chore(deps): Consolidate 11 safe dependabot dependency updates (#167)

goergenj · dependabot[bot] · web-flow · commit 9ef28fa18c52 · 2026-04-07T14:12:40.000-07:00
* Add build test scripts and dependabot PR processing skill - tests/build-all.ps1: orchestrator for all languages - tests/build-javascript.ps1: npm build/node --check for JS/TS projects - tests/build-java.ps1: mvn compile for Java projects - tests/build-csharp.ps1: dotnet build for C# projects - .github/skills/dependabot-pr-processing/SKILL.md: classification guide * Bump Azure.AI.Projects and Azure.Identity Bumps Azure.AI.Projects from 1.0.0-beta.8 to 2.0.0 Bumps Azure.Identity from 1.13.2 to 1.20.0 --- updated-dependencies: - dependency-name: Azure.AI.Projects dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major - dependency-name: Azure.Identity dependency-version: 1.20.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump com.azure:azure-identity Bumps the maven group with 1 update in the /java/voice-live-quickstarts/MCPQuickstart directory: [com.azure:azure-identity](https://github.com/Azure/azure-sdk-for-java). Updates `com.azure:azure-identity` from 1.11.0 to 1.12.2 - [Release notes](https://github.com/Azure/azure-sdk-for-java/releases) - [Commits](Azure/azure-sdk-for-java@azure-core_1.11.0...azure-identity_1.12.2) --- updated-dependencies: - dependency-name: com.azure:azure-identity dependency-version: 1.12.2 dependency-type: direct:production dependency-group: maven ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump com.azure:azure-identity Bumps [com.azure:azure-identity](https://github.com/Azure/azure-sdk-for-java) from 1.11.0 to 1.18.2. - [Release notes](https://github.com/Azure/azure-sdk-for-java/releases) - [Commits](Azure/azure-sdk-for-java@azure-core_1.11.0...com.azure+azure-identity_1.18.2) --- updated-dependencies: - dependency-name: com.azure:azure-identity dependency-version: 1.18.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps-dev): bump eslint-config-next Bumps [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) from 16.1.6 to 16.2.2. - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](https://github.com/vercel/next.js/commits/v16.2.2/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.2.2 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps-dev): bump eslint-config-next Bumps [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) from 16.1.0 to 16.2.2. - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](https://github.com/vercel/next.js/commits/v16.2.2/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.2.2 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps-dev): bump @types/node Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 24.12.2 to 25.5.2. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.5.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps-dev): bump @types/node in /javascript/voice-live-trader-demo Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 20.19.39 to 25.5.2. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.5.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps-dev): bump @types/node Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 20.19.39 to 25.5.2. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.5.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump dotenv Bumps [dotenv](https://github.com/motdotla/dotenv) from 16.6.1 to 17.4.0. - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v16.6.1...v17.4.0) --- updated-dependencies: - dependency-name: dotenv dependency-version: 17.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump dotenv in /voice-live-universal-assistant/javascript Bumps [dotenv](https://github.com/motdotla/dotenv) from 16.6.1 to 17.4.0. - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v16.6.1...v17.4.0) --- updated-dependencies: - dependency-name: dotenv dependency-version: 17.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump dotenv Bumps [dotenv](https://github.com/motdotla/dotenv) from 16.6.1 to 17.4.0. - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v16.6.1...v17.4.0) --- updated-dependencies: - dependency-name: dotenv dependency-version: 17.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
diff --git a/.github/skills/dependabot-pr-processing/SKILL.md b/.github/skills/dependabot-pr-processing/SKILL.md
@@ -0,0 +1,80 @@
+---
+applyTo: '**'
+---
+
+# Dependabot PR Processing Skill
+
+Process dependabot pull requests efficiently by classifying them as safe (auto-merge after compile test) or manual (requires runtime/audio testing).
+
+## Classification Rules
+
+### Safe to auto-merge (compile-only verification)
+These packages do NOT touch audio/voice event handling or runtime behavior:
+
+- **devDependencies** (never shipped): `eslint`, `eslint-config-*`, `@types/*`, `typescript`, `prettier`, lint plugins
+- **Auth-only SDKs**: `Azure.Identity` (C#), `azure-identity` (Java), `@azure/identity` (JS) — HTTP/auth layer only
+- **Project management SDKs**: `Azure.AI.Projects` — control-plane only
+- **Environment loading**: `dotenv` — startup config only
+
+### Requires manual voice/event testing
+These packages participate in the audio/voice event pipeline:
+
+- **Voice SDKs**: `azure-ai-voicelive` (any language), `@azure/ai-voicelive`
+- **Core event libraries**: `azure-core` (Java) — provides `BinaryData`, reactive streams, WebSocket framing used by voice SDK
+- **Runtime frameworks**: `next`, `express`, `spring-boot-starter-parent` — SSR/WebSocket/server behavior changes
+- **UI component libraries with runtime impact**: `lucide-react`, `@fluentui/react-components`, `react`, `react-dom`
+
+### Close without merge (do manually as coordinated upgrade)
+Major version bumps that likely have breaking changes:
+
+- Any **major version** bump (e.g., vite 5→8, TypeScript 5→6, ESLint 9→10, Tailwind 3→4, Spring Boot 3→4)
+- Check the migration guide first — if mechanical, can be batched
+
+## Processing Workflow
+
+### Step 1: Classify
+For each open dependabot PR, determine:
+1. Is it a devDependency or runtime dependency?
