XS⚠️ ◾ [Autogenerated] Release v1.7.17 with Package Updates - #826
Closed
microsoft-pr-metrics[bot] wants to merge 6 commits into
Closed
XS⚠️ ◾ [Autogenerated] Release v1.7.17 with Package Updates#826microsoft-pr-metrics[bot] wants to merge 6 commits into
microsoft-pr-metrics[bot] wants to merge 6 commits into
Conversation
Contributor
Author
|
Action required before merging Check out this branch, then run the GitHub Copilot CLI agent: copilot --agent refresh-ci-dependencies --prompt "Refresh the pinned CI/CD dependencies on this release branch."This updates SHA-pinned GitHub Actions, Azure DevOps task versions, and Node.js runtime consistency – the pins the automated dependency updates do not cover – then commits and pushes to this branch. See |
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Bumps the PR Metrics extension/task version across manifests, package metadata, user agent string, and documentation to the next patch release.
Changes:
- Updated version strings from
1.7.16to1.7.17across extension/task/package metadata. - Updated README usage examples to reference
microsoft/PR-Metrics@v1.7.17. - Adjusted release trigger/versioning files under
.github.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/vss-extension.json | Bumps extension manifest version to 1.7.17 |
| src/task/task.loc.json | Bumps task localized version patch to 17 |
| src/task/task.json | Bumps task friendlyName and patch to 17 |
| src/task/src/utilities/constants.ts | Updates GitHub API user agent version string |
| src/task/Strings/resources.resjson/en-US/resources.resjson | Updates localized friendly name version string |
| package.json | Bumps npm package version to 1.7.17 |
| README.md | Updates documented GitHub Action reference to v1.7.17 |
| .github/release-version.json | Updates release patch version (currently to 18) |
| .github/release-publish-trigger.txt | Updates release publish trigger to 1.7.17 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
Author
PR Metrics✔ Thanks for keeping your pull request small.
Metrics computed by PR Metrics. Add it to your Azure DevOps and GitHub PRs! |
microsoft-pr-metrics
Bot
changed the title
![microsoft-pr-metrics[bot]](https://avatars.githubusercontent.com/in/3875026?s=60&v=4){kind=small}
| @@ -1,20 +1,20 @@ | |||
| { | |||
Contributor
Author
There was a problem hiding this comment.
❗ This file doesn't require review.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 13 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
src/task/src/utilities/constants.ts:29
- The user-agent embeds the version as a hard-coded string, which requires manual updates across multiple files each release (and makes it easy to miss one, as evidenced by the release-version mismatch in this PR). Consider centralizing the version (e.g., a single version constant generated at build time, or reading from package metadata during bundling) and deriving
userAgentfrom that source of truth.
export const userAgent = "PRMetrics/v1.7.17";
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 13 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
src/task/src/utilities/constants.ts:29
- The version is duplicated across many files (manifests, README, resources, and this user-agent). The mismatch in
.github/release-version.jsonsuggests this manual process is error-prone. Consider generating these versioned strings during the build/release step from a single source of truth (e.g.,package.jsonor the release-version file) to prevent drift.
export const userAgent = "PRMetrics/v1.7.17";
…ersions - eslint from 10.8.0 to 10.7.0 - globals from 17.8.0 to 17.7.0 - npm-check-updates from 23.0.0 to 22.2.9 chore: add overrides for minimatch to package.json
Muiris Woulfe (muiriswoulfe)
temporarily deployed
to
production
July 30, 2026 21:06 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Muiris Woulfe (muiriswoulfe)
temporarily deployed
to
production
July 30, 2026 21:06 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Muiris Woulfe (muiriswoulfe)
temporarily deployed
to
production
July 30, 2026 21:06 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Muiris Woulfe (muiriswoulfe)
temporarily deployed
to
production
July 30, 2026 21:06 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
| @@ -2,7 +2,7 @@ | |||
| "$schema": "https://json.schemastore.org/resjson.json", | |||
Contributor
Author
There was a problem hiding this comment.
❗ This file doesn't require review.
Copilot started reviewing on behalf of
Muiris Woulfe (muiriswoulfe)
July 30, 2026 21:07
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 11 out of 14 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
.github/release-publish-trigger.txt:1
- The required release-time CI dependency refresh is incomplete.
.github/workflows/build.ymlstill pinsgithub/codeql-actionv4.37.3, although v4.37.4 is now available; this release workflow explicitly requires runningrefresh-ci-dependenciesbefore merge (.github/workflows/release-initiate.yml:98-109). Run that agent and commit its pin updates before this trigger publishes v1.7.17.
