chore: consolidate dependabot PRs and update all packages to latest

[Copilot]

Combines 15 open dependabot PRs into a single update, bumping all outdated NuGet, npm, and GitHub Actions dependencies — including several packages beyond what dependabot had staged.

NuGet (Directory.Packages.props)

• System.Reactive 6.1.0 → 7.0.0
• Microsoft.AspNetCore.Components.WebAssembly + .Server 10.0.5 → 10.0.10

npm — microsoft-trydotnet

• jsdom 29.1.1 → 30.0.1
• @types/node ^25.9.3 → ^26.2.0
• @types/chai ^5.0.1 → ^5.2.3
• typescript ^5.9.3 → ^7.0.2 ⚠️
• rollup 4.62.3 → 4.62.4

npm — microsoft-trydotnet-editor

• typescript ^5.8.3 → ^7.0.2 ⚠️
• eslint ^8.57.0 → ^10.8.1 ⚠️
• uuid 13.0.0 → 14.0.1
• @microsoft/polyglot-notebooks 1.0.441801 → 1.0.722201
• monaco-editor 0.33.0 → 0.56.0

npm — microsoft-learn-mock

• rollup 2.79.2 → 4.62.4 ⚠️
• typescript ^5.9.3 → ^7.0.2 ⚠️

npm — microsoft-trydotnet-styles

• sass ^1.99.0 → ^1.102.0

GitHub Actions

• actions/checkout v7.0.0 → v7.0.1 (SHA updated in lock file)

⚠️ = major version bump; TypeScript 7.x, eslint 10.x, rollup 4.x, and monaco 0.56.0 are the notable ones to watch in CI.

[BenjaminMichaelis]

@copilot did we use npm to update our packages? Looks like our lock file is out of date in CI. Also update our code if we needed to from the package upgrades

[Copilot]

@copilot did we use npm to update our packages? Looks like our lock file is out of date in CI. Also update our code if we needed to from the package upgrades

Done in commit fix: update npm lock files and fix TypeScript compat issues from package upgrades.

Lock files: Ran npm install --package-lock-only in all 4 npm projects to update their lock files to match the upgraded package.json entries. The CI npm ci failure was because the lock files were missing entries for TypeScript 7's platform-specific optional packages.

Code fixes required by the upgrades:

• typescript in microsoft-trydotnet bumped to 7.x — moduleResolution: "node" was removed in TS 7, changed to "bundler". Added explicit strictNullChecks: false and skipLibCheck: true to preserve previous behavior. Two internal subscribe callbacks needed as ApiMessage casts (TS 7 is stricter about index-signature assignability to discriminated unions).
• typescript in microsoft-trydotnet-editor capped at ^6.0.3 (TS 7 is blocked by @typescript-eslint's <6.1.0 peer dep). Updated moduleResolution to "bundler" (needed by monaco-editor 0.56.0's ESM package structure). Added strictNullChecks: false / noImplicitAny: false to preserve old behavior. Three code fixes: e instanceof Error ? e.message : String(e) for the TS 6 unknown catch binding, btoa/atob replacing Buffer (Node global, not available in the browser), and a global.d.ts declaring *.css modules for the side-effect CSS import.
• microsoft-learn-mock tsconfig also updated from node → bundler module resolution.

[Copilot]

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Set up Node.js environment

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

[Copilot]

Pull request overview

Consolidates multiple Dependabot updates into a single dependency-refresh PR across the repo’s .NET (central package management), JavaScript workspaces (npm), and GitHub Actions lockfile, aiming to bring packages up to their latest versions.

Changes:

• Updates npm devDependencies/dependencies across microsoft-trydotnet, microsoft-trydotnet-editor, microsoft-learn-mock, and microsoft-trydotnet-styles (including major bumps like TypeScript 7, eslint 10, rollup 4, monaco 0.56).
• Bumps central NuGet package versions in Directory.Packages.props (notably System.Reactive 7.0.0 and Blazor WebAssembly packages 10.0.10).
• Updates the pinned actions/checkout SHA in the Dependabot major-review workflow lockfile.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/microsoft-trydotnet/package.json	Bumps TypeScript/jsdom/@types to newer versions for the trydotnet JS package.
src/microsoft-trydotnet/package-lock.json	Refreshes the resolved dependency graph for the trydotnet JS package to match updated deps.
src/microsoft-trydotnet-styles/package.json	Updates sass version range for the styles package.
src/microsoft-trydotnet-editor/package.json	Major bumps for TypeScript/eslint and runtime deps like monaco/polyglot-notebooks/uuid.
src/microsoft-learn-mock/package.json	Major bumps for rollup and TypeScript in the learn-mock package.
Directory.Packages.props	Centralized NuGet version bumps for .NET projects.
.github/workflows/dependabot-major-review.lock.yml	Updates pinned actions/checkout reference to v7.0.1 SHA.

Files not reviewed (1)

• src/microsoft-trydotnet/package-lock.json: Generated file

Suppressed comments (1)

src/microsoft-trydotnet/package-lock.json:3802

• This lockfile update pulls in [email protected], which requires Node >=22.19.0 (engines field). CI currently runs npm ci under Node 20 (.github/actions/setup-node/action.yml:14), so the dependency graph is not runnable in CI as-is.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.