+2. Does it touch the voice/event pipeline? (Check imports in source files for `azure-core`, `BinaryData`, `VoiceLiveAsyncClient`, etc.)
+3. Is it a major version bump?
+
+### Step 2: Handle safe PRs
+1. Create a branch from main: `chore/dependabot-safe-updates`
+2. For each safe PR, merge its branch into the working branch
+3. Run the build tests: `./tests/build-all.ps1`
+4. If builds pass, push and create a single PR
+5. After merge, the individual dependabot PRs auto-close (or close manually)
+
+### Step 3: Consolidate manual-test PRs
+1. Group related manual-test PRs by project/ecosystem
+2. Create a single branch: `chore/dependabot-manual-review`
+3. Apply all changes
+4. Create a PR with a checklist of what needs manual voice/audio testing
+5. Close individual dependabot PRs with comment: "Consolidated into PR #N"
+
+### Step 4: Close major-bump PRs
+Close with comment explaining the major version needs a coordinated manual upgrade.
+
+## Build Test Commands
+
+Run from repo root:
+
+```powershell
+# Test everything
+./tests/build-all.ps1
+
+# Test specific language
+./tests/build-all.ps1 -Language javascript
+./tests/build-all.ps1 -Language java
+./tests/build-all.ps1 -Language csharp
+
+# Test specific projects
+./tests/build-all.ps1 -Projects @("javascript/voice-live-avatar")
+```
+
+## Build Quirks
+- JS quickstarts have no build scripts — use `npm ci && node --check <file>.js`
+- Java AgentsNewQuickstart uses non-standard `pom-agent.xml`
+- Java ModelQuickstart has `<sourceDirectory>.</sourceDirectory>` (sources in root)
+- C# projects target mixed frameworks: `net8.0` and `net9.0`
+- `voice-live-universal-assistant/javascript` is runtime-only (Express), no build step — `npm ci` is sufficient
diff --git a/csharp/voice-live-quickstarts/AgentsNewQuickstart/VoiceLiveWithAgent.csproj b/csharp/voice-live-quickstarts/AgentsNewQuickstart/VoiceLiveWithAgent.csproj
@@ -16,8 +16,8 @@
 
   <ItemGroup>
     <PackageReference Include="Azure.AI.VoiceLive" Version="1.1.0-beta.3" />
-    <PackageReference Include="Azure.AI.Projects" Version="1.0.0-beta.8" />
-    <PackageReference Include="Azure.Identity" Version="1.13.2" />
+    <PackageReference Include="Azure.AI.Projects" Version="2.0.0" />
+    <PackageReference Include="Azure.Identity" Version="1.20.0" />
     <PackageReference Include="NAudio" Version="2.2.1" />
   </ItemGroup>
 
diff --git a/java/voice-live-quickstarts/MCPQuickstart/pom.xml b/java/voice-live-quickstarts/MCPQuickstart/pom.xml
@@ -37,7 +37,7 @@
         <dependency>
             <groupId>com.azure</groupId>
             <artifactId>azure-identity</artifactId>
-            <version>1.11.0</version>
+            <version>1.12.2</version>
         </dependency>
 
         <!-- Reactor Core for reactive programming -->
diff --git a/java/voice-live-quickstarts/ModelQuickstart/pom.xml b/java/voice-live-quickstarts/ModelQuickstart/pom.xml
@@ -37,7 +37,7 @@
         <dependency>
             <groupId>com.azure</groupId>
             <artifactId>azure-identity</artifactId>
-            <version>1.11.0</version>
+            <version>1.18.2</version>
         </dependency>
 
         <!-- Reactor Core for reactive programming -->
diff --git a/javascript/basic-web-voice-assistant/package.json b/javascript/basic-web-voice-assistant/package.json
@@ -18,7 +18,7 @@
     "@azure/core-auth": "^1.9.0"
   },
   "devDependencies": {
-    "@types/node": "^20.0.0",
+    "@types/node": "^25.5.2",
     "typescript": "^5.0.0",
     "vite": "^5.0.0"
   },
diff --git a/javascript/voice-live-avatar/package.json b/javascript/voice-live-avatar/package.json
@@ -40,7 +40,7 @@
     "@types/react-dom": "^19",
     "baseline-browser-mapping": "^2.9.19",
     "eslint": "^9.39.2",
-    "eslint-config-next": "16.1.6",
+    "eslint-config-next": "16.2.2",
     "postcss": "^8",
     "prettier": "^3.8.1",
     "tailwindcss": "^4.1.18",
diff --git a/javascript/voice-live-interpreter-demo/package.json b/javascript/voice-live-interpreter-demo/package.json
