[waleedlatif1]

Summary

• tedious (via mssql) resolved @azure/identity 4.13.1 and @azure/msal-node 5.5.0, flagged by bun audit as GHSA-xcx6-jx8p-x3h5 (high).
• A root override pins @azure/identity to 4.14.1, which tedious's ^4.13.1 already allows. It depends on @azure/msal-node ^7.1.0, so msal-node resolves 7.1.2 (the newest past the 7-day release-age gate). open moves to 11 with it.
• The lockfile also records the extension's current version (0.1.5).

Left for follow-ups

• undici 8.10.2 is pinned exactly by @earendil-works/pi-coding-agent 1.0.0 and by e2b 2.50.0's undici8; clearing it means a pi-coding-agent upgrade (1.5.0 clears the release-age gate on Nov 9) and an e2b bump past 2.60, both behavior changes worth their own review.
• undici 6.28.1 comes from node-gyp (build only).

Test plan

• bun install resolves msal-node 7.1.2; bun audit no longer lists msal-node
• CI

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 8, 2026 9:38am UTC

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Pins @azure/identity to 4.14.1 and updates bun.lock to resolve @azure/msal-node to 7.1.2.

• The SQL Server driver now gets patched Azure sign-in packages.
• The extension lock entry now matches version 0.1.5.

Acknowledgment: waleedlatif1 explicitly deferred the existing undici updates because they require separate dependency upgrades and behavior reviews. Those unchanged dependencies are not findings here.

_{Reviews (1) · Last reviewed commit: "chore(deps): pin @azure/identity 4.14.1 ..." · Reviewed by Greptile}