fix: restore Azure pipeline Docker authentication by ranadeepsingh · Pull Request #2573 · microsoft/SynapseML

ranadeepsingh · 2026-07-24T13:56:13Z

Issue

The ADO pipeline was blocked before any job could start:

BuildDocker referenced the nonexistent SynapseML MCR Docker registry service connection
Azure Pipelines validates service connection references before evaluating task conditions, so scheduled and PR builds failed even though Docker publishing defaults to disabled
/azp run did queue builds for PR fix: modernize OpenAI and LangChain support for GPT-5.1 #2572, but they failed validation immediately and the bot returned the misleading message No pipelines were found matching this branch/path

The shared setup template also generated repeated warnings:

Python 3.8 is no longer cached on the Ubuntu 22.04 hosted image, so UsePythonVersion@0 attempted anonymous GitHub downloads
the template pinned Azure CLI 2.60.0, which is older than the current 2.88.0 release

Fix

replace the missing Docker-registry connection with the existing SynapseML Build workload-identity connection
authenticate with az acr login before pushing development and release images to mmlsparkmcr
use cached Python 3.11 and disable registry downloads, avoiding GitHub rate limits without exposing a broad GitHub token to fork PR jobs
install Azure CLI 2.88.0 through the selected Python interpreter

Pipeline coverage audit

all 12 job declarations from master are preserved
BuildDocker still gets the version and Git tag
demo and minimal Docker image builds are preserved
development image tags and pushes are preserved under the original master/publish condition
release version/latest tags and pushes are preserved under the original tagged-release condition
component governance detection remains the final Docker job step

Validation

pipeline.yaml and templates/update_cli.yml parse successfully
structural comparison confirms all pipeline jobs are retained
sbt scalastyle test:scalastyle
black --check --extend-exclude 'docs/' .
ADO build 20260724.4 passed YAML validation and started the updated jobs
64 UsePythonVersion tasks and 64 Azure CLI installation tasks completed successfully with zero warnings; the old anonymous-download and CLI 2.60.0 warning strings are absent from the ADO timeline

Tracking

ADO Bug AB#5467636
Original failed build 20260723.1

Post-merge review status

PR #2574 was merged into this PR's head branch as commit 321ed02f64.
The local and fork fix/ado-docker-auth branches were rebased by fast-forward
to that exact upstream head; no commits were rewritten. Follow-up commit
8390352fd2 then moved the affected official GitHub Actions and website
runtime to Node 24 LTS. Commit 21e6081356 added one documented, tracked
dependency-review exception for the non-exploitable Docusaurus path.

The current diff contains 39 files across the pipeline repair, merged
website dependency modernization, and Node 24 action-runtime update.
Four independent file groups were reviewed and reconciled against source,
history, GitHub checks, and ADO results.
No hard-coded credentials, private keys, access tokens, or generated secret
files were found.
Black, Scala style, 177 version-script tests, whitespace validation, the
GitHub website build, ADO full build 228104679, and targeted ADO build
228246262 passed.
No PR review threads are unresolved.
Checkout, setup-node, setup-python, setup-java, artifact/pages actions, and
Dependency Review now use their current Node 24-compatible releases pinned
by immutable commit SHA. The dependency severity policy remains unchanged.
The Node 24 reruns passed CodeQL, website build, PR validation, and dead-link
checks. Their combined logs contain no Node 20 deprecation warning.
Review Dependencies now passes with zero errors, no Node 20 warning, and
the global High-severity threshold still active.

Tracked dependency exception

Newly published High advisory
GHSA-mh99-v99m-4gvg:

@docusaurus/core@3.10.2 -> serve-handler@6.1.7 -> minimatch@3.1.5 -> brace-expansion@1.1.16

The current 1.1.16 pin is compatible with minimatch@3 but remains covered
by the advisory. A direct override to the first patched release, 5.0.8, is
not safe because its CommonJS export shape is incompatible with
minimatch@3. Docusaurus and serve-handler are already at their current
upstream releases.

