[Infrastructure] Update vulnerable npm dependencies

[wtgodbe]

Summary

• update brace-expansion from 1.1.16 to 1.1.18 in the Azure DevOps report task
• update DOMPurify from 3.2.4 to 3.4.13 and refresh the bundled project-template asset
• ingest the patched package versions through the dotnet-public-npm Azure Artifacts feed

Security alerts

This addresses all currently open npm Dependabot alerts: 2 high, 15 medium, and 4 low.

Testing

• installed both updated lockfiles with npm ci through the Azure Artifacts feed
• verified the bundled DOMPurify file exactly matches DOMPurify 3.4.13

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

Updates npm dependency artifacts used by .NET Extensions project templates and the AI Evaluation Azure DevOps reporting task to address known vulnerabilities, including a DOMPurify refresh and a brace-expansion patch, using the dotnet-public-npm Azure Artifacts feed.

Changes:

• Bumps DOMPurify to 3.4.13 and refreshes the bundled DOMPurify asset in the AIChatWeb template.
• Updates the project-templates npm lockfile to consume the patched DOMPurify package.
• Updates the Azure DevOps task lockfile to use brace-expansion 1.1.18.

Reviewed changes

Copilot reviewed 1 out of 4 changed files in this pull request and generated 1 comment.

File	Description
src/ProjectTemplates/package-lock.json	Updates resolved DOMPurify package version and metadata in the templates dependency lockfile.
src/ProjectTemplates/Microsoft.Extensions.AI.Templates/templates/AIChatWeb-CSharp/AIChatWeb-CSharp.Web/wwwroot/lib/dompurify/README.md	Updates the documented DOMPurify version for the bundled asset.
src/ProjectTemplates/Microsoft.Extensions.AI.Templates/templates/AIChatWeb-CSharp/AIChatWeb-CSharp.Web/wwwroot/lib/dompurify/dist/purify.es.mjs	Refreshes the bundled DOMPurify distribution file to 3.4.13.
src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript/azure-devops-report/tasks/PublishAIEvaluationReport/package-lock.json	Updates brace-expansion to a patched version within the Azure DevOps report task lockfile.

Files not reviewed (2)

• src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript/azure-devops-report/tasks/PublishAIEvaluationReport/package-lock.json: Generated file
• src/ProjectTemplates/package-lock.json: Generated file

Suppressed comments (1)

src/ProjectTemplates/package-lock.json:226

• This lockfile updates DOMPurify to 3.4.13, but the dependency declaration still appears to be "dompurify": "^3.2.4" (see packages[""] and src/ProjectTemplates/Microsoft.Extensions.AI.Templates/package.json). Keeping the declared range aligned with the intended minimum version helps prevent an accidental downgrade the next time the lockfile is regenerated.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.