Bump dependencies

[William Wong (compulim)]

Changelog Entry

• Bumped all dependencies to the latest versions, by @compulim in PR #5427 and PR #5529
  • Production dependencies
    • @babel/runtime@7.28.2
    • botframework-directlinejs@0.15.6
    • core-js-pure@3.44.0
    • core-js@3.44.0
    • event-as-promise@2.0.0
    • iter-fest@0.3.0
    • katex@0.16.22
    • mdast-util-from-markdown@2.0.2
    • merge-refs@2.0.0
    • micromark-extension-gfm@3.0.0
    • micromark-util-character@2.1.1
    • micromark@4.0.2
    • microsoft-cognitiveservices-speech-sdk@1.45.0
    • mime@4.0.7
    • react-chain-of-responsibility@0.3.0
    • react-say@2.2.0
    • react-scroll-to-bottom@4.2.0
    • react-wrap-with@0.1.0
    • sanitize-html@2.17.0
    • shiki@2.5.0
    • use-propagate@0.2.1
    • use-ref-from@0.1.0
    • use-state-with-ref@0.1.0
    • valibot@1.1.0
    • web-speech-cognitive-services@8.1.1
  • Development dependencies
    • @babel/cli@7.28.0
    • @babel/core@7.28.0
    • @babel/plugin-transform-runtime@7.28.0
    • @babel/plugin-transform-typescript@7.28.0
    • @babel/preset-env@7.28.0
    • @babel/preset-react@7.27.1
    • @babel/preset-typescript@7.27.1
    • @babel/runtime@7.28.2
    • @biomejs/biome@2.1.3
    • @emotion/css@11.13.5
    • @happy-dom/jest-environment@18.0.1
    • @jridgewell/sourcemap-codec@1.5.4
    • @types/dom-speech-recognition@0.0.6
    • @types/jest@29.5.14
    • @types/mdast@4.0.4
    • @types/node@24.1.0
    • @types/react-dom@16.9.25
    • @types/react@16.14.65
    • @typescript-eslint/eslint-plugin@8.38.0
    • @typescript-eslint/parser@8.38.0
    • adm-zip@0.5.16
    • axe-core@4.10.3
    • babel-jest@29.7.0
    • babel-plugin-istanbul@7.0.0
    • bent@7.3.12
    • botframework-directlinejs@0.15.6
    • compression@1.8.1
    • concurrently@9.2.0
    • core-js-pure@3.44.0
    • core-js@3.44.0
    • cross-env@10.0.0
    • dotenv@17.2.1
    • esbuild@0.25.8
    • eslint-config-prettier@10.1.8
    • eslint-plugin-import@2.32.0
    • eslint-plugin-prettier@5.5.3
    • eslint-plugin-react-hooks@5.2.0
    • eslint-plugin-react@7.37.5
    • eslint-plugin-security@3.0.1
    • eslint@8.57.1
    • express@5.1.0
    • glob@8.1.0
    • http-proxy-middleware@2.0.9
    • husky@9.1.7
    • jest-environment-node@29.7.0
    • jest-image-snapshot@6.5.1
    • jest@29.7.0
    • lint-staged@16.1.2
    • micromark-util-types@2.0.2
    • microsoft-cognitiveservices-speech-sdk@1.45.0
    • nodemon@3.1.10
    • nopt@8.1.0
    • prettier@3.6.2
    • progress@2.0.3
    • q@1.5.1
    • read-pkg-up@11.0.0
    • read-pkg@9.0.1
    • request-progress@3.0.0
    • request@2.88.2
    • selenium-webdriver@4.34.0
    • selfsigned@3.0.1
    • serve-handler@6.1.6
    • serve@14.2.4
    • tsd@0.32.0
    • tsup@8.5.0
    • type-fest@4.41.0
    • typescript-plugin-css-modules@5.2.0
    • typescript@5.8.3
    • webpack-cli@6.0.1
    • webpack@5.101.0

Description

Bump dependencies.

Design

Specific Changes

• npm run bump
• Removed pinDependencies of Babel
  • Certain combination of Babel and Jest are causing OOM
• Pinned to jest@29 because jest-image-snapshot@6.5.1 does not support jest@30 yet
• Removed node-fetch as most Node.js engine supports fetch, also removed dependency to vulnerable dependencies
• Updated test snapshots to meet jest@29

• I have added tests and executed them locally
• I have updated CHANGELOG.md
• I have updated documentation

Review Checklist

This section is for contributors to review your work.

• Accessibility reviewed (tab order, content readability, alt text, color contrast)
• Browser and platform compatibilities reviewed
• CSS styles reviewed (minimal rules, no z-index)
• Documents reviewed (docs, samples, live demo)
• Internationalization reviewed (strings, unit formatting)
• package.json and package-lock.json reviewed
• Security reviewed (no data URIs, check for nonce leak)
• Tests reviewed (coverage, legitimacy)

[Copilot]

Pull Request Overview

This PR bumps all dependencies to their latest versions, modernizing the build tools and security posture while removing vulnerable dependencies.

• Updates production dependencies including Babel runtime, core-js, and cognitive services SDK
• Updates development dependencies including Jest, ESLint, and build tools to latest versions
• Removes node-fetch dependency in favor of native fetch API support

Reviewed Changes

Copilot reviewed 94 out of 104 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
package.json	Updated root dev dependencies and removed Babel version pinning
tsup.base.config.ts	Fixed regex patterns for ESBuild compatibility
Various package.json files	Removed node-fetch dependencies and updated pinned versions
Test files	Updated Jest snapshots to match new format
Source files	Fixed TypeScript types and updated imports

Files not reviewed (7)

• samples/01.getting-started/k.direct-line-token/javascript/web/package-lock.json: Language not supported
• samples/07.advanced-web-chat-apps/a.upload-to-azure-storage/web/package-lock.json: Language not supported
• samples/07.advanced-web-chat-apps/b.sso-for-enterprise/rest-api/package-lock.json: Language not supported
• samples/07.advanced-web-chat-apps/c.sso-for-intranet/web/package-lock.json: Language not supported
• samples/07.advanced-web-chat-apps/d.sso-for-teams/web/package-lock.json: Language not supported
• samples/07.advanced-web-chat-apps/e.sso-on-behalf-of-authentication/rest-api/package-lock.json: Language not supported
• samples/package-lock.json: Language not supported