Bump go modules, npm packages, and GitHub Action pins per Dependabot update plan

[Copilot]

Dependabot's update planner flagged 15 open dependency bumps (5 GitHub Actions, 6 Go modules, 4 npm), including several major version jumps requiring compatibility review.

GitHub Actions

• actions/upload-pages-artifact v3 → v5.0.0 (.github/workflows/docs.yml)
• azure/login v2 → v3.0.2 (.github/workflows/aoai-endpoint-smoke-test.yml)
• astral-sh/setup-uv v7.3.0 → v10.1.0 (.github/workflows/copilot-setup-steps.yml)
• actions/setup-node v4.1.0 → v7.0.0 (pkg/workflow/maintenance_workflow_yaml_jobs.go)
• actions/download-artifact and compiled workflow uses of setup-node/setup-uv were already at target versions via pkg/actionpins/data/action_pins.json (refreshed in a prior PR); no further action needed there

Go modules

• golang.org/x/term 0.45.0 → 0.46.0
• golang.org/x/crypto 0.56.0 → 0.57.0
• github.com/modelcontextprotocol/go-sdk 1.7.0 → 1.8.0
• golang.org/x/tools 0.49.0 → 0.50.0

npm

• docs/package.json: @astrojs/markdown-remark 7.3.0 → 7.3.1, @primer/octicons 19.34.0 → 19.36.0, pdfjs-dist 6.2.108 → 6.3.289, yaml 2.9.0 → 2.9.1
• actions/setup/js/package.json: @types/node 26.5.0 → 26.5.1, vite 8.2.2 → 8.3.0

Deliberately not bumped

• mermaid 11.17.2 → 12.0.0: astro-mermaid@2.1.0 (used for diagram rendering) declares peerDependencies.mermaid: "^10.0.0 || ^11.0.0", and mermaid 12 pulls in chevrotain/lodash-es versions with known high-severity vulnerabilities (GHSA-r5fr-rjxr-66jc, GHSA-f23m-r3pf-42rh). Left at 11.17.2 pending an astro-mermaid release that supports mermaid 12.

• Fixes [dependabot:update-planner] Dependency update plan for github/gh-aw #61573

[github-actions]

⚠️ Security scanning failed for Design Decision Gate 🏗️. Review the logs for details.

No ADR enforcement needed: PR does not have the "implementation" label and has ≤100 new lines of code in business logic directories.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

⚠️ PR Code Quality Reviewer failed during code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

✅ Ponytail Reviewer completed successfully!

Lean already. Ship.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

Generated by Ponytail Reviewer for #61574

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. Test Quality Sentinel skipped. (PR scope: dependency/version updates only: go.mod, go.sum, npm package-lock.json, GitHub Action pins, and one workflow maintenance file.)

🧪 Test quality analysis by Test Quality Sentinel

[Copilot]

🟡 Changes recommended

The Pages artifact drops the required .well-known file, and the combined major upgrades violate the linked isolation plan.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates dependency versions across workflows, Go modules, and npm packages while retaining Mermaid 11.

Changes:

• Upgrades four GitHub Actions.
• Refreshes Go and npm dependencies.
• Updates generated lockfiles.

File summaries

File	Description
.github/workflows/aoai-endpoint-smoke-test.yml	Upgrades Azure Login.
.github/workflows/copilot-setup-steps.yml	Upgrades setup-uv.
.github/workflows/docs.yml	Upgrades Pages artifact upload.
actions/setup/js/package.json	Updates Node development dependencies.
actions/setup/js/package-lock.json	Locks updated Node dependencies.
docs/package.json	Updates documentation dependencies.
docs/package-lock.json	Locks updated documentation dependencies.
go.mod	Updates Go module requirements.
go.sum	Refreshes Go module checksums.
pkg/workflow/maintenance_workflow_yaml_jobs.go	Upgrades generated setup-node usage.

Review details

Files not reviewed (2)

• actions/setup/js/package-lock.json: Generated file
• docs/package-lock.json: Generated file

• Files reviewed: 7/10 changed files
• Comments generated: 3
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Skills-Based Review 🧠

This is a mechanical dependency-bump PR (5 GitHub Action pins, 4 Go modules, 4 npm packages). No source logic changes, so /tdd, /codebase-design, and /diagnosing-bugs don't materially apply here — checked instead for correctness/consistency of the bumps themselves.

📋 Verification performed

• go build ./... succeeds cleanly with the bumped go.mod/go.sum (x/term, x/crypto, go-sdk, x/tools).
• actions/setup-node@v7.0.0 SHA in pkg/workflow/maintenance_workflow_yaml_jobs.go matches the pin recorded in pkg/actionpins/data/action_pins.json, so the compiled workflow output stays consistent — no make recompile needed since no .md workflow sources changed.
• azure/login and actions/upload-pages-artifact pins updated with matching version comments and correct SHAs.
• The deliberate mermaid v11→v12 hold-back is well justified in the PR body (peer-dependency constraint on astro-mermaid + two known high-severity transitive CVEs in mermaid 12's chevrotain/lodash-es). Confirmed docs/package.json still pins mermaid: ^11.17.2.

No actionable issues found.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 33.6 AIC · ⌖ 15 AIC · ⊞ 10.6K
_{Comment /matt to run again}

[Copilot]

🔵 Needs a closer look

The updates violate the required isolation plan, include lockfile versions beyond the reviewed targets, and retain a duplicated action pin.

Review details

Files not reviewed (2)

• actions/setup/js/package-lock.json: Generated file
• docs/package-lock.json: Generated file

Suppressed comments (4)

Previously missed (3) — in code that hasn't changed since the last review.

actions/setup/js/package-lock.json:1559

• The PR claims the reviewed patch update to 26.5.1, but npm ci will install 26.6.1 from this lockfile. That silently broadens the change to an additional minor release; Dependabot PR #61097 resolves exactly 26.5.1. Keep the lock entry at the stated target or update the PR scope and review the additional release.
  docs/package-lock.json:2479
• The PR description and linked Dependabot update specify 19.36.0, but this lockfile installs 19.37.0. That adds an unreviewed minor release beyond the stated update; the original Dependabot PR #61096 resolves exactly 19.36.0. Regenerate or restore the lock entry so the installed dependency matches the reviewed target.
  go.mod:30
• Issue #61573 explicitly requires the crypto-sensitive x/crypto bump to be reviewed in its own PR and requires each unrelated major Actions upgrade to be isolated. This PR combines it with four major Actions jumps plus the other Go and npm updates, so it does not satisfy the linked update plan and makes compatibility/security failures difficult to attribute. Split these update groups as specified before merging.

pkg/workflow/maintenance_workflow_yaml_jobs.go:672

• This repeats the setup-node SHA instead of using the shared action-pin registry. The prior registry refresh already moved setup-node to v7 while this maintenance-only copy stayed on v4, demonstrating that it will drift again on the next update. Resolve the pin through getActionPin as the other actions in this file do.

        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

• Files reviewed: 7/10 changed files
• Comments generated: 0 new
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

[mnkiefer]

@copilot Address #61574 (review)

[Copilot]

🔵 Needs a closer look

The updates violate the required isolation plan, include lockfile versions beyond the reviewed targets, and retain a duplicated action pin....

Addressed in 6f56023: removed the Action and Go updates that require isolated review, and regenerated the npm lockfiles so @types/node resolves to 26.5.1 and @primer/octicons to 19.36.0.