Request for dependency updates to address critical / major vulnerabilities

Is it an issue related to Adaptive Cards?

No response

Is this an accessibility issue?

No response

What version of Web Chat are you using?

Latest production

Which distribution are you using Web Chat from?

NPM

Which hosting environment does this issue primarily affect?

Web apps

Which browsers and platforms do the issue happened?

No response

Which area does this issue affect?

Others or unrelated

Which theme pack does this issue affect?

I did not test it on other theme packs

What is the public URL for the website?

http://virtualagent.hpcloud.hp.com/

Please describe the bug

Critical Issues

1. swiper@8.2.6 - Prototype Pollution Currently pinned for adaptivecards compatibility. Versions 6.5.1-12.1.1 are vulnerable, fix is 12.2.0. Advisory: GHSA-hmx5-qpq5-p643
2. form-data < 2.5.4 - Unsafe Random + CRLF Injection Comes from deprecated request package. No fix available since request is unmaintained. Advisories: GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx
3. @angular/common ⇐ 19.2.15 - XSRF Token Leak Transitive dependency from speech-sdk@1.17.0. Fix available in 19.2.16+. Advisory: GHSA-58c5-g7wp-6w37
4. @angular/core ⇐ 18.2.14 - XSS Issues Also from speech-sdk@1.17.0. Multiple XSS vulnerabilities in i18n and SVG handling. Advisories: GHSA-prjf-86w9-mfqv, GHSA-g93w-mfhg-p222, GHSA-jrmj-c5cx-3cw6

High Severity Issues :

(same speech-sdk blocker as above):
5. @angular/common: GHSA-p3vc-36g9-x9gr (DoS via OOM), GHSA-q6f4-qqrg-jv6x (Info Leak), GHSA-48r7-hpm6-gfxm (DoS)
6. @angular/core: GHSA-rgjc-h3x7-9mwg (DOM Clobbering), GHSA-692r-grfm-v8x7 (Template XSS)

What's Blocking Fixes

• Speech SDK 1.17.0 pulls in old Angular versions
• Adaptive Cards needs swiper v8 specifically
• The request package is deprecated with no replacement

What Would Help
If you could update:

1. Speech SDK to use fixed Angular versions
2. Adaptive Cards to work with swiper 12+ (logged separately https://github.com/microsoft/AdaptiveCards/issues/9381)
3. Replace request with a maintained HTTP client

Do you see any errors in console log?

How to reproduce the issue?

n/a

What do you expect?

If you could update:

1. Speech SDK to use fixed Angular versions
2. Adaptive Cards to work with swiper 12+ (NOTE: this will be logged as an issue in the AdaptiveCard repo)
3. Replace request with a maintained HTTP client

What actually happened?

n/a

Do you have any screenshots or recordings to repro the issue?

n/a

Adaptive Card JSON

Additional context

Vulnerabilities discovered via npm audit --production

Start by running npm audit --production and tracing the reported paths for speech-sdk, swiper, and request. Review the linked Adaptive Cards issue and the stated Angular and request blockers; done means the vulnerable dependencies are updated or the remaining unfixable blockers are clearly documented.