Dependency Review now allows only this GHSA. Docusaurus invokes
serve-handler without glob-based rewrites, redirects, headers, or
directory-listing patterns, so untrusted input cannot reach
brace-expansion. The repository-wide fail-on-severity: high policy remains
unchanged, and AB#5469322 tracks removal when an upstream-compatible release
becomes available.

## Summary Replace Docker push tasks that reference the missing SynapseML MCR service connection with Azure CLI tasks authenticated through the existing SynapseML Build workload identity. ## Prompting Intent Restore the SynapseML Azure DevOps pipeline so scheduled and PR builds can pass YAML validation, and make /azp run usable by authorized maintainers without weakening Docker publishing controls. ## Linked Sources - Failed ADO build: https://msdata.visualstudio.com/A365/_build/results?buildId=227953126&view=results - Broken WIF migration: #2536 - Affected PR command: #2572 (comment) ## Rationale Use the existing SynapseML Build WIF connection because it is available to the A365 pipeline and its identity has Contributor access to the resource group containing mmlsparkmcr. Running az acr login before docker push preserves federated authentication and avoids depending on a Docker registry service connection that is absent from the project. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

azure-pipelines · 2026-07-24T13:56:22Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

github-actions · 2026-07-24T13:56:27Z

Hey @ranadeepsingh 👋!
Thank you so much for contributing to our repository 🙌.
Someone from SynapseML Team will be reviewing this pull request soon.

We use semantic commit messages to streamline the release process.
Before your pull request can be merged, you should make sure your first commit and PR title start with a semantic prefix.
This helps us to create release messages and credit you for your hard work!

Examples of commit messages with semantic prefixes:

fix: Fix LightGBM crashes with empty partitions
feat: Make HTTP on Spark back-offs configurable
docs: Update Spark Serving usage
build: Add codecov support
perf: improve LightGBM memory usage
refactor: make python code generation rely on classes
style: Remove nulls from CNTKModel
test: Add test coverage for CNTKModel

To test your commit locally, please follow our guild on building from source.
Check out the developer guide for additional guidance on testing your change.

github-actions · 2026-07-24T13:56:33Z

Dependency Review Summary

The full dependency review summary was too large to display here (1930KB, limit is 1024KB).

Please download the artifact named "dependency-review-summary" to view the complete report.

View full job summary

ranadeepsingh · 2026-07-24T13:56:38Z

/azp run

azure-pipelines · 2026-07-24T13:56:50Z

Azure Pipelines: Successfully started running 1 pipeline(s).

Copilot

Pull request overview

Restores Docker image publishing in the Azure DevOps pipeline by removing references to a missing/invalid Docker service connection and instead authenticating to the mmlsparkmcr ACR via the existing SynapseML Build WIF service connection, while preserving the existing gating (master-only for dev images; tagged-release-only for release images).

Changes:

Replaced Docker@2 push steps (service connection-based) with AzureCLI@2 steps that run az acr login and docker push.
Kept dev image publishing restricted to master builds with publishDockerImages: true.
Kept release image publishing restricted to master builds where the current commit is tagged with a v* tag and publishDockerImages: true.

Show a summary per file

File	Description
`pipeline.yaml`	Switches ACR authentication/push from a missing Docker service connection to `az acr login` using the existing `SynapseML Build` WIF connection, maintaining publish gating.

Review details

Files reviewed: 1/1 changed files
Comments generated: 0
Review effort level: Low

codecov-commenter · 2026-07-24T14:11:16Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.61%. Comparing base (86a0655) to head (90c8194).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2573      +/-   ##
==========================================
- Coverage   84.79%   84.61%   -0.18%     
==========================================
  Files         334      334              
  Lines       17801    17801              
  Branches     1619     1619              
==========================================
- Hits        15094    15063      -31     
- Misses       2707     2738      +31

