Bot Framework JS SDK 4.23.3

Notable in this release

• Added supporet for TS 5.9

  Note: In order to support new TS version, we had to drop support for TS 4.7 as it is incompatible with the new node/types version.

• Package updates to resolve security alerts

What's Changed

• fix: Remaining CodeQL issues (#4898)
• bump: [https://github.com/microsoft/botbuilder-js/issues/4894] Add support for typescript 5.9 (#4897)
• fix: [https://github.com/microsoft/botbuilder-js/issues/4840] The use of the package browserify-sign could violate Microsoft crypto policy (#4875)
• Mark activity as optional in ConversationParameters (#4873)
• bump: dependencies to safe versions (#4896)
• Enable configuration of the OpenIdmetadata's refresh interval (#4877)
• fix: CodeQL issues with Medium and Error severity (#4893)
• bump: pbkdf2 from 3.1.1 to 3.1.3 (#4888)
• port: CQA to support TokenCredential instead of key (#4879)
• fix: CodeQL issues with severity High (#4892)
• Bump pbkdf2 version to fix issue (#4891)
• chore(deps): bump tar-fs from 2.1.1 to 2.1.2 (#4871)
• fix: Add signInSso cardviewType to SignInCardViewParameters (#4872)
• Update babel-runtime (#4868)
• bump: axios from 1.7.7 to 1.8.2 (#4869)
• Allow null value for Configuration parameter (#4856)
• fix: [https://github.com/microsoft/botbuilder-js/issues/4853] ConfigurationBotFrameworkAuthentication errors when initialized with process.env (#4857)
• Update elliptic, esbuild, and serialize-javascript (#4862)
• refactor: [https://github.com/microsoft/botbuilder-js/issues/4759] Migrate off @azure/core-http (#4834)
• chore(deps): bump elliptic from 6.6.0 to 6.6.1 (#4863)
• fix: Update generators and remove Core Bot templates (#4867)
• Fix actions/cache deprecation (#4858)

Full Changelog: 4.23.2...4.23.3

Bot Framework JS SDK 4.23.2

Notable changes in this release

• Node 22 support
• Dependency updates for security alerts
• Federated Credentials for bot-to-channel auth. This is supported for single tenant only.

What's Changed

• port: [#4632] Support Federated Identity Credential by Joel Mut (@sw-joelmut) in #4765
• port: [#6841] SkillDialog.InterceptOAuthCardsAsync doesn't support CloudAdapter by Cecilia Avila (@ceciliaavila) in #4766
• fix: CVE-2024-52798 vulnerability with path-to-regexp by Jhonatan Sandoval Velasco (@JhontSouth) in #4817
• bump: Update d3-format package by Jhonatan Sandoval Velasco (@JhontSouth) in #4842
• fix: Run the coveralls step only for windows by Cecilia Avila (@ceciliaavila) in #4843
• bump: nanoid from 3.3.6 to 3.3.8 by Dependabot (@dependabot) in #4812
• feat: Support Sso for SharePoint bot ACEs by Benjamin Tsai (@bentsai10) in #4806
• port:[#6879] Bot is not accepting v2 tokens from Bot Framework Emulator - Single Tenant Bots by Jhonatan Sandoval Velasco (@JhontSouth) in #4847
• fix: Upgrade path-to-regexp and find-my-way packages to latest version by Cecilia Avila (@ceciliaavila) in #4756
• bump: http-proxy-middleware from 2.0.6 to 2.0.7 by Dependabot (@dependabot) in #4778
• bump: [#4684] Upgrade Nighwatch by Joel Mut (@sw-joelmut) in #4768
• bump: elliptic from 6.5.7 to 6.6.0 by Dependabot (@dependabot) in #4780
• bump: [#4684] Upgrade filenamify using import-sync for esm-only package by Cecilia Avila (@ceciliaavila) in #4782
• fix: Upgrade cookie dependency to latest version by Cecilia Avila (@ceciliaavila) in #4771
• bump: [#4684] Replace nanoid with native module crypto by Cecilia Avila (@ceciliaavila) in #4769
• bump: Update p-map package by Jhonatan Sandoval Velasco (@JhontSouth) in #4820
• Suppress fake secret in unit test. by tracyboehrer (@tracyboehrer) in #4850
• bump: Update chai package by Jhonatan Sandoval Velasco (@JhontSouth) in #4844
• refactor: [#4684] Replace browserify with tsup by Joel Mut (@sw-joelmut) in #4774
• port: [#6861]TeamsSSOTokenExchangeMiddleware.DeduplicatedTokenExchangeIdAsync fails on BlobStorage ETag validation by Cecilia Avila (@ceciliaavila) in #4800
• bump: [#4684] Update nock dependency to latest version by Cecilia Avila (@ceciliaavila) in #4760
• bump: rollup from 4.21.0 to 4.22.4 by Dependabot (@dependabot) in #4755
• bump: [#4684] Upgrade rimraf dependency to v5 by Cecilia Avila (@ceciliaavila) in #4761
• bump: [#4684] Update sinon dependency to latest version by Cecilia Avila (@ceciliaavila) in #4762

