Skip to content

Upgrade cache integrations to remediate Undici and uuid alerts - #1264

Draft
Elizabeth Craig (ecraig12345) wants to merge 1 commit into
copilot/update-fastify-stackfrom
copilot/cache-security-upgrades
Draft

Elizabeth Craig (ecraig12345) wants to merge 1 commit into
copilot/update-fastify-stackfrom
copilot/cache-security-upgrades

Conversation

@ecraig12345

Copy link
Copy Markdown
Member

Stack

Stacked on #1263. Merge the Node and RPC PRs first, then retarget this PR to main.

Changes

Upgrade Actions cache to 6.3.0 and Azure Identity to 4.14.1; share Azure Blob Storage 12.31.0 with Actions. Remove obsolete Node 18 Azure pins and engine exceptions. Load the ESM-only Actions client dynamically. Preserve restore/save paths and keys; honor the upstream ACTIONS_CACHE_MODE behavior.

Reviewed Actions release notes (v4-v6) and Azure Identity/Storage changelogs. The MSAL v7 interactive form_post change does not affect the configured non-interactive credential factories. MSAL 7.1.2 is eligible; 7.2.0 remains quarantined until November 13. Keep the eight-day gate unchanged.

Remove all root uuid 8, Undici 5, and @fastify/busboy paths. Undici now resolves to fixed 6.29.1. Share core-rest-pipeline 1.25 through a scoped Actions resolution: Actions only uses its TransferProgressEvent type. Correct the missing upstream core-client dependency metadata on storage-common 12.5.0 with a Yarn package extension; no runtime patches.

Validation

Full CI passed on Node 24.22.1, including Azure restore/save mock integration, actual ESM client loading and disabled cache restore/save, and server E2E tests. Dependency consistency, formatting, Beachball, and targeted deduplication checks passed. Live remote cache operations require credentials and were not performed.

…ncies

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@ecraig12345 Elizabeth Craig (ecraig12345) added the lage-v3 Work items for lage v3 and related major bumps of backfill label Nov 7, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

lage-v3 Work items for lage v3 and related major bumps of backfill

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant