[Jackson Weber (JacksonWeber)]

Summary

Consolidate the available updates from 10 open Dependabot PRs, plus additional npm audit fixes, into one dependency update. Keep the required Microsoft package proxy and leave production dependency ranges unchanged.

• Raise OpenAI Agents to ^0.15.0 in the root and main samples. This removes the vulnerable MCP SDK / Express / body-parser / Ajv / fast-uri dependency chain rather than forcing incompatible transitive overrides.
• Raise Vitest and its Istanbul coverage provider together to ^4.1.12 and update Vite to the proxy-approved 8.3.4.
• Update markdown-it to 14.3.3, brace-expansion to 5.0.12, source-map-js to 1.2.2, and Zod to 4.6.7 across affected lockfiles, including the AKS sample.
• Upgrade the Agent365 S2S sample to MSAL Node ^7.1.1 for GHSA-xcx6-jx8p-x3h5.
• Update SHA-pinned actions/setup-node to 7.1.0 and actions/upload-artifact to 7.0.2.
• Add a Fabric sample lockfile and switch its documented installation command to npm ci.

Dependabot coverage

PRs	Resolution
#273	Zod updated to 4.6.7 in samples.
#269	markdown-it updated to 14.3.3.
#258	brace-expansion updated to 5.0.12.
#259	source-map-js updated to 1.2.2.
#262	Both grouped GitHub Actions updates applied across all affected workflows.
#257, #260, #267, #268, #271	Superseded by removing the affected proxy-addr, MCP SDK, Hono, and ip-address dependencies from the root/main sample trees with OpenAI Agents 0.15.0.

Leave #266 open. Its exact Vite 8.3.5 target is unavailable through the required Microsoft proxy. This PR uses the latest proxy-approved 8.3.4, which clears the reported Vite audit findings. The requester approved proceeding with this exception.

npm audit results and remaining blocker

Final npm audit --json --prefer-online results, including development dependencies:

Package tree	Remaining findings
Root	0
Main samples	0
AKS LangChain sample	0
Agent365 S2S sample	0
Fabric sample	2 high entries: body-parser and its dependent Express, from one underlying advisory

Fabric is not audit-clean: GHSA-27r3-jxmh-p828 requires body-parser 1.20.9 or 2.4.0. Both patched versions are unavailable through the required proxy (exact-version lookups return E404). Its lockfile currently resolves Express 4.22.3 and body-parser 1.20.8. Upgrading Express to the proxy's latest 5.3.0 would still pull a vulnerable body-parser 2.x version, so this PR avoids an ineffective major upgrade. The requester approved proceeding while documenting this blocked fix; it must be revisited when a patched version is proxy-approved.

Verification

• npm ci succeeds for the root and all four sample package trees.
• Root build, formatting, lint, TypeDoc generation, and ESM import check pass (lint/docs retain existing warnings).
• npm test -- --maxWorkers=4: 1,293 passed, 16 skipped, 5 todo. The first unbounded parallel run hit one durable-export replay timeout; that test passed in isolation and the complete bounded-concurrency rerun passed.
• Integration tests: 83 passed, 1 skipped because Windows symlink creation requires developer mode/elevation.
• Targeted OpenAI instrumentation sample type-check passes with Agents 0.15.0.
• Agent365 S2S build, formatting, and lint pass with MSAL Node 7.1.1.
• Exact consolidated version targets, removed vulnerable chains, manifest/lockfile consistency, and unchanged production dependency ranges are asserted.

Full main-samples build limitation: npm run build --prefix samples reports four errors in the unchanged samples/src/a365HostingMiddleware.ts: an unused InferenceScope import (line 35), Promise<unknown[]> typing (line 114), and missing getParentSpanRef calls (lines 205 and 306). No unrelated sample source changes are included.

[Copilot]

🔵 Needs a closer look

The MSAL major upgrade and substantial OpenAI Agents dependency changes warrant final human compatibility review.

No open issues 🎉

4 files not reviewed

• samples/agent365-s2s/package-lock.json: Generated file
• samples/aks-langchain/package-lock.json: Generated file
• samples/fabric/package-lock.json: Generated file
• samples/package-lock.json: Generated file

What changed in this PR

Consolidates Dependabot updates and security fixes across the distro’s development dependencies, samples, and GitHub Actions, while preserving root production dependency ranges and the required Microsoft package proxy.

Changes:

• Updates OpenAI Agents, Vitest, MSAL Node, and affected transitive dependencies.
• Refreshes SHA-pinned GitHub Actions versions.
• Adds a Fabric sample lockfile and documents npm ci, with proxy-blocked fixes recorded in the changelog.

File	Description
samples/​package.json	Raises OpenAI Agents to ^0.15.0.
samples/​package-lock.json	Updates Agents and Zod; removes the old MCP/Express dependency chain.
samples/​fabric/​README.md	Switches installation instructions to npm ci.
samples/​fabric/​package-lock.json	Adds reproducible dependency resolutions for Fabric.
samples/​aks-langchain/​package-lock.json	Updates Zod to 4.6.7.
samples/​agent365-s2s/​package.json	Raises MSAL Node to ^7.1.1.
samples/​agent365-s2s/​package-lock.json	Locks updated MSAL packages and refreshes root metadata.
package.json	Updates Agents, Vitest, and Istanbul coverage development dependencies.
CHANGELOG.md	Records dependency updates and proxy-blocked fixes.
.github/​workflows/​pr-validation.yml	Updates the pinned setup-node action.
.github/​workflows/​performance.yml	Updates setup-node and upload-artifact pins.
.github/​workflows/​docs.yml	Updates the pinned setup-node action.

_{Review effort: Balanced}