[waldekmastykarz]

Pull Request Title

fix: patch vulnerabilities and update eligible dependencies

Linked Issue

Related: pnp/cli-microsoft365#7683. No separate tracking issue supplied for routine dependency maintenance.

One PR = One Commit

Individual patch commits retain dependency update boundaries for review and rollback. Please squash on merge.

New Command = Five Files

N/A. No commands added. Changes are dependency manifests/lockfiles plus Zod and React type compatibility.

Main Branch Only

Targets pnp/cli-microsoft365:main, not the fork.

Merge Conflicts

Based on upstream main through 81e442db5.

Summary

• Update 22 direct dependencies and refresh eligible transitive security fixes in the CLI and documentation site.
• Preserve the earlier dependency PR's Zod compatibility change and boolean-option assertion.
• Retain required security major upgrades: MSAL Node 5 → 7 and csv-parse 6 → 7.
• Update inherited XML parser, XML DOM, serialize-javascript, and follow-redirects overrides; do not auto-apply major override bumps.
• Adjust five documentation return annotations to React.JSX for compatibility with the refreshed React 19 types.
• Verify publication dates for all 369 changed locked package/version selections against the seven-day cooldown.
• Use only public npm registry URLs in both maintained lockfiles.

Previous PR

Do not close #7683 automatically. All source changes and most dependency changes are retained, but its shrinkwrap selected three November 5 releases that remain inside cooldown. This PR selects msal-common 16.15.0, msal-node 7.1.2, and msal-node-extensions 5.5.4 instead of 16.16.0, 7.2.0, and 5.6.0. Since not ALL previous lock selections are included, #7683 remains open as requested.

Security status and remaining work

Initial audit: CLI 26 findings (9 high, 16 moderate, 1 low); docs 52 findings (21 critical, 15 high, 12 moderate, 4 low). These are initial package counts, including propagated findings.

Final npm audit --json --include=dev --include=optional --fetch-retries=0 (CLI) and npm audit --json --include=dev --fetch-retries=0 (docs) were blocked by HTTP 429 from the configured feed, even after honoring Retry-After. Direct public npm access failed with ENOTCONN. Current advisory counts are therefore unverified, not zero.

Comparing the final locks to the initial advisory snapshot leaves CLI development-tooling glob/minimatch advisories and docs deepmerge, serialize-javascript, tinypool, and uuid advisories. The docs tinypool finding remains critical. Fixes require incompatible transitive upgrades (not forced), or are unavailable (deepmerge). Docusaurus is already latest. This PR does not claim vulnerability-free dependency trees.

Cooldown-deferred updates:

• @azure/msal-common 16.16.1, eligible 2026-11-13T23:49:01.000Z; intermediate 16.16.0 becomes eligible 2026-11-12T03:30:31.000Z.
• @azure/msal-node 7.2.1, eligible 2026-11-13T23:51:49.000Z; intermediate 7.2.0 becomes eligible 2026-11-12T03:33:14.000Z.
• @azure/msal-node-extensions 5.6.1, eligible 2026-11-13T23:51:36.000Z; intermediate 5.6.0 becomes eligible 2026-11-12T03:32:54.000Z.

Unrelated major direct upgrades and breaking override bumps are not auto-applied.

Validation

• fnm exec --using 24 npm run build — passed.
• fnm exec --using 24 npm test — passed after each new root patch; final run 17,170 tests, 100% statements/branches/functions/lines.
• cd docs && fnm exec --using 24 npm run typecheck — passed.
• cd docs && fnm exec --using 24 npm run build — passed.
• fnm exec --using 24 npm outdated --json --include=dev --include=optional --fetch-retries=0 — completed; only cooldown updates and out-of-range major versions remain.
• cd docs && fnm exec --using 24 npm outdated --json --include=dev --fetch-retries=0 — passed; no outdated direct dependencies.
• git diff --check upstream/main...HEAD — passed.
• All changed locked-version publication timestamps checked: passed.
• Every resolved URL in npm-shrinkwrap.json and docs/package-lock.json uses registry.npmjs.org: passed.

Real tenant sign-in and cross-platform native token-cache integration were not performed.

[Copilot]

🔵 Needs a closer look

The core MSAL upgrade lacks real-tenant authentication and cross-platform native-cache validation, while blocked security audits leave a reported critical docs dependency advisory unverified, requiring human assessment of compatibility and security risks.

No open issues 🎉

1 file not reviewed

• npm-shrinkwrap.json: Generated file

What changed in this PR

Updates CLI for Microsoft 365 and documentation-site dependencies to address vulnerabilities and refresh eligible packages, while preserving compatibility with updated Zod and React types.

Changes:

• Updates runtime and development dependencies, security overrides, and CLI shrinkwrap selections.
• Handles array-valued JSON Schema types and strengthens the boolean-option assertion.
• Updates five documentation component return annotations to React.JSX.

Builds, tests, and lint were not independently run. The PR reports successful validation, but final vulnerability counts remain unverified because audit requests were blocked.

File	Description
src/​utils/​zod.ts	Handles array-valued schema types when parsing command options.
src/​utils/​zod.spec.ts	Asserts that boolean options retain their boolean type.
package.json	Updates CLI dependencies and security overrides.
npm-shrinkwrap.json	Locks updated CLI dependency selections.
docs/​src/​theme/​Footer/​index.tsx	Uses the React-scoped JSX return type.
docs/​src/​theme/​DocBreadcrumbs/​index.tsx	Updates three JSX return annotations.
docs/​src/​components/​TeamCardOverview.tsx	Uses the React-scoped JSX return type.
docs/​package.json	Updates React and Markdown-processing dependencies.

_{Review effort: Balanced}