1.7.17
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 11 out of 14 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (2)
package.json:93
- Using a caret range in
overridesmakes installs non-deterministic (it may resolve to newer 10.x versions over time). This can also desyncsrc/LICENSE.txtfrom what actually gets installed. Prefer pinning an exact version inoverrides(matching the license notice) to keep builds and compliance reproducible.
"overrides": {
"minimatch": "^10.2.5"
.npmrc:5
- Changing the repo-wide registry to
packagefeedproxy.microsoft.iocan break installs for contributors/CI environments that expect the public npm registry (and can make dependency resolution environment-specific). Consider scoping the registry change (e.g., per-package scope) or moving this configuration into the build/release pipeline so local development continues to work with the default npm registry.
registry=https://packagefeedproxy.microsoft.io/npm/
| "major": 1, | ||
| "minor": 7, | ||
| "patch": 17 | ||
| "patch": 18 |
Member
|
Closing in favour of a recreated pull request opened under a user account, so the CLA can be signed (the CLA is keyed to the pull request author). Same head branch and same content. |
Muiris Woulfe (muiriswoulfe)
temporarily deployed
to
production
July 30, 2026 21:14 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Muiris Woulfe (muiriswoulfe)
temporarily deployed
to
production
July 30, 2026 21:14 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Muiris Woulfe (muiriswoulfe)
temporarily deployed
to
production
July 30, 2026 21:14 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Muiris Woulfe (muiriswoulfe)
temporarily deployed
to
production
July 30, 2026 21:14 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Muiris Woulfe (muiriswoulfe)
added a commit
that referenced
this pull request
Aug 7, 2026
…ity remediation (#827) Release of PR Metrics v1.7.17. Beyond the routine autogenerated version and package updates, this release includes security remediation for CVE-2026-14257 and a package feed change. ## Security - Remediates CVE-2026-14257 / GHSA-mh99-v99m-4gvg (`brace-expansion` denial of service via unbounded expansion length, causing an uncatchable out-of-memory process crash). - The advisory patches each major line independently rather than in a single range: `< 1.1.17` is fixed in 1.1.17, `2.0.0` to `2.1.2` in 2.1.3, `3.0.0` to `3.0.2` in 3.0.3, and `4.0.0` to `5.0.7` in 5.0.8. - The package updates in this release are sufficient on their own. Every `brace-expansion` copy in the tree now sits above the fixed version for its line, so no `overrides` entry is required: | Consumer | `minimatch` | `brace-expansion` | Fixed version for line | | --- | --- | --- | --- | | `azure-pipelines-task-lib` | 3.1.5 | 1.1.18 | 1.1.17 | | `readdir-glob` | 5.1.9 | 2.1.4 | 2.1.3 | | `mocha`, `archiver-utils` | 9.0.9 | 2.1.4 | 2.1.3 | | `eslint` | 10.2.6 | 5.0.9 | 5.0.8 | - `npm audit` reports no `brace-expansion` finding. - Earlier revisions of this branch carried an override, first pinning `minimatch` to `^10.2.6` and later forcing `brace-expansion` to `^5.0.9`. Both have been dropped. Neither was necessary once the per-line fixed versions were taken into account, and the global `brace-expansion` pin was actively harmful: the CommonJS build of `brace-expansion` 5.x exports a named `expand` binding rather than a callable module, so `minimatch` below 10 throws `expand is not a function` from `braceExpand`. Leaving each `minimatch` major on its own patched `brace-expansion` line keeps the CommonJS contract intact. ## Package feed - Switches `.npmrc` to the Microsoft package feed proxy, in line with policy. - The proxy has now caught up with the public registry, so the three development dependencies previously held back are on their current releases: `eslint` 10.8.0, `globals` 17.8.0 and `npm-check-updates` 23.0.0. - For the same reason, `brace-expansion` resolves to 5.0.9 beneath `eslint` rather than the 5.0.8 the proxy previously carried. ## Verification - `npm run test:fast` passes, with 100% statement, branch, function and line coverage. - `npm run lint` passes. - `dist/` regenerated via `npm run build:package`, and `src/LICENSE.txt` via `generate-license-file`. Both reproduce byte-identical output on repeat runs. - Every `minimatch` in the tree was exercised against its resolved `brace-expansion` to confirm `braceExpand()` still evaluates brace patterns, covering the 3.1.5, 5.1.9, 9.0.9 and 10.2.6 lines. - `undici` resolves to 6.28.0, the highest release within the range its consumers request. - Every `package-lock.json` entry retains both `resolved` and `integrity`. ## Notes - Recreated from the autogenerated pull request (#826) under this account so the CLA can be signed, since the CLA is keyed to the pull request author. --------- Co-authored-by: microsoft-pr-metrics[bot] <288118622+microsoft-pr-metrics[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Autogenerated release for PR Metrics v1.7.17. This includes version updates and dependency updates.