +25,7 @@
     "@microsoft/agents-activity": "^1.2.2",
     "@microsoft/agents-copilotstudio-client": "^1.2.2",
     "@microsoft/agents-hosting": "^1.2.2",
-    "@opentelemetry/core": "2.1.0",
+    "@opentelemetry/core": "2.8.0",
     "dotenv": "^17.2.3",
     "express": "^5.1.0"
   },
diff --git a/nodejs/devin/sample-agent/package.json b/nodejs/devin/sample-agent/package.json
index 1320884c..d12ef494 100644
--- a/nodejs/devin/sample-agent/package.json
+++ b/nodejs/devin/sample-agent/package.json
@@ -19,7 +19,7 @@
     "@microsoft/agents-a365-runtime": "2.0.0",
     "@microsoft/agents-a365-tooling": "2.0.0",
     "@microsoft/agents-hosting": "^1.0.15",
-    "@opentelemetry/core": "2.1.0",
+    "@opentelemetry/core": "2.8.0",
     "dotenv": "^17.2.3",
     "uuid": "^13.0.0"
   },
diff --git a/nodejs/langchain/quickstart-before/package.json b/nodejs/langchain/quickstart-before/package.json
index edf660a1..2460f601 100644
--- a/nodejs/langchain/quickstart-before/package.json
+++ b/nodejs/langchain/quickstart-before/package.json
@@ -28,7 +28,7 @@
     "express": "^5.1.0",
     "langchain": "^1.0.1",
     "node-fetch": "^3.3.2",
-    "uuid": "^9.0.0"
+    "uuid": "^11.1.1"
   },
   "devDependencies": {
     "@azure/monitor-opentelemetry-exporter": "^1.0.0-beta.32",
diff --git a/nodejs/langchain/sample-agent/package.json b/nodejs/langchain/sample-agent/package.json
index 2a14c4c9..7271a458 100644
--- a/nodejs/langchain/sample-agent/package.json
+++ b/nodejs/langchain/sample-agent/package.json
@@ -36,7 +36,7 @@
     "express": "^5.1.0",
     "langchain": "^1.0.1",
     "node-fetch": "^3.3.2",
-    "uuid": "^9.0.0"
+    "uuid": "^11.1.1"
   },
   "devDependencies": {
     "@azure/monitor-opentelemetry-exporter": "^1.0.0-beta.32",
diff --git a/nodejs/perplexity/sample-agent/package.json b/nodejs/perplexity/sample-agent/package.json
index 1a9a5813..269c99dd 100644
--- a/nodejs/perplexity/sample-agent/package.json
+++ b/nodejs/perplexity/sample-agent/package.json
@@ -26,13 +26,13 @@
     "@microsoft/agents-activity": "^1.2.2",
     "@microsoft/agents-hosting": "^1.2.2",
     "@microsoft/microsoft-graph-client": "^3.0.7",
-    "@opentelemetry/core": "2.1.0",
+    "@opentelemetry/core": "2.8.0",
     "@perplexity-ai/perplexity_ai": "^0.16.0",
     "dotenv": "^17.2.2",
     "express": "^5.1.0",
     "mammoth": "^1.11.0",
     "pdf-parse": "^2.4.5",
-    "zod": "^3.23.8"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@microsoft/m365agentsplayground": "^0.2.18",
diff --git a/nodejs/vercel-sdk/sample-agent/package.json b/nodejs/vercel-sdk/sample-agent/package.json
index c7483b55..bfa4168a 100644
--- a/nodejs/vercel-sdk/sample-agent/package.json
+++ b/nodejs/vercel-sdk/sample-agent/package.json
@@ -30,7 +30,7 @@
     "dotenv": "^17.2.3",
     "express": "^5.1.0",
     "node-fetch": "^3.3.2",
-    "uuid": "^9.0.0"
+    "uuid": "^11.1.1"
   },
   "devDependencies": {
     "@azure/monitor-opentelemetry-exporter": "^1.0.0-beta.32",