[waldekmastykarz]

Pull Request Title

fix: patch vulnerabilities and bump outdated dependencies

Linked Issue

Supersedes #7663.

One PR = One Commit

This replacement carries forward both complete commits from #7663 and adds the newly cooldown-eligible security and dependency updates.

New Command = Five Files

N/A. This PR updates dependencies and the existing Zod compatibility helper only.

Main Branch Only

Targets upstream main.

Merge Conflicts

The branch is based on the latest upstream main.

Summary

• includes every change from fix: patch vulnerabilities and bump outdated dependencies #7663
• upgrades @azure/msal-node from 5.6.0 to 7.1.0 to resolve GHSA-xcx6-jx8p-x3h5; 7.1.1 remains in the seven-day cooldown until 2026-10-28
• updates cooldown-eligible direct dependencies: @typescript-eslint/eslint-plugin, @typescript-eslint/parser, eslint, and zod
• updates transitive undici to 6.29.1, resolving GHSA-4qv8-2p9j-2685 and GHSA-xjj6-f33q-929c
• preserves the Zod schema compatibility fix and all dependency/override updates from fix: patch vulnerabilities and bump outdated dependencies #7663

Security status

npm audit reports three remaining entries:

• high-severity node-forge advisory: 1.4.0 is the latest published version and npm reports no fix available
• low-severity serialize-javascript advisory through mocha: the fixed 7.1.3 release is not published; 7.1.2 is the latest registry version
• mocha is reported because it depends on the affected serialize-javascript; npm's suggested forced downgrade to Mocha 7.2.0 does not provide a published fixed dependency

Cooling down

• @azure/msal-common 16.14.3 — eligible 2026-10-28 19:12 UTC
• @azure/msal-node 7.1.1 — eligible 2026-10-28 19:21 UTC; this PR uses eligible fixed version 7.1.0
• @azure/msal-node-extensions 5.5.3 — eligible 2026-10-28 19:14 UTC

Not auto-applied

• major direct updates: @types/node, eslint-plugin-mocha, mocha, and typescript
• pre-release-only updates: @typescript-eslint/eslint-plugin and @typescript-eslint/parser
• major override updates: @xmldom/xmldom, uuid, swiper, diff, and jws

Validation

• npm run build — passed
• npm test — passed
• 16,263 tests passing
• 100% statement, branch, function, and line coverage
• final npm audit — one high and two low entries remain, all currently unpatchable
• final npm outdated — all remaining compatible updates are in cooldown
• final override scan — patch/minor overrides are current; only major updates remain

[Copilot]

🟡 Changes recommended

The nullable-schema test checks only the option name, so it would miss a regression in the inferred option type that controls argument parsing.

1 open issue

• Add regression assertion for nullable schema option type · New

1 file not reviewed

• npm-shrinkwrap.json: Generated file

What changed in this PR

This PR carries forward #7663’s dependency refresh for CLI for Microsoft 365, adds security updates that have cleared the seven-day cooldown, and preserves the Zod compatibility adjustment.

Changes:

• Updates runtime dependencies, development tooling, and selected overrides.
• Refreshes locked dependencies, including MSAL Node and Undici security updates.
• Handles array-valued JSON Schema types when inferring CLI option types.

File	Description
src/​utils/​zod.ts	Normalizes array-valued schema types before selecting an option parser.
package.json	Updates dependency ranges and security-related overrides.
npm-shrinkwrap.json	Locks updated direct and transitive dependencies and their metadata.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The MSAL 5.6.0→7.1.0 upgrade requires maintainer validation of live login, token refresh, and persisted/native cache compatibility across supported platforms because current tests stub token acquisition.

No open issues 🎉

1 resolved since last review

• Add regression assertion for nullable schema option type

1 file not reviewed

• npm-shrinkwrap.json: Generated file

_{Review effort: Balanced}