Other

• bump: [#4684] Update applicationinsights dependency to version 2.x by Cecilia Avila (@ceciliaavila) in #4758
• fix: [#4746] Fix INodeBuffer in TypeScript 5.6 and ESNext target by Joel Mut (@sw-joelmut) in #4757
• feat: Add TS 5.6 and ESNext target support by Joel Mut (@sw-joelmut) in #4763
• feat: [#4684] Consolidate and update browser-echo-bot dependencies by Joel Mut (@sw-joelmut) in #4764
• fix: Workspaces for update-versions script by Joel Mut (@sw-joelmut) in #4783
• port: Add dataset to SearchInvokeValue by Joel Mut (@sw-joelmut) in #4777
• bump: Update ESLint packages and migrate to eslint.config.cjs files by Jhonatan Sandoval Velasco (@JhontSouth) in #4776
• fix: [#4684] Update INodeSocket type by Joel Mut (@sw-joelmut) in #4767
• Caret ranges for generator SDK version (any v4) by tracyboehrer (@tracyboehrer) in #4787
• fix: Upgrade cross-spawn dependency to latest version by Joel Mut (@sw-joelmut) in #4798
• feat: Update versions for generators by Cecilia Avila (@ceciliaavila) in #4796
• refactor: Fix test:consumer pipeline randomly failing by Joel Mut (@sw-joelmut) in #4793
• fix: [#4684] ESLint issues in botbuilder-ai by Cecilia Avila (@ceciliaavila) in #4790
• fix: Update Generators versions: Add missing directory to workspaces by Cecilia Avila (@ceciliaavila) in #4801
• fix: [#4684] ESLint issues in botbuilder-azure-blobs by Cecilia Avila (@ceciliaavila) in #4802
• fix: [#4684] ESLint issues in botbuilder-lg by Cecilia Avila (@ceciliaavila) in #4803
• fix: [#4684] ESLint issues in botbuilder-applicationinsights by Cecilia Avila (@ceciliaavila) in #4804
• feat: Add support for Node 22 by Cecilia Avila (@ceciliaavila) in #4808
• fix: [#4684] ESLint issues in botbuilder-dialogs-adaptive-runtime-core by Cecilia Avila (@ceciliaavila) in #4809
• fix: [#4684] ESLint issues in botbuilder-dialogs-adaptive-runtime by Cecilia Avila (@ceciliaavila) in #4810
• fix: [#4684] ESLint issues in botbuilder-dialogs-adaptive-runtime-integration libraries by Cecilia Avila (@ceciliaavila) in #4811
• fix: [#4684] ESLint issues in botbuilder-dialogs-adaptive-testing by Joel Mut (@sw-joelmut) in #4821
• fix: [#4684] ESLint issues in botframework-connector by Joel Mut (@sw-joelmut) in #4822
• fix: [#4684] ESLint issues in botbuilder-testing by Joel Mut (@sw-joelmut) in #4823
• fix: [#4684] ESLint issues in botbuilder-dialogs-declarative by Cecilia Avila (@ceciliaavila) in #4813
• fix: [#4684] ESLint issues in botbuilder-stdlib by Cecilia Avila (@ceciliaavila) in #4814
• fix: [#4684] ESLint issues in botframework-config by Cecilia Avila (@ceciliaavila) in #4815
• fix: [#4684] ESLint issues in botbuilder-ai-luis by Joel Mut (@sw-joelmut) in #4824
• fix: [#4684] ESLint issues in botframework-streaming by Joel Mut (@sw-joelmut) in #4825
• fix: [#4684] ESLint issues in botbuilder-dialogs-adaptive by Joel Mut (@sw-joelmut) in #4826
• fix: [#4684] ESLint issues in botbuilder-azure by Joel Mut (@sw-joelmut) in #4828
• fix: ESLint issues in bobuilder-core by Jhonatan Sandoval Velasco (@JhontSouth) in #4827
• fix: Remove ESLint config file in bobuilder-ai-qna by Jhonatan Sandoval Velasco (@JhontSouth) in #4829
• fix: ESLint issues in botbuilder by Jhonatan Sandoval Velasco (@JhontSouth) in #4830
• fix: ESLint issues in botbuilder-azure-queues by Jhonatan Sandoval Velasco (@JhontSouth) in #4831
• fix: ESLint issues in botbuilder-dialogs by Jhonatan Sandoval Velasco (@JhontSouth) in #4832
• fix: ESLint issues in adaptive-expressions by Jhonatan Sandoval Velasco (@JhontSouth) in #4833
• fix: [#4684] ESLint issues in adaptive-expressions-ie11 by Jhonatan Sandoval Velasco (@JhontSouth) in #4835
• fix: ESLint issues in botframework-schema by Jhonatan Sandoval Velasco (@JhontSouth) in #4836
• fix: ESLint issues in bobuilder-ai-orchestrator by Jhonatan Sandoval Velasco (@JhontSouth) in #4837
• fix: ESLint issues in botbuilder-repo-utils by Jhonatan Sandoval Velasco (@JhontSouth) in #4838
• fix: Remove unused resolutions by Jhonatan Sandoval Velasco (@JhontSouth) in #4816
• fix: Remaining ESLint issues by Joel Mut (@sw-joelmut) in #4846
• port: [#6882] Mock expired token for 'throws exception on expired token' unit test by Jhonatan Sandoval Velasco (@JhontSouth) in #4848

