Update package.json deps with npm audit, component governance by KarishmaGhiya · Pull Request #2527 · microsoft/mcp

KarishmaGhiya · 2026-04-28T22:54:09Z

Summary

Updates package.json dependencies in Fabric and Template MCP Server VS Code extensions by running
pm audit fix\ to resolve security vulnerabilities. Will also fix some Component Governance alerts.

Changes

Fabric.Mcp.Server/vscode: Updated dependencies in package.json and regenerated package-lock.json
Template.Mcp.Server/vscode: Updated dependencies in package.json and regenerated package-lock.json

Invoking Livetests

Copilot submitted PRs are not trustworthy by default. Users with \write\ access to the repo need to validate the contents of this PR before leaving a comment with the text /azp run mcp - pullrequest - live. This will trigger the necessary livetest workflows to complete required validation.

Copilot

Pull request overview

Updates VS Code extension npm dependencies (primarily to address npm audit findings) across the MCP server extensions, including major-version bumps that change runtime/tooling requirements.

Changes:

Updated @microsoft/vscode-azext-utils to ^4.0.7 in multiple VS Code extensions.
Updated VS Code extension packaging tooling dependency @vscode/vsce (Azure/Fabric) and refreshed lockfiles (Template shown).
Reflowed JSON formatting for serverMode enum arrays (Azure/Fabric).

Reviewed changes

Copilot reviewed 3 out of 6 changed files in this pull request and generated 5 comments.

File	Description
servers/Template.Mcp.Server/vscode/package.json	Bumps `@microsoft/vscode-azext-utils` to v4.
servers/Template.Mcp.Server/vscode/package-lock.json	Regenerated lockfile; introduces new transitive engine constraints (notably `tas-client`).
servers/Fabric.Mcp.Server/vscode/package.json	Bumps `@microsoft/vscode-azext-utils` to v4 and updates `@vscode/vsce`.
servers/Azure.Mcp.Server/vscode/package.json	Bumps `@microsoft/vscode-azext-utils` to v4 and updates `@vscode/vsce`; also expands `serverMode` enum formatting.

Copilot · 2026-04-28T23:01:23Z

    "dependencies": {
-        "@microsoft/vscode-azext-utils": "~2",
+        "@microsoft/vscode-azext-utils": "^4.0.7",


The PR description says it updates Fabric + Template VS Code extension dependencies, but this change also updates the Azure VS Code extension. Please update the PR description (or drop the Azure change) so reviewers understand the full scope and can validate Azure-specific packaging/runtime impact.

Copilot · 2026-04-28T23:01:24Z

    },
    "dependencies": {
-        "@microsoft/vscode-azext-utils": "~2",
+        "@microsoft/vscode-azext-utils": "^4.0.7",


Bumping @microsoft/vscode-azext-utils to v4 introduces a minimum VS Code engine requirement of ^1.105.0 (per the package’s engines.vscode). This extension still declares engines.vscode as ^1.101.0, so it may be activated on VS Code versions where the dependency is unsupported. Please align this extension’s engines.vscode (and typically @types/vscode) to at least ^1.105.0, or pin @microsoft/vscode-azext-utils to a version compatible with ^1.101.0.

Suggested change

"@microsoft/vscode-azext-utils": "^4.0.7",

"@microsoft/vscode-azext-utils": "^3.0.0",

Copilot · 2026-04-28T23:01:24Z

    "dependencies": {
-        "@microsoft/vscode-azext-utils": "~2",
+        "@microsoft/vscode-azext-utils": "^4.0.7",
        "@microsoft/vscode-azureresources-api": "~2",
        "dayjs": "~1",


Bumping @microsoft/vscode-azext-utils to v4 introduces a minimum VS Code engine requirement of ^1.105.0 (per the package’s engines.vscode). This extension still declares engines.vscode as ^1.101.0, so it may be activated on VS Code versions where the dependency is unsupported. Please align this extension’s engines.vscode (and typically @types/vscode) to at least ^1.105.0, or pin @microsoft/vscode-azext-utils to a version compatible with ^1.101.0.

Copilot · 2026-04-28T23:01:24Z

+            "version": "0.3.2",
+            "resolved": "https://registry.npmjs.org/tas-client/-/tas-client-0.3.2.tgz",
+            "integrity": "sha512-Hr0k7swJSyI7fsgqWf28GoME3lDXysTV1pJW/OBCrokhkqd3dTL+79SLKRGaYNHNaHii5N7VLRlZZc/up6xdAA==",
+            "license": "MIT",
+            "engines": {
+                "node": ">=22"


tas-client@0.3.2 declares engines.node: >=22. Our VSIX packaging pipeline uses Node 20.x (see eng/pipelines/templates/jobs/vsix/pack-and-sign-vsix.yml), and VS Code’s extension host is typically Node 20.x as well. This can lead to engine warnings during install and potential runtime failures if tas-client actually relies on Node 22 features. Consider pinning vscode-tas-client/tas-client to a Node 20-compatible version, or updating the build/runtime Node version expectations accordingly.

