fix(deps): resolve security alerts and consolidate Dependabot updates

.changeset/config.json

@@ -1,9 +1,10 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json",
   "access": "public",
   "baseBranch": "origin/main",
   "changelog": "@changesets/cli/changelog",
   "commit": false,
+  "format": "oxfmt",
   "ignore": [],
   "linked": [],
   "privatePackages": {

.changeset/security-dependency-refresh.md

@@ -0,0 +1,8 @@
+---
+---
+
+Refresh vulnerable transitive dependencies and consolidate the pending Dependabot npm and GitHub Actions updates while preserving the seven-day release cooldown.
+
+Keep both supported xmldom and js-yaml major lines patched. Update the existing body-parser resolution to pick up qs fixes, and narrowly override Appium's pinned morgan and sharp versions until its dependency pins adopt the patched releases.
+
+Upgrade Changesets CLI and its action together, explicitly use the repository's oxfmt formatter, and retain the version-only workflow; package publishing remains in Azure Pipelines.

.github/workflows/changesets-version.yml

@@ -13,21 +13,21 @@ jobs:
     if: ${{ github.repository == 'microsoft/fluentui-react-native' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           filter: blob:none
           fetch-depth: 0
           persist-credentials: false
 
       - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3
+        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@8ae6d960b7d76fdaa54eb30d7bdb92507a09b9fa # 5.4.10
 
       - name: Install dependencies
         run: |
           yarn install --immutable
 
       - name: Generate token for version PR
-        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
@@ -37,9 +37,10 @@ jobs:
 
       - name: Create Version Bump PR
         id: changesets
-        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
         with:
-          version: yarn changeset:version
-          createGithubReleases: false
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          github-token: ${{ steps.app-token.outputs.token }}
+          version-script: yarn changeset:version
+          create-github-releases: false
+          push-git-tags: false
+          push-with-git-cli: true

.github/workflows/codeql-analysis.yml

@@ -39,11 +39,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +54,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0

.github/workflows/pr-bundle-size-comment.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout trusted reporter
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false

.github/workflows/pr.yml

@@ -19,12 +19,12 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3
+        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@8ae6d960b7d76fdaa54eb30d7bdb92507a09b9fa # 5.4.10
         with:
           node-version: 22
 
@@ -43,12 +43,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3
+        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@8ae6d960b7d76fdaa54eb30d7bdb92507a09b9fa # 5.4.10
         with:
           node-version: 22
 
@@ -106,10 +106,10 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3
+        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@8ae6d960b7d76fdaa54eb30d7bdb92507a09b9fa # 5.4.10
         with:
           platform: android
           node-version: 22
@@ -136,10 +136,10 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3
+        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@8ae6d960b7d76fdaa54eb30d7bdb92507a09b9fa # 5.4.10
         with:
           platform: macos
           node-version: 22
@@ -191,10 +191,10 @@ jobs:
     timeout-minutes: 40
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3
+        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@8ae6d960b7d76fdaa54eb30d7bdb92507a09b9fa # 5.4.10
         with:
           platform: macos
           node-version: 22
@@ -244,10 +244,10 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3
+        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@8ae6d960b7d76fdaa54eb30d7bdb92507a09b9fa # 5.4.10
         with:
           platform: ios
           node-version: 22
@@ -289,12 +289,12 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 5
 
       - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3
+        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@8ae6d960b7d76fdaa54eb30d7bdb92507a09b9fa # 5.4.10
         with:
           platform: windows
           node-version: 22
@@ -356,12 +356,12 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 5
 
       - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3
+        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@8ae6d960b7d76fdaa54eb30d7bdb92507a09b9fa # 5.4.10
         with:
           platform: windows
           node-version: 22
@@ -422,10 +422,10 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3
+        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@8ae6d960b7d76fdaa54eb30d7bdb92507a09b9fa # 5.4.10
         with:
           platform: windows
           node-version: 22
@@ -470,10 +470,10 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3
+        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@8ae6d960b7d76fdaa54eb30d7bdb92507a09b9fa # 5.4.10
         with:
           platform: windows
           node-version: 22
@@ -516,13 +516,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           filter: blob:none
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
           cache: 'yarn'
@@ -544,10 +544,10 @@ jobs:
       has-tarballs: ${{ steps.check.outputs.has-tarballs }}
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3
+        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@8ae6d960b7d76fdaa54eb30d7bdb92507a09b9fa # 5.4.10
         with:
           node-version: 22
 
@@ -583,10 +583,10 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up toolchain
-        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3
+        uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@8ae6d960b7d76fdaa54eb30d7bdb92507a09b9fa # 5.4.10
         with:
           node-version: 22
 

CONTRIBUTING.md

@@ -229,6 +229,11 @@ This repo manages semantic versioning and publishing using [Changesets](https://
 1. `yarn changeset` will take you through a command line wizard to generate changeset files
 2. Make sure to push the newly generated changeset file (`.changeset/*.md`)
 
+Repository release tooling uses Changesets CLI v3 with Node.js 22.x (22.12 or later), 24.x, or 26+, and the repository-pinned Yarn version.
+Changelogs use oxfmt; run `yarn format` from the repository root to format changes.
+`yarn changeset:version` requires an unreleased changeset and fails when none are present.
+The GitHub Actions workflow only creates version-update pull requests; package publishing remains in Azure Pipelines.
+
 #### Testing changes
 
 Before you create a pull request, test your changes with the FluentUI Tester on the platforms that are affected by your change. For more information on the FluentUI Tester, please follow instructions in the [FluentUI Tester readme](./apps/fluent-tester/README.md).

package.json

@@ -45,7 +45,7 @@
     "@babel/preset-typescript": "catalog:",
     "@babel/runtime": "catalog:",
     "@changesets/changelog-github": "^0.5.0",
-    "@changesets/cli": "^2.30.0",
+    "@changesets/cli": "^3.0.2",
     "@microsoft/esrp-npm-release": "^0.1.2",
     "@rnx-kit/align-deps": "catalog:",
     "@rnx-kit/lint-lockfile": "catalog:",
@@ -69,7 +69,7 @@
     "@types/react": "19.1.17",
     "axios@npm:1.13.3": "^1.18.1",
     "basic-ftp@npm:^5.0.2": "5.3.1",
-    "body-parser@npm:^1.20.3": "1.20.6",
+    "body-parser@npm:^1.20.3": "1.20.8",
     "deepmerge-ts@npm:^7.0.3": "8.0.1",
     "esbuild@npm:~0.25.0": "^0.28.0",
     "expect-webdriverio": "patch:expect-webdriverio@npm%3A5.6.1#~/.yarn/patches/expect-webdriverio-npm-5.6.1-69666d39e9.patch",
@@ -78,8 +78,10 @@
     "form-data@npm:4.0.5": "^4.0.6",
     "launch-editor@npm:^2.9.1": "2.14.1",
     "lodash": "^4.18.1",
+    "morgan@npm:1.11.0": "1.12.1",
     "path-to-regexp@npm:8.3.0": "^8.4.2",
     "react-native-windows": "0.81.35",
+    "sharp@npm:0.35.3": "0.35.4",
     "shell-quote": "^1.9.0",
     "socks@npm:^2.8.3": "2.8.9",
     "unicorn-magic@npm:^0.3.0": "^0.4.0",
@@ -90,7 +92,7 @@
     "yaml@npm:^1.10.0": "1.10.3"
   },
   "engines": {
-    "node": ">=22.12"
+    "node": "^22.12.0 || ^24.0.0 || >=26.0.0"
   },
   "packageManager": "yarn@4.18.0",
   "rnx-kit": {