@@ -18,7 +18,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.39.1",
-    "@types/node": "^24.10.4",
+    "@types/node": "^25.5.2",
     "@types/react": "^19.2.5",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^4.3.0",
diff --git a/javascript/voice-live-quickstarts/AgentsNewQuickstart/package.json b/javascript/voice-live-quickstarts/AgentsNewQuickstart/package.json
@@ -7,7 +7,7 @@
     "@azure/ai-voicelive": "1.0.0-beta.3",
     "@azure/ai-agents": "1.2.0-beta.2",
     "@azure/identity": "^4.6.0",
-    "dotenv": "^16.4.7"
+    "dotenv": "^17.4.0"
   },
   "optionalDependencies": {
     "node-record-lpcm16": "^1.0.1",
diff --git a/javascript/voice-live-quickstarts/ModelQuickstart/package.json b/javascript/voice-live-quickstarts/ModelQuickstart/package.json
@@ -7,7 +7,7 @@
     "@azure/ai-voicelive": "1.0.0-beta.3",
     "@azure/core-auth": "^1.9.0",
     "@azure/identity": "^4.6.0",
-    "dotenv": "^16.4.7"
+    "dotenv": "^17.4.0"
   },
   "optionalDependencies": {
     "node-record-lpcm16": "^1.0.1",
diff --git a/javascript/voice-live-trader-demo/package.json b/javascript/voice-live-trader-demo/package.json
@@ -17,11 +17,11 @@
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4",
-    "@types/node": "^20",
+    "@types/node": "^25",
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "eslint": "^9",
-    "eslint-config-next": "16.1.0",
+    "eslint-config-next": "16.2.2",
     "tailwindcss": "^4",
     "typescript": "^5"
   }
diff --git a/tests/build-all.ps1 b/tests/build-all.ps1
@@ -0,0 +1,72 @@
+#!/usr/bin/env pwsh
+<#
+.SYNOPSIS
+    Build-test all projects across JavaScript, Java, and C#.
+.DESCRIPTION
+    Orchestrates build tests for all sample projects in the repo.
+    Useful for validating dependency updates (e.g., dependabot PRs).
+.PARAMETER Language
+    Optional filter: "javascript", "java", "csharp", or "all" (default).
+.PARAMETER Projects
+    Optional array of specific project paths to test (passed through to per-language scripts).
+.EXAMPLE
+    ./tests/build-all.ps1
+    ./tests/build-all.ps1 -Language javascript
+    ./tests/build-all.ps1 -Projects @("javascript/voice-live-avatar", "csharp/voice-live-quickstarts/AgentsNewQuickstart")
+#>
+param(
+    [ValidateSet("all", "javascript", "java", "csharp")]
+    [string]$Language = "all",
+
+    [string[]]$Projects
+)
+
+$ErrorActionPreference = "Continue"
+$scriptDir = $PSScriptRoot
+$totalFailed = 0
+
+function Invoke-BuildScript {
+    param([string]$ScriptName, [string[]]$ProjectFilter)
+
+    $scriptPath = Join-Path $scriptDir $ScriptName
+    if (-not (Test-Path $scriptPath)) {
+        Write-Host "ERROR: Script not found: $scriptPath" -ForegroundColor Red
+        return 1
+    }
+
+    if ($ProjectFilter) {
+        & $scriptPath -Projects $ProjectFilter
+    }
+    else {
+        & $scriptPath
+    }
+    return $LASTEXITCODE
+}
+
+Write-Host "========================================" -ForegroundColor Magenta
+Write-Host "Build All - Dependency Validation" -ForegroundColor Magenta
+Write-Host "Language: $Language" -ForegroundColor Magenta
+Write-Host "========================================" -ForegroundColor Magenta
+
+if ($Language -in @("all", "javascript")) {
+    $totalFailed += (Invoke-BuildScript "build-javascript.ps1" $Projects)
+}
+
+if ($Language -in @("all", "java")) {
+    $totalFailed += (Invoke-BuildScript "build-java.ps1" $Projects)
+}
+
+if ($Language -in @("all", "csharp")) {
+    $totalFailed += (Invoke-BuildScript "build-csharp.ps1" $Projects)
+}
+
+Write-Host "`n========================================" -ForegroundColor Magenta
+if ($totalFailed -eq 0) {
+    Write-Host "ALL BUILDS PASSED" -ForegroundColor Green
+}
+else {
+    Write-Host "BUILDS FAILED: $totalFailed project(s)" -ForegroundColor Red
+}
+Write-Host "========================================" -ForegroundColor Magenta
+
+exit $totalFailed
diff --git a/tests/build-csharp.ps1 b/tests/build-csharp.ps1
@@ -0,0 +1,88 @@
+#!/usr/bin/env pwsh
+<#
+.SYNOPSIS
+    Build-test all C# projects in the repo.
