[waldekmastykarz]

What's changed

Patches vulnerabilities and bumps outdated dependencies.

Vulnerability fixes

• adm-zip: 0.5.17 → 0.6.0 (fixes high severity memory allocation vuln — major version bump)
• axios: 1.16.1 → 1.19.0 (fixes multiple moderate/high vulnerabilities including prototype pollution, CRLF injection, proxy bypass)
• Transitive fixes via dependency tree updates: brace-expansion, form-data, js-yaml, undici

Dependency bumps

Package	From	To
@azure/msal-common	16.6.2	16.12.0
@azure/msal-node	5.2.2	5.5.0
@inquirer/confirm	6.1.0	6.1.1
@inquirer/input	5.1.0	5.1.2
@inquirer/select	5.2.0	5.2.1
@xmldom/xmldom	0.9.10	0.9.11
applicationinsights	3.14.0	3.16.0
clipboardy	5.3.1	5.3.2
csv-stringify	6.7.0	6.8.3
open	11.0.0	11.0.1
semver	7.8.1	7.8.5
uuid	14.0.0	14.0.1
@types/node	24.12.4	24.13.3
@types/semver	7.7.1	7.8.0
@typescript-eslint/eslint-plugin	8.60.0	8.67.0
@typescript-eslint/parser	8.58.0	8.67.0
eslint	10.4.0	10.8.1
globals	17.6.0	17.11.0
mocha	11.7.6	11.8.0
sinon	22.0.0	22.1.0
tsc-watch	7.2.0	7.2.1

Remaining transitive vulnerabilities (no fix available yet)

• @opentelemetry/core, protobufjs — waiting on applicationinsights upstream to release compatible versions

Notes

• All 15,938 tests pass
• Build succeeds
• Supersedes fix: patch vulnerabilities and bump outdated dependencies #7455 (all changes from that PR are included with newer versions)

[waldekmastykarz]

Closing in favor of #7551 which includes all changes from this PR plus additional vulnerability fixes (protobufjs override update, opentelemetry dedup, removed stale sdk-node pin). Result: 0 vulnerabilities.