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

AB#5467636 ## Summary Use cached Python 3.11 without registry downloads and install Azure CLI 2.88.0 in the shared ADO setup template. ## Prompting Intent Remove the repeated UsePythonVersion GitHub download warning and the Azure CLI 2.60.0 out-of-date warning across SynapseML matrix jobs while preserving every existing pipeline setup and publishing path. ## Linked Sources - ADO bug: https://dev.azure.com/msdata/A365/_workitems/edit/5467636 - Failed ADO build: https://msdata.visualstudio.com/A365/_build/results?buildId=227953126&view=results - Fix PR: #2573 ## Rationale Python 3.8 is no longer cached on the Ubuntu 22.04 hosted image, which forces UsePythonVersion to download anonymously from GitHub. Python 3.11 is cached and supported by Azure CLI 2.88.0, so disabling registry downloads removes the warning without exposing a broad GitHub token to fork PR jobs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

ranadeepsingh · 2026-07-24T14:13:38Z

/azp run

azure-pipelines · 2026-07-24T14:13:49Z

Azure Pipelines: Successfully started running 1 pipeline(s).

AB#5467636 ## Summary Repair the deterministic failures and actionable warnings found in ADO build 228039854. Use WIF-backed Microsoft Entra authentication for Databricks, install the core Python wheel before module tests, tolerate Translator casing changes, retry transient artifact publication, execute website tests in the managed conda environment, preserve Codecov credentials after failed tests, and replace warning-producing Docker build tasks. ## Prompting Intent The engineer asked to fix the remaining errors and warnings in the SynapseML ADO pipeline after moving the shared toolchain to Python 3.11. The pipeline must retain all existing job matrices, Docker build and push paths, publishing paths, and test coverage while removing avoidable warnings rather than hiding real failures. ## Linked Sources - Failed ADO run: https://msdata.visualstudio.com/A365/_build/results?buildId=228039854&view=results - Tracking bug: https://dev.azure.com/msdata/A365/_workitems/edit/5467636 - Pull request: #2573 - Databricks service principal authentication: https://learn.microsoft.com/en-us/azure/databricks/dev-tools/auth/azure-sp ## Rationale Use the existing SynapseML Build workload identity and workspace Contributor role instead of rotating another long-lived Databricks PAT. Make Python tests independent of mutable conda cache contents by installing their local core dependency explicitly. Retry only the idempotent blob publication step for transient Maven failures, and keep Component Governance security alerts visible because they require separate dependency remediation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

AB#5467636 ## Summary Refresh the Databricks and Azure service-management access tokens used by long-running ADO notebook jobs before either token expires. Parse Azure CLI's numeric token expiry, retain authenticated headers only while both tokens have more than five minutes remaining, and serialize refresh so concurrent API calls reuse one valid header set. Preserve PAT authentication for existing local and fallback workflows. ## Prompting Intent The engineer asked to repair all remaining ADO pipeline failures and warnings without introducing breakage, regressions, or security incidents. The final review identified that a Databricks job can run longer than the lifetime of the previously cached Microsoft Entra tokens, so the authentication path needed expiry-aware refresh plus focused tests. ## Linked Sources - ADO bug: https://dev.azure.com/msdata/A365/_workitems/edit/5467636 - Original failing build: https://msdata.visualstudio.com/A365/_build/results?buildId=228039854&view=results - Pull request: #2573 ## Rationale Use the authoritative numeric expires_on value returned by Azure CLI and the earlier expiry of the two required tokens. Refreshing five minutes early avoids late polling and cleanup failures while accommodating clock and request latency. A synchronized proactive refresh was chosen over retrying after HTTP 401 because it avoids failed authenticated operations and leaves all Databricks request behavior unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

