chore: upgrade all dependencies with vulnerabilities

[Copilot]

Upgrades direct dependencies in package.json files to fix transitive vulnerability issues, and refreshes the lockfile via conservative rush update.

Changes Made

• copy-webpack-plugin ^13.0.0 → ^14.0.0 in packages/apps/autorest/package.json and packages/extensions/core/package.json (fixes serialize-javascript RCE vulnerability)
• node-gyp ^10.0.1 → ^11.0.0 in packages/tools/compare/package.json (fixes tar path traversal vulnerabilities)
• Regenerated pnpm-lock.yaml using conservative rush update (not --full) to preserve TypeSpec dependency versions and avoid breaking openapi-to-typespec tests

Vulnerabilities Fixed

Package	Old Version	New Version	Vulnerability
serialize-javascript	6.0.2	7.0.5	RCE via RegExp.flags
tar	6.2.1	7.4.3	Path Traversal (multiple CVEs)

Testing

• ✅ Build passes (all 22 operations successful)
• ✅ oai2-to-oai3 and core unit tests pass
• ✅ openapi-to-typespec generate:validate produces clean output
• ✅ Code review passed
• ✅ CodeQL security scan passed

[azure-pipelines]

You may test this build by running autorest --reset and then either:

---

Add the following CLI flags

Pacakge	Flag	Description
@autorest/core	--version:https://tinyurl.com/2c2et3nx	For changes to autorest core.
@autorest/modelerfour	--use:https://tinyurl.com/2adj27yv	For changes to modelerfour.

Or with all

autorest --version:https://tinyurl.com/2c2et3nx --use:https://tinyurl.com/2adj27yv

---

or use the following in your autorest configuration:

# For changes to autorest core
version: "https://tinyurl.com/2c2et3nx"

# For changes to modelerfour
use-extension:
  "@autorest/modelerfour": "https://tinyurl.com/2adj27yv"

---

If this build is good for you, give this comment a thumbs up. (👍) And you should run `autorest --reset` again once you're finished testing to remove it.

[timotheeguerin]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[timotheeguerin]

@copilot the test are failing in openapi converter

[Copilot]

@copilot the test are failing in openapi converter

The issue was that rush update --full re-resolved all transitive dependencies, bumping @typespec/compiler from 1.5.0 to 1.11.0 and @azure-tools/typespec-azure-resource-manager from 0.61.0 to 0.61.1, which introduced breaking template changes in private-endpoints.tsp. Fixed by using conservative rush update --purge instead to only update what's needed for the direct dependency changes while preserving TypeSpec versions. Commit: 26bbccd

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dev.azure.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[azure-pipelines]

You may test this build by running autorest --reset and then either:

---

Add the following CLI flags

Pacakge	Flag	Description
@autorest/core	--version:https://tinyurl.com/2bztwegr	For changes to autorest core.
@autorest/modelerfour	--use:https://tinyurl.com/265zrh64	For changes to modelerfour.

Or with all

autorest --version:https://tinyurl.com/2bztwegr --use:https://tinyurl.com/265zrh64

---

or use the following in your autorest configuration:

# For changes to autorest core
version: "https://tinyurl.com/2bztwegr"

# For changes to modelerfour
use-extension:
  "@autorest/modelerfour": "https://tinyurl.com/265zrh64"

---

If this build is good for you, give this comment a thumbs up. (👍) And you should run `autorest --reset` again once you're finished testing to remove it.

[azure-pipelines]

You may test this build by running autorest --reset and then either:

---

Add the following CLI flags

Pacakge	Flag	Description
@autorest/core	--version:https://tinyurl.com/28caxvca	For changes to autorest core.
@autorest/modelerfour	--use:https://tinyurl.com/2dbufl9g	For changes to modelerfour.

Or with all

autorest --version:https://tinyurl.com/28caxvca --use:https://tinyurl.com/2dbufl9g

---

or use the following in your autorest configuration:

# For changes to autorest core
version: "https://tinyurl.com/28caxvca"

# For changes to modelerfour
use-extension:
  "@autorest/modelerfour": "https://tinyurl.com/2dbufl9g"

---

If this build is good for you, give this comment a thumbs up. (👍) And you should run `autorest --reset` again once you're finished testing to remove it.