Suggested change

"version": "0.3.2",

"resolved": "https://registry.npmjs.org/tas-client/-/tas-client-0.3.2.tgz",

"integrity": "sha512-Hr0k7swJSyI7fsgqWf28GoME3lDXysTV1pJW/OBCrokhkqd3dTL+79SLKRGaYNHNaHii5N7VLRlZZc/up6xdAA==",

"license": "MIT",

"engines": {

"node": ">=22"

"version": "<REPLACE_WITH_NODE20_COMPATIBLE_VERSION>",

"resolved": "https://registry.npmjs.org/tas-client/-/tas-client-<REPLACE_WITH_NODE20_COMPATIBLE_VERSION>.tgz",

"integrity": "<REPLACE_WITH_MATCHING_INTEGRITY>",

"license": "MIT",

"engines": {

"node": ">=20"

Copilot · 2026-04-28T23:01:25Z

    "dependencies": {
-        "@microsoft/vscode-azext-utils": "~2",
+        "@microsoft/vscode-azext-utils": "^4.0.7",
        "@microsoft/vscode-azureresources-api": "~2",
        "dayjs": "~1",


Bumping @microsoft/vscode-azext-utils to v4 introduces a minimum VS Code engine requirement of ^1.105.0 (per the package’s engines.vscode). This extension still declares engines.vscode as ^1.101.0, so it may be activated on VS Code versions where the dependency is unsupported. Please align this extension’s engines.vscode (and typically @types/vscode) to at least ^1.105.0, or pin @microsoft/vscode-azext-utils to a version compatible with ^1.101.0.

hallipr · 2026-04-28T23:04:52Z

        "@typescript-eslint/parser": "^8.47.0",
        "@vscode/test-electron": "~2",
-        "@vscode/vsce": "~3",
+        "@vscode/vsce": "^2.25.0",


Why are we pinning to a random version from 2 years ago?

srnagar · 2026-04-28T23:05:17Z

        "@typescript-eslint/parser": "^8.47.0",
        "@vscode/test-electron": "~2",
-        "@vscode/vsce": "~3",
+        "@vscode/vsce": "^2.25.0",


Why did we drop the major version to 2?

jongio

Two questions on the dependency version changes:

The vsce downgrade (3.x to 2.x) is unexpected for an npm audit fix - typically audit fix upgrades packages. Was this intentional? vsce 3 requires Node >= 20 and dropped some deprecated APIs, so going back to 2.25 could affect extension packaging if the build pipeline is on Node 20+.
The azext-utils jump from v2 to v4 skips an entire major version. Has the extension code been verified against v4's API surface? Major versions usually ship breaking changes.

Minor: the PR description mentions only Fabric and Template but Azure.Mcp.Server/vscode is also changed.

jongio · 2026-04-28T23:05:38Z

        "@typescript-eslint/parser": "^8.47.0",
        "@vscode/test-electron": "~2",
-        "@vscode/vsce": "~3",
+        "@vscode/vsce": "^2.25.0",


This downgrades vsce from 3.x to 2.x. npm audit fix normally upgrades - was this intentional? vsce 3 dropped some deprecated APIs and requires Node >= 20. If the CI/packaging pipeline uses Node 20+, the older vsce might still work but you'd lose signing support (@vscode/vsce-sign is removed from the lockfile). Also this change isn't applied to Template.Mcp.Server - intentional inconsistency?

jongio · 2026-04-28T23:05:38Z

    },
    "dependencies": {
-        "@microsoft/vscode-azext-utils": "~2",
+        "@microsoft/vscode-azext-utils": "^4.0.7",


This jumps from v2 to v4 (skipping v3 entirely). Has the extension source been verified against azext-utils v4's API? Major versions typically ship breaking changes. If the extension builds and tests pass with v4, this is fine - just want to confirm it was validated.

KarishmaGhiya added 2 commits April 28, 2026 14:19

update package.json deps with npm audit

15a1a17

update package.json deps with npm audit

1fa7783

Copilot AI review requested due to automatic review settings April 28, 2026 22:54

KarishmaGhiya requested review from a team as code owners April 28, 2026 22:54

KarishmaGhiya requested review from JonathanCrd, anannya03, conniey, jairmyree, jongio, sandeep-sen and xirzec April 28, 2026 22:54

github-project-automation Bot added this to Azure MCP Server Apr 28, 2026

github-project-automation Bot moved this to Untriaged in Azure MCP Server Apr 28, 2026

Copilot started reviewing on behalf of KarishmaGhiya April 28, 2026 22:56 View session

KarishmaGhiya changed the title ~~Update package.json deps with npm audit~~ Apr 28, 2026

chidozieononiwu approved these changes Apr 28, 2026

View reviewed changes

Copilot AI reviewed Apr 28, 2026

View reviewed changes

hallipr reviewed Apr 28, 2026

View reviewed changes

srnagar reviewed Apr 28, 2026

View reviewed changes

jongio reviewed Apr 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update package.json deps with npm audit, component governance#2527

Update package.json deps with npm audit, component governance#2527
KarishmaGhiya wants to merge 2 commits intomicrosoft:mainfrom
KarishmaGhiya:cg-fixes

KarishmaGhiya commented Apr 28, 2026 •

edited

Loading

Copilot AI left a comment

Copilot AI Apr 28, 2026

Copilot AI Apr 28, 2026

Copilot AI Apr 28, 2026

Copilot AI Apr 28, 2026

Copilot AI Apr 28, 2026

hallipr Apr 28, 2026

srnagar Apr 28, 2026

jongio left a comment

jongio Apr 28, 2026

jongio Apr 28, 2026

Labels

6 participants

	"@microsoft/vscode-azext-utils": "^4.0.7",
	"@microsoft/vscode-azext-utils": "^3.0.0",

Conversation

KarishmaGhiya commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Invoking Livetests

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

hallipr Apr 28, 2026

Choose a reason for hiding this comment

srnagar Apr 28, 2026

Choose a reason for hiding this comment

jongio left a comment

Choose a reason for hiding this comment

jongio Apr 28, 2026

Choose a reason for hiding this comment

jongio Apr 28, 2026

Choose a reason for hiding this comment

Labels

6 participants

KarishmaGhiya commented Apr 28, 2026 •

edited

Loading