AB#5467636 ## Summary Run all three Databricks GPU notebooks sequentially on one cluster instead of starting three GPU clusters concurrently. Keep two GPU workers for distributed execution, place the driver on the well-provisioned CPU instance pool, extend the Databricks job timeout, and add a small client-side polling margin. Add focused tests for separate driver and worker pools, default request compatibility, init-script preservation, and the complete deterministic GPU notebook list. ## Prompting Intent The engineer asked to repair all remaining ADO pipeline errors and warnings without dropping steps or introducing regressions or security incidents. Full validation build 228051299 proved the authentication and prior fixes but exposed regional GPU allocation failures that prevented all three GPU suites from starting. ## Linked Sources - ADO bug: https://dev.azure.com/msdata/A365/_workitems/edit/5467636 - Capacity-failed validation: https://msdata.visualstudio.com/A365/_build/results?buildId=228051299&view=results - Original failing build: https://msdata.visualstudio.com/A365/_build/results?buildId=228039854&view=results - Pull request: #2573 - Azure allocation guidance: https://aka.ms/allocation-guidance ## Rationale Azure Activity Log recorded 25 ZonalAllocationFailed events for Standard_NC6s_v3 while three clusters simultaneously requested nine GPU VMs. The GPU pool had two idle workers and one capacity-blocked pending VM, while the CPU pool had twelve idle nodes. Reusing one cluster with a CPU-pool driver consumes the two available GPU workers, preserves two-worker Horovod and Spark execution, and keeps all three notebooks covered without changing VM families, quotas, or workspace infrastructure. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

AB#5467636 ## Summary Add an explicit public npm registry configuration beside the website package manifest and report intentionally skipped publishing secrets as informational messages instead of warnings. ## Prompting Intent The engineer asked to remove pipeline errors and warnings while preserving real security findings and avoiding regressions. The complete log audit for build 228059575 found the injected supply-chain scanner warning about a missing website/.npmrc in 130 logs and normal publishing-disabled secret messages in 2,748 log entries. ## Linked Sources - ADO bug: https://dev.azure.com/msdata/A365/_workitems/edit/5467636 - Passing validation with warning audit: https://msdata.visualstudio.com/A365/_build/results?buildId=228059575&view=results - Pull request: #2573 - npm scanner guidance: https://aka.ms/cfs/npm ## Rationale Pinning the website package manager to the standard HTTPS npm registry satisfies the supply-chain scanner without adding credentials or changing dependency resolution. Publishing-disabled builds intentionally return empty placeholders, so logging that expected state as information removes noise while leaving actual secret retrieval failures and Component Governance security alerts unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

AB#5467636 ## Summary Use the website native Yarn configuration so the injected CFS detector recognizes the package-manager setup without redirecting public OSS contributors to a private Azure Artifacts feed. Remove invalid blank lines after shell continuation markers in the legacy Spark and Zeppelin mini Dockerfiles so Component Governance can parse them. ## Prompting Intent The engineer asked to repair the ADO pipeline end to end, remove actionable errors and warnings, preserve all pipeline paths, and avoid regressions or security incidents for the public SynapseML repository. ## Linked Sources - ADO bug: https://dev.azure.com/msdata/A365/_workitems/edit/5467636 - Warning validation build: https://msdata.visualstudio.com/A365/_build/results?buildId=228071880 - CFS npm guidance: https://aka.ms/cfs/npm - Component Governance guidance: https://aka.ms/cgbuildtaskdocs ## Rationale Use .yarnrc rather than an Azure Artifacts .npmrc because the website is a Yarn v1 project and external contributors must retain anonymous public dependency access. Fix the malformed Dockerfile continuations rather than excluding directories or suppressing the Docker detector, preserving complete dependency and security scanning. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

ranadeepsingh · 2026-07-24T19:47:54Z

/azp run

azure-pipelines · 2026-07-24T19:48:06Z

Azure Pipelines: Successfully started running 1 pipeline(s).