+.DESCRIPTION
+    Runs dotnet build for each C# project.
+    Returns exit code 0 if all pass, 1 if any fail.
+.PARAMETER Projects
+    Optional array of project directory paths (relative to repo root) to test.
+    If omitted, tests all known C# projects.
+#>
+param(
+    [string[]]$Projects
+)
+
+$ErrorActionPreference = "Continue"
+$repoRoot = (git rev-parse --show-toplevel).Trim()
+
+$allProjects = @(
+    @{ Path = "csharp/CustomerServiceBot";                              CsProj = "CustomerServiceBot.csproj" }
+    @{ Path = "csharp/voice-live-quickstarts/ModelQuickstart";          CsProj = "csharp.csproj" }
+    @{ Path = "csharp/voice-live-quickstarts/MCPQuickstart";            CsProj = "MCPQuickstart.csproj" }
+    @{ Path = "csharp/voice-live-quickstarts/AgentsNewQuickstart";      CsProj = "VoiceLiveWithAgent.csproj" }
+    @{ Path = "csharp/voice-live-quickstarts/BringYourOwnModelQuickstart"; CsProj = "csharp.csproj" }
+    @{ Path = "csharp/voice-live-quickstarts/AgentQuickstart";          CsProj = "csharp.csproj" }
+    @{ Path = "voice-live-universal-assistant/csharp";                   CsProj = "VoiceLiveWebApp.csproj" }
+)
+
+if ($Projects) {
+    $allProjects = $allProjects | Where-Object { $Projects -contains $_.Path }
+}
+
+$results = @()
+$failed = 0
+
+foreach ($project in $allProjects) {
+    $projectDir = Join-Path $repoRoot $project.Path
+    if (-not (Test-Path $projectDir)) {
+        Write-Host "SKIP: $($project.Path) (directory not found)" -ForegroundColor Yellow
+        continue
+    }
+
+    $csprojPath = Join-Path $projectDir $project.CsProj
+    if (-not (Test-Path $csprojPath)) {
+        Write-Host "SKIP: $($project.Path) ($($project.CsProj) not found)" -ForegroundColor Yellow
+        continue
+    }
+
+    Write-Host "`n========================================" -ForegroundColor Cyan
+    Write-Host "Testing: $($project.Path) [dotnet build $($project.CsProj)]" -ForegroundColor Cyan
+    Write-Host "========================================" -ForegroundColor Cyan
+
+    Push-Location $projectDir
+    $success = $true
+
+    try {
+        dotnet build $project.CsProj --verbosity quiet --nologo 2>&1
+        if ($LASTEXITCODE -ne 0) { $success = $false }
+    }
+    catch {
+        $success = $false
+        Write-Host "ERROR: $_" -ForegroundColor Red
+    }
+    finally {
+        Pop-Location
+    }
+
+    if ($success) {
+        Write-Host "PASS: $($project.Path)" -ForegroundColor Green
+        $results += @{ Project = $project.Path; Status = "PASS" }
+    }
+    else {
+        Write-Host "FAIL: $($project.Path)" -ForegroundColor Red
+        $results += @{ Project = $project.Path; Status = "FAIL" }
+        $failed++
+    }
+}
+
+Write-Host "`n========================================" -ForegroundColor Cyan
+Write-Host "C# Build Results" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+foreach ($r in $results) {
+    $color = if ($r.Status -eq "PASS") { "Green" } else { "Red" }
+    Write-Host "  $($r.Status): $($r.Project)" -ForegroundColor $color
+}
+Write-Host "`nTotal: $($results.Count) projects, $failed failed"
+
+exit $failed
diff --git a/tests/build-java.ps1 b/tests/build-java.ps1
diff --git a/tests/build-javascript.ps1 b/tests/build-javascript.ps1
diff --git a/voice-live-universal-assistant/javascript/package.json b/voice-live-universal-assistant/javascript/package.json