Bot Framework JS SDK 4.23.1

What's Changed

• bump: micromatch from 4.0.7 to 4.0.8 in /testing/browser-functional/browser-echo-bot by Dependabot (@dependabot) in #4732
• bump: micromatch from 4.0.2 to 4.0.8 by Dependabot (@dependabot) in #4733
• bump: [#4684] Update multiple dependencies inside public libraries to latest version by Joel Mut (@sw-joelmut) in #4739
• bump: webpack from 5.92.0 to 5.94.0 in /testing/browser-functional/browser-echo-bot by Dependabot (@dependabot) in #4736
• fix: [#4684] Update some dependencies to latest version by Joel Mut (@sw-joelmut) in #4737
• fix: [#4684] Update versions command by Joel Mut (@sw-joelmut) in #4742
• bump: body-parser from 1.20.2 to 1.20.3 by Dependabot (@dependabot) in #4743
• bump: express from 4.19.2 to 4.20.0 in /testing/browser-functional/browser-echo-bot by Dependabot (@dependabot) in #4744
• fix: Upgrade express dependency to latest version by Cecilia Avila (@ceciliaavila) in #4747
• fix: Replace globby with fast-glob by Jhonatan Sandoval Velasco (@JhontSouth) in #4745
• fix: Upgrade send dependency to latest version by Cecilia Avila (@ceciliaavila) in #4749
• bump: [#4684] Update @azure/cosmos and @azure/core-auth dependencies to their latest version by Joel Mut (@sw-joelmut) in #4748
• bump: [#4684] Update multiple dependencies inside internal libraries to latest version by Joel Mut (@sw-joelmut) in #4752

Bot Framework JS SDK 4.23.0

This is the August 2024 release of the Bot Framework JS SDK. This release contains Node 18 & 20 support, as well as security fixes.

NOTE
Due to the update to the last Azure Identity and MSAL.Node packages, Node versions prior to Node 18 are no longer supported. This is because those packages don't support out-of-support Node versions.

What's Changed

• bump: [#4550] Add Node 18 and 20 support by Joel Mut (@sw-joelmut) in #4726

• fix: Remove CVE-2022-3517 vulnerability by Jhonatan Sandoval Velasco (@JhontSouth) in #4699

• fix: Remove CVE-2022-25881 vulnerability by updating the http-cache-semantics package by Joel Mut (@sw-joelmut) in #4703

• fix: Remove CVE-2020-8203 vulnerability in lodash.set by Andrés Robinet (@andres-robinet-sw) in #4704

• fix: Remove CVE-2021-3807 vulnerability by Jhonatan Sandoval Velasco (@JhontSouth) in #4705

• fix: Remove CVE-2022-23539 vulnerability by updating the jsonwebtoken packages by Joel Mut (@sw-joelmut) in #4706

• fix: Remove CVE-2022-3517 vulnerability with minimatch by Jhonatan Sandoval Velasco (@JhontSouth) in #4707

• bump: semver from 5.7.1 to 7.6.2 by Dependabot (@dependabot) in #4710

• bump: hosted-git-info from 2.8.8 to 2.8.9 by Dependabot (@dependabot) in #4711

• bump: elliptic from 6.5.3 to 6.5.5 by Dependabot (@dependabot) in #4712

• fix: Remove CVE-2020-28469 vulnerability by updating the glob-parent package by Joel Mut (@sw-joelmut) in #4713

• fix: Remove remaining vulnerabilities by updating the hosted-git-info, tar, semver, ejs, elliptic packages by Joel Mut (@sw-joelmut) in #4714

• fix: [#4684] Remove unnecessary resolutions by Joel Mut (@sw-joelmut) in #4719

• fix: Remove undefined value in @azure/msal-node by Jhonatan Sandoval Velasco (@JhontSouth) in #4718

