XS⚠️ ◾ Release v1.7.17 with package updates and brace-expansion security remediation

[Muiris Woulfe (muiriswoulfe)]

Release of PR Metrics v1.7.17. Beyond the routine autogenerated version and
package updates, this release includes security remediation for CVE-2026-14257
and a package feed change.

Security

• Remediates CVE-2026-14257 / GHSA-mh99-v99m-4gvg (brace-expansion denial of
  service via unbounded expansion length, causing an uncatchable out-of-memory
  process crash).

• The advisory patches each major line independently rather than in a single
  range: < 1.1.17 is fixed in 1.1.17, 2.0.0 to 2.1.2 in 2.1.3, 3.0.0 to
  3.0.2 in 3.0.3, and 4.0.0 to 5.0.7 in 5.0.8.

• The package updates in this release are sufficient on their own. Every
  brace-expansion copy in the tree now sits above the fixed version for its
  line, so no overrides entry is required:

  Consumer	minimatch	brace-expansion	Fixed version for line
  azure-pipelines-task-lib	3.1.5	1.1.18	1.1.17
  readdir-glob	5.1.9	2.1.4	2.1.3
  mocha, archiver-utils	9.0.9	2.1.4	2.1.3
  eslint	10.2.6	5.0.9	5.0.8

• npm audit reports no brace-expansion finding.

• Earlier revisions of this branch carried an override, first pinning
  minimatch to ^10.2.6 and later forcing brace-expansion to ^5.0.9. Both
  have been dropped. Neither was necessary once the per-line fixed versions were
  taken into account, and the global brace-expansion pin was actively harmful:
  the CommonJS build of brace-expansion 5.x exports a named expand binding
  rather than a callable module, so minimatch below 10 throws
  expand is not a function from braceExpand. Leaving each minimatch major
  on its own patched brace-expansion line keeps the CommonJS contract intact.

Package feed

• Switches .npmrc to the Microsoft package feed proxy, in line with policy.
• The proxy has now caught up with the public registry, so the three development
  dependencies previously held back are on their current releases: eslint
  10.8.0, globals 17.8.0 and npm-check-updates 23.0.0.
• For the same reason, brace-expansion resolves to 5.0.9 beneath eslint
  rather than the 5.0.8 the proxy previously carried.

Verification

• npm run test:fast passes, with 100% statement, branch, function and line
  coverage.
• npm run lint passes.
• dist/ regenerated via npm run build:package, and src/LICENSE.txt via
  generate-license-file. Both reproduce byte-identical output on repeat runs.
• Every minimatch in the tree was exercised against its resolved
  brace-expansion to confirm braceExpand() still evaluates brace patterns,
  covering the 3.1.5, 5.1.9, 9.0.9 and 10.2.6 lines.
• undici resolves to 6.28.0, the highest release within the range its
  consumers request.
• Every package-lock.json entry retains both resolved and integrity.

Notes

• Recreated from the autogenerated pull request (XS⚠️ ◾ [Autogenerated] Release v1.7.17 with Package Updates #826) under this account so the
  CLA can be signed, since the CLA is keyed to the pull request author.

[microsoft-pr-metrics]

PR Metrics

✔ Thanks for keeping your pull request small.
⚠️ Consider adding additional tests.

	Lines
Product Code	1
Test Code	-
Subtotal	1
Ignored Code	693
Total	694

Metrics computed by PR Metrics. Add it to your Azure DevOps and GitHub PRs!

[Copilot]

Pull request overview

Releases PR Metrics v1.7.17 with dependency updates and remediation for the brace-expansion denial-of-service vulnerability.

Changes:

• Updates release versions and documentation.
• Routes npm through the Microsoft package feed proxy.
• Overrides minimatch, refreshes dependencies, licenses, lockfile, and distribution artifacts.

Reviewed changes

Copilot reviewed 11 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/release-publish-trigger.txt	Triggers publishing v1.7.17.
.github/release-version.json	Advances the next release to 1.7.18.
.npmrc	Switches to the Microsoft package proxy.
README.md	Updates usage examples to v1.7.17.
dist/index.mjs	Refreshes the bundled action dependencies.
dist/resources.resjson	Updates bundled release branding.
package-lock.json	Locks updated and remediated dependencies.
package.json	Updates dependencies and adds the minimatch override.
src/LICENSE.txt	Refreshes third-party license notices.
src/task/Strings/resources.resjson/en-US/resources.resjson	Updates localized release branding.
src/task/src/utilities/constants.ts	Updates the source User-Agent version.
src/task/task.json	Updates Azure task metadata.
src/task/task.loc.json	Updates localized task metadata.
src/vss-extension.json	Updates extension version metadata.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 14 changed files in this pull request and generated no new comments.

Suppressed comments (4)

src/LICENSE.txt:1514

• The third-party notice names brace-expansion@5.0.8, while the committed lockfile resolves the package to 5.0.9. The release's legal inventory should identify the version actually shipped.

 - brace-expansion@5.0.9

package.json:93

• The security section says the override is ^10.2.5 and that brace-expansion resolves to 5.0.8, but this override and the lockfile resolve minimatch 10.2.6 and brace-expansion 5.0.9. Update the security/package-feed notes so reviewers and release records describe the remediation actually being shipped.

    "minimatch": "^10.2.6"

src/LICENSE.txt:661

• The third-party notice names minimatch@10.2.5, but the committed lockfile resolves node_modules/minimatch to 10.2.6. Regenerate or correct the notice so the shipped dependency inventory is accurate.

This issue also appears on line 1514 of the same file.

 - minimatch@10.2.6

package.json:80

• This upgrade contradicts the PR description, which says ESLint 10.7.0 (along with globals 17.7.0 and npm-check-updates 22.2.9) is deliberately held because the proxy lacks the newer releases. The lockfile now resolves the newer versions from the Microsoft proxy, so update the package-feed notes to describe the actual release contents.

This issue also appears on line 93 of the same file.

    "eslint": "10.8.0",

[Copilot]

Pull request overview

Copilot reviewed 11 out of 14 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

package.json:83

• The Package feed section says the proxy is holding eslint at 10.7.0 and globals at 17.7.0, but these lines (and the lockfile’s proxy URLs) show that 10.8.0 and 17.8.0 are available. Update the PR description, including its similar stale claims for npm-check-updates and brace-expansion, so the release record matches the artifacts being reviewed.

    "eslint": "10.8.0",
    "fast-check": "4.9.0",
    "generate-license-file": "4.2.1",
    "globals": "17.8.0",

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.