Copilot

Review details

Files reviewed: 16/17 changed files
Comments generated: 1
Review effort level: Low

AB#5467636 ## Summary Constrain Databricks AAD credentials to the trusted workspace, disable authenticated redirects, add focused auth/cache coverage to the core CI selector, restore Docker provenance metadata, avoid duplicate core wheel installation, and remove the CFS detector blind spot. ## Prompting Intent The maintainer asked to resolve all active PR comments and review findings without pipeline regressions, missed tests, credential leakage, security incidents, or loss of existing build and publish behavior. ## Linked Sources - Pull request: #2573 - Active Codegen review: #2573 (comment) - Pipeline bug: AB#5467636 ## Rationale Exact workspace validation and redirect suppression prevent AAD and management tokens from reaching attacker-controlled destinations. Docker@2 build-only tasks restore traceability labels without reintroducing the missing registry connection. Dynamic sbt task selection preserves module setup while installing core once. The Yarn workaround was removed because hiding a noncompliant public registry is less safe than tracking the required OSS exception or governed production configuration. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

AB#5467636 ## Summary Allow conda jobs and tagged releases to rebuild cleanly when Azure Pipeline Cache restore fails, and remove Docker build warnings exposed by the restored Docker@2 tasks. ## Prompting Intent The maintainer asked to inspect active PR comments and diagnose/fix the failures in ADO build 228091411 without introducing regressions or hiding actionable warnings. ## Linked Sources - Pull request: #2573 - Failed build: https://msdata.visualstudio.com/A365/_build/results?buildId=228091411&view=results - Pipeline bug: AB#5467636 ## Rationale Cache service TLS failures are infrastructure transients and should fall back to a clean environment build rather than aborting one matrix shard. The fallback checks for anything other than a confirmed cache hit and removes partial environments first. Docker quiet mode emits the image ID required by Docker@2 output handling, while corrected ENV and WORKDIR instructions remove BuildKit warnings without changing image tags or publish behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

AB#5467636 ## Summary Fail fast when Databricks cluster startup enters a terminal state and retry only Azure GPU resource stockouts. Use two GPU workers initially, fall back to one worker on bounded retries, and clean up failed clusters without masking the original failure. ## Prompting Intent The engineer asked to review active PR feedback and diagnose the latest ADO pipeline failures, then fix repository-owned issues without slowing normal tests, masking regressions, weakening security, or leaking credentials. ## Linked Sources - Pull request: #2573 - Failed ADO validation: https://msdata.visualstudio.com/A365/_build/results?buildId=228096155&view=results - Tracking bug: https://dev.azure.com/msdata/A365/_workitems/edit/5467636 ## Rationale The failed run was caused by CLOUD_PROVIDER_RESOURCE_STOCKOUT rather than notebook behavior. Retrying only that exact termination code avoids hiding product or test failures, while the one-worker fallback reduces scarce GPU allocation pressure. Startup orchestration is isolated in a package-private helper so cleanup, timeout, and retry behavior can be unit tested without changing authentication or public APIs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

