Repository navigation
Fix SDL issues - #384
Merged
Vladimir Morozov (vmoroz) merged 6 commits intoOct 2, 2026
Merged
Fix SDL issues#384
Conversation
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
Review effort: Lite
Findings: 2
Open (2)
What changed in this PR
Updates Azure DevOps SDL configuration and dependency locks to address Guardian ESLint exclusion handling, remove expired suppressions, mitigate a brace-expansion CVE, and adjust symbol publishing behavior for GitHub-hosted sources.
Changes:
- Replaces Guardian ESLint signature suppressions with explicit exclusion patterns in CI and release pipelines; removes the expired
.gdnsuppressfile. - Updates multiple Yarn lockfiles to
brace-expansion1.1.21 / 2.1.7. - Disables source indexing in the symbol publishing step while continuing PDB publishing.
| File | Description |
|---|---|
| utils/scripts/hermes/yarn.lock | Bumps brace-expansion to 1.1.21 in this package root. |
| utils/promise/yarn.lock | Bumps brace-expansion to 1.1.21 in this package root. |
| tools/hermes-parser/js/yarn.lock | Bumps brace-expansion to 1.1.21 and 2.1.7 in this package root. |
| API/hermes/cdp/tools/hermes-inspector-msggen/yarn.lock | Bumps brace-expansion to 1.1.21 in this package root. |
| .ado/release-pipeline.yml | Adds explicit ESLint exclusion patterns and removes Guardian suppression file usage. |
| .ado/guardian/sdl/.gdnsuppress | Removes an expired Guardian suppression file from the repo. |
| .ado/build-template.yml | Adds explicit ESLint exclusion patterns; disables source indexing for symbol publishing. |
Files not reviewed (5)
- .ado/scripts/package-lock.json: Generated file
- benchmarks/widgets/original/es5/package-lock.json: Generated file
- benchmarks/widgets/single-file/es5/package-lock.json: Generated file
- tools/hcdp/package-lock.json: Generated file
- unittests/NodeApi/test/package-lock.json: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- use the repository ignore file as the single exclusion source - remove the checkout-folder-dependent pattern list
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
Review effort: Lite
Findings: 1
Resolved since last review (2)
Files not reviewed (5)
- .ado/scripts/package-lock.json: Generated file
- benchmarks/widgets/original/es5/package-lock.json: Generated file
- benchmarks/widgets/single-file/es5/package-lock.json: Generated file
- tools/hcdp/package-lock.json: Generated file
- unittests/NodeApi/test/package-lock.json: Generated file
- centralize the exclusion file path and rationale - reuse the shared variable in CI and release pipelines
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
Review effort: Lite
Findings: 1
Open (3)
\\). If this template is ever consumed by a non-Windows… · New${{ }}) to reference a runtime variable value (which itself… · New${{ }}here can be harder to reason about because… · New
Resolved since last review (1)
Files not reviewed (5)
- .ado/scripts/package-lock.json: Generated file
- benchmarks/widgets/original/es5/package-lock.json: Generated file
- benchmarks/widgets/single-file/es5/package-lock.json: Generated file
- tools/hcdp/package-lock.json: Generated file
- unittests/NodeApi/test/package-lock.json: Generated file
- use runtime variable references for task inputs - normalize the shared ignore path separators
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
Review effort: Lite
Findings: None
Resolved since last review (3)
Files not reviewed (5)
- .ado/scripts/package-lock.json: Generated file
- benchmarks/widgets/original/es5/package-lock.json: Generated file
- benchmarks/widgets/single-file/es5/package-lock.json: Generated file
- tools/hcdp/package-lock.json: Generated file
- unittests/NodeApi/test/package-lock.json: Generated file
Member
Author
|
/azp run |
|
Azure Pipelines: No pipelines were found matching this branch/path. |
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
Review effort: Lite
Findings: None
Files not reviewed (5)
- .ado/scripts/package-lock.json: Generated file
- benchmarks/widgets/original/es5/package-lock.json: Generated file
- benchmarks/widgets/single-file/es5/package-lock.json: Generated file
- tools/hcdp/package-lock.json: Generated file
- unittests/NodeApi/test/package-lock.json: Generated file
Benchmark ResultsTotal benchmarks: 204 Inputs: baseline/baseline.json, bench_result.json v8 (6176ms, 4863ms) -21.3%
test-suites (317886ms, 254938ms) -19.8%
micros (60876ms, 48472ms) -20.4%
jit-benches (8563ms, 5483ms) -36.0%
many-subclasses (73437ms, 60988ms) -17.0%
map-objects (3627ms, 2773ms) -23.5%
map-strings (4335ms, 3203ms) -26.1%
nbody (3448ms, 2384ms) -30.9%
string-switch (6503ms, 4550ms) -30.0%
raytracer (5608ms, 4367ms) -22.1%
MiniReact (30332ms, 22671ms) -25.3%
widgets (12934ms, 10205ms) -21.1%
|
Member
Author
|
/azp run |
|
Azure Pipelines: No pipelines were found matching this branch/path. |
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
Review effort: Lite
Findings: 2
Open (2)
Files not reviewed (5)
- .ado/scripts/package-lock.json: Generated file
- benchmarks/widgets/original/es5/package-lock.json: Generated file
- benchmarks/widgets/single-file/es5/package-lock.json: Generated file
- tools/hcdp/package-lock.json: Generated file
- unittests/NodeApi/test/package-lock.json: Generated file
- use native Windows separators for Guardian file paths
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
Review effort: Lite
Findings: 2
Open (2)
Resolved since last review (2)
Files not reviewed (5)
- .ado/scripts/package-lock.json: Generated file
- benchmarks/widgets/original/es5/package-lock.json: Generated file
- benchmarks/widgets/single-file/es5/package-lock.json: Generated file
- tools/hcdp/package-lock.json: Generated file
- unittests/NodeApi/test/package-lock.json: Generated file
Julio César Rocha (JunielKatarn)
approved these changes
Oct 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #378. Guardian did not load the repository
.eslintignore, andthe checked-in suppressions had expired, causing SDL post-analysis failures and
recurring exception maintenance.
SDL scope
Replaces signature suppressions with explicit exclusions for non-shipping
engine tests, benchmarks, third-party sources, generated fixtures, and internal
tools in both CI and release pipelines. Removes the expired suppression file.
Dependency security
Updates npm and Yarn locks to
brace-expansion1.1.21 and 2.1.7, resolvingCVE-2026-102277 across every detected package root.
Symbol publishing
Disables unsupported GitHub source indexing while continuing to publish PDBs
to Azure Artifacts.
Test Plan
Focused package-source checks and clean/immutable installs pass. CI passes with
green SDL, Component Governance, and symbol publication tasks.
Microsoft Reviewers: Open in CodeFlow