fix: resolve audit/license failures

[HarithaVattikuti]

Summary

Fixes the failing basic-validation.yml run on main (npm audit high-severity vulnerability).

Root cause

npm audit --audit-level=high failed with a high-severity DoS vulnerability in brace-expansion (GHSA-rgw5-rvv9-x895). The committed package-lock.json was stale — minimatch's own ^5.0.8 semver range already permits the fixed 5.0.9 release, no override was needed.

Changes

• Regenerated package-lock.json (fresh npm install) — resolves brace-expansion to 5.0.9.
• Refreshed .licenses/npm cache (licensed cache) to match the updated dependency tree.
• Added minimatch to the licensed.yml reviewed list — its license text doesn't cleanly auto-detect as Blue Oak 1.0.0, which is already in the allowed list.
• Rebuilt dist/setup/index.js and dist/cache-save/index.js.

Validation

• npm audit --audit-level=high → 0 vulnerabilities
• licensed status → 0 errors
• npm run pre-checkin (format, lint, build, test) → all pass, 122/122 tests

[Copilot]

Pull request overview

Updates the Node.js dependency lockfile, bundled dist artifacts, and license metadata to resolve basic-validation.yml failures caused by npm audit high-severity findings and licensed mismatches.

Changes:

• Regenerates package-lock.json to pull in patched transitive dependencies (notably brace-expansion).
• Refreshes dist/cache-save/index.js (rebundled output) to include updated dependency code.
• Updates licensed caches/metadata and adds minimatch to the reviewed list to keep license checks passing.

Reviewed changes

Copilot reviewed 22 out of 26 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
package-lock.json	Updates resolved dependency tree to address audit findings (incl. brace-expansion/minimatch).
dist/cache-save/index.js	Rebuilt bundled JS output reflecting updated dependency versions and security-related upstream changes.
.licenses/npm/xml-naming.dep.yml	Adds new cached license entry for xml-naming@0.3.0.
.licenses/npm/xml-naming-0.1.0.dep.yml	Removes old cached license entry for xml-naming@0.1.0.
.licenses/npm/undici.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/strnum.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/minimatch-10.2.6.dep.yml	Updates cached version/license classification for minimatch@10.2.6.
.licenses/npm/fast-xml-parser.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/fast-xml-builder.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/brace-expansion-5.0.9.dep.yml	Updates cached version to match patched brace-expansion.
.licenses/npm/brace-expansion-1.1.18.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/@typespec/ts-http-runtime.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/@azure/storage-common.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/@azure/storage-blob.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/@azure/logger.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/@azure/core-xml.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/@azure/core-util.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/@azure/core-tracing.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/@azure/core-rest-pipeline.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/@azure/core-paging.dep.yml	Updates cached version/text to match updated lockfile.
.licenses/npm/@azure/core-http-compat.dep.yml	Updates cached version/homepage to match updated lockfile.
.licenses/npm/@azure/core-client.dep.yml	Updates cached version to match updated lockfile.
.licenses/npm/@azure/core-auth.dep.yml	Updates cached version/homepage to match updated lockfile.
.licenses/npm/@azure/abort-controller.dep.yml	Updates cached version/text to match updated lockfile.
.licensed.yml	Adds minimatch to the manually reviewed dependency list.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.