AB#5469322 ## Summary Load only the Codecov token immediately before coverage upload instead of loading the complete build Key Vault before unit tests. Restore the readability spacing that was unintentionally removed from the legacy Helm Dockerfiles. ## Prompting Intent The engineer asked for a file-by-file review of the stacked pipeline changes, with particular attention to secret leakage, unnecessary changes, the conda cache condition, publishing log levels, and preservation of Dockerfile readability. ## Linked Sources - Website security bug: https://dev.azure.com/msdata/A365/_workitems/edit/5469322 - Pipeline repair bug: https://dev.azure.com/msdata/A365/_workitems/edit/5467636 - Stacked pull request: microsoft#2574 - Parent pipeline repair: microsoft#2573 - Full ADO validation: https://msdata.visualstudio.com/A365/_build/results?buildId=228133377&view=results ## Rationale The earlier Key Vault placement ensured Codecov could upload after a failed test, but it also made every vault secret available before arbitrary unit-test execution. A late AzureKeyVault task with succeededOrFailed preserves failure uploads while filtering access to codecov-token only. The Helm blank-line removals had no functional or warning-related benefit, so restoring them keeps the original visual grouping without changing image behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: modernize website dependency security AB#5469322 ## Summary Replace the legacy Yarn and Docusaurus 2 website toolchain with Node 20, npm, Docusaurus 3, and React 18. Add targeted dependency overrides, a portable SHA-512 package lock, MDX 3 compatibility handling and tests, and checksum verification for the pinned Codecov CLI. ## Prompting Intent The engineer asked for a deeply reviewed follow-up to the ADO pipeline repair that resolves the website/yarn.lock security backlog without reducing test coverage, introducing regressions, leaking credentials, or weakening supply-chain protections. ## Linked Sources - ADO Bug 5469322: https://dev.azure.com/msdata/A365/_workitems/edit/5469322 - Parent pipeline repair PR: #2573 - Component Governance build: https://msdata.visualstudio.com/A365/_build/results?buildId=228104679&view=results - Residual upstream advisory: GHSA-mh99-v99m-4gvg ## Rationale The legacy dependency graph could not be remediated safely with isolated transitive bumps, so the website was moved to the current supported Docusaurus and React generations. npm provides a deterministic lock and CI-native cache; the committed lock omits environment-specific registry URLs and verifies every registry artifact with SHA-512. A tested preprocessor preserves historical documentation while adapting only legacy MDX constructs outside fenced code. Codecov is pinned and checksum-verified rather than downloaded from a mutable latest URL. The remaining brace-expansion advisory has no compatible upstream fix and is limited to trusted static-server glob configuration, so no risky vendored fork or node_modules mutation was introduced. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: narrow Codecov secret scope AB#5469322 ## Summary Load only the Codecov token immediately before coverage upload instead of loading the complete build Key Vault before unit tests. Restore the readability spacing that was unintentionally removed from the legacy Helm Dockerfiles. ## Prompting Intent The engineer asked for a file-by-file review of the stacked pipeline changes, with particular attention to secret leakage, unnecessary changes, the conda cache condition, publishing log levels, and preservation of Dockerfile readability. ## Linked Sources - Website security bug: https://dev.azure.com/msdata/A365/_workitems/edit/5469322 - Pipeline repair bug: https://dev.azure.com/msdata/A365/_workitems/edit/5467636 - Stacked pull request: #2574 - Parent pipeline repair: #2573 - Full ADO validation: https://msdata.visualstudio.com/A365/_build/results?buildId=228133377&view=results ## Rationale The earlier Key Vault placement ensured Codecov could upload after a failed test, but it also made every vault secret available before arbitrary unit-test execution. A late AzureKeyVault task with succeededOrFailed preserves failure uploads while filtering access to codecov-token only. The Helm blank-line removals had no functional or warning-related benefit, so restoring them keeps the original visual grouping without changing image behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

ranadeepsingh · 2026-07-26T01:24:11Z

/azp run

azure-pipelines · 2026-07-26T01:24:22Z

Azure Pipelines: Successfully started running 1 pipeline(s).

## Summary Upgrade the official GitHub Actions used by validation, security, and website workflows to their latest Node 24-compatible releases, pin them by immutable commit SHA, and set the website runtime floor to Node 24 LTS. ## Prompting Intent The engineer asked to remove the Node 20 deprecation warnings from the dependency check and use the latest stable Node line to stay ahead of action and dependency runtime issues. ## Linked Sources - PR #2573: #2573 - GitHub Node 20 deprecation notice: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/ - actions/checkout v7.0.1: https://github.com/actions/checkout/releases/tag/v7.0.1 - actions/setup-node v7.0.0: https://github.com/actions/setup-node/releases/tag/v7.0.0 - dependency-review-action v5.0.0: https://github.com/actions/dependency-review-action/releases/tag/v5.0.0 ## Rationale Node 24 is the current LTS release; Node 26 is still a Current release and is not the appropriate production CI baseline yet. Updating the actions themselves is required because setup-node does not control an action embedded runtime. Full SHA pins preserve supply-chain integrity. The dependency review severity policy remains unchanged, so this removes runtime warnings without suppressing the separate brace-expansion advisory. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

AB#5469322 ## Summary Allow only GHSA-mh99-v99m-4gvg in Dependency Review while preserving the repository-wide High-severity failure threshold and documenting the conditions for removing the exception. ## Prompting Intent The engineer asked to inspect the failing dependency-review feedback and fix the actionable items without introducing dependency breakage or weakening security checks broadly. ## Linked Sources - Dependency Review run: https://github.com/microsoft/SynapseML/actions/runs/30182951285/job/89742582894?pr=2573 - PR #2573: #2573 - Advisory: GHSA-mh99-v99m-4gvg - Docusaurus serve implementation: https://github.com/facebook/docusaurus/blob/v3.10.2/packages/docusaurus/src/commands/serve.ts - Tracking bug: https://dev.azure.com/msdata/A365/_workitems/edit/5469322 ## Rationale The run contains one blocking vulnerability and 181 informational OpenSSF scorecard warnings. No compatible upstream release exists: brace-expansion 5.0.8 changes the CommonJS API expected by serve-handler minimatch 3. Docusaurus invokes serve-handler without glob-based rewrites, redirects, headers, or listing patterns, so untrusted input cannot reach the vulnerable expansion path. A single tracked GHSA exception is safer than a breaking override or disabling High-severity enforcement. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 24, 2026 13:56

Copilot started reviewing on behalf of ranadeepsingh July 24, 2026 13:56 View session

Copilot AI reviewed Jul 24, 2026

View reviewed changes

ranadeepsingh added the area/build label Jul 24, 2026

ranadeepsingh changed the title ~~fix: restore Azure pipeline Docker authentication~~ fix: restore Azure pipeline Docker authentication AB#5467636 Jul 24, 2026

ranadeepsingh and others added 5 commits July 24, 2026 08:32

ranadeepsingh changed the title ~~fix: restore Azure pipeline Docker authentication AB#5467636~~ fix: restore Azure pipeline Docker authentication Jul 24, 2026

ranadeepsingh commented Jul 24, 2026

View reviewed changes

Comment thread ...itive/src/test/scala/com/microsoft/azure/synapse/ml/services/translate/TranslatorSuite.scala

ranadeepsingh requested a review from Copilot July 24, 2026 19:52

Copilot started reviewing on behalf of ranadeepsingh July 24, 2026 19:53 View session

Copilot started work on behalf of ranadeepsingh July 24, 2026 19:53 View session

Copilot finished work on behalf of ranadeepsingh July 24, 2026 19:54

Copilot AI reviewed Jul 24, 2026

View reviewed changes

Comment thread project/CodegenPlugin.scala Outdated

ranadeepsingh and others added 2 commits July 24, 2026 15:18

ranadeepsingh mentioned this pull request Jul 25, 2026

fix: modernize website dependency security #2574

Merged

5 tasks

ranadeepsingh and others added 2 commits July 25, 2026 18:28

Uh oh!

Conversation

ranadeepsingh commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue

Fix

Pipeline coverage audit

Validation

Tracking

Post-merge review status

Tracked dependency exception

Uh oh!

azure-pipelines Bot commented Jul 24, 2026

Uh oh!

github-actions Bot commented Jul 24, 2026

Uh oh!

github-actions Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review Summary

Uh oh!

ranadeepsingh commented Jul 24, 2026

Uh oh!

azure-pipelines Bot commented Jul 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

codecov-commenter commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ranadeepsingh commented Jul 24, 2026

Uh oh!

azure-pipelines Bot commented Jul 24, 2026

Uh oh!

ranadeepsingh commented Jul 24, 2026

Uh oh!

azure-pipelines Bot commented Jul 24, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

ranadeepsingh commented Jul 26, 2026

Uh oh!

azure-pipelines Bot commented Jul 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ranadeepsingh commented Jul 24, 2026 •

edited

Loading

github-actions Bot commented Jul 24, 2026 •

edited

Loading

codecov-commenter commented Jul 24, 2026 •

edited

Loading