• bump: fast-xml-parser from 4.2.5 to 4.4.1 by Dependabot (@dependabot) in #4721

• port: [#6813][#6798] Not able to create instance of BlobsTranscriptStore using TokenCredential instead of connectionString and containerName by Jhonatan Sandoval Velasco (@JhontSouth) in #4720

• fix: Remove browser-echo-bot vulnerabilities by Jhonatan Sandoval Velasco (@JhontSouth) in #4717

• fix: CVE-2024-42460 vulnerability with elliptic by Jhonatan Sandoval Velasco (@JhontSouth) in #4729

• bump: axios from 1.7.2 to 1.7.4 by Dependabot (@dependabot) in #4730

• port: [#6793][#6792] Composer Bot with QnA Intent recognized triggers duplicate QnA queries by Jhonatan Sandoval Velasco (@JhontSouth) in #4700

Full Changelog: 4.22.3...4.23.0

Bot Framework for JS SDK 4.22.3

This is the June 2024 patch release of the Bot Framework JS SDK. This release contains security updates.

What's Changed

• fix: Remove CVE-2020-28469 with with glob-parent 5.1.1 (High) by Jhonatan Sandoval Velasco (@JhontSouth) in #4670
• fix: CodeQL SM04509 issue by Andrés Robinet (@andres-robinet-sw) in #4671
• bump: Upgrade axios version to ^1.7.2 by Jhonatan Sandoval Velasco (@JhontSouth) in #4680
• fix: Remove CVE-2024-37890 vulnerability by updating the ws package by Joel Mut (@sw-joelmut) in #4683
• fix: Remove CVE-2020-36632 vulnerability by Jhonatan Sandoval Velasco (@JhontSouth) in #4687
• fix: Remove CVE-2022-21680 vulnerability by Jhonatan Sandoval Velasco (@JhontSouth) in #4688
• fix: Remove CVE-2022-21680 vulnerability by Jhonatan Sandoval Velasco (@JhontSouth) in #4689
• fix: Remove CVE-2023-45133 vulnerability by Jhonatan Sandoval Velasco (@JhontSouth) in #4691
• fix: CVE-2020-8203 with lodash.pick by Andrés Robinet (@andres-robinet-sw) in #4692
• fix: Remove CVE-2020-7774 vulnerability by updating the y18n package by Joel Mut (@sw-joelmut) in #4693
• fix: Remove CVE-2022-0144 vulnerability by Jhonatan Sandoval Velasco (@JhontSouth) in #4695
• fix: Remove CVE-2024-4068 vulnerability by Jhonatan Sandoval Velasco (@JhontSouth) in #4696
• feat: Support Single Tenant authentication through BotFramework-Emulator by Jhonatan Sandoval Velasco (@JhontSouth) in #4643
• refactor: AgentSettings Circular Structure and improve internals by Joel Mut (@sw-joelmut) in #4641
• chore: Moved @types/jswebtoken (in both places) to dependencies. by tracyboehrer (@tracyboehrer) in #4646
• chore: [#4636] Add more information to Tenant parameters by Joel Mut (@sw-joelmut) in #4649
• fix: SM03944 suppression by tracyboehrer (@tracyboehrer) in #4654
• Removed unused build assets by tracyboehrer (@tracyboehrer) in #4658
• fix: [#4657] bump the npm_and_yarn group across 2 directories with 20 updates by Jhonatan Sandoval Velasco (@JhontSouth) in #4663
• fix: SM04509 suppression by tracyboehrer (@tracyboehrer) in #4667
• fix: SM02383 suppression by tracyboehrer (@tracyboehrer) in #4668
• fix: [#4483] Switching npm dependency bcrypt to bcryptjs by Jhonatan Sandoval Velasco (@JhontSouth) in #4669

Bot Framework JS SDK 4.22.2

This is the April 2024 JS SDK patch release. This release contains minor bug fixes and security updates.

What's Changed

• fix: add content type header by Vincenzo Chianese (@XVincentX) in #4587
• fix: [#4544] JwtTokenExtractor.getIdentity:err! FetchError: request to https://login.botframework.com/v1/.well-known/openidconfiguration by Cecilia Avila (@ceciliaavila) in #4583
• bump: Update swagger-client to stop using lodash-compat by Jhonatan Sandoval Velasco (@JhontSouth) in #4604
• fix: Removed Copyright from generated code by tracyboehrer (@tracyboehrer) in #4612
• fix: [#4584] ChannelAccount cannot accept extensible properties by Jhonatan Sandoval Velasco (@JhontSouth) in #4618
• bump: Update follow-redirects to ^1.15.4 by Jhonatan Sandoval Velasco (@JhontSouth) in #4617
• bump: Update @azure/msal-node and @azure/msal-browser by Jhonatan Sandoval Velasco (@JhontSouth) in #4619
• bump: undici from 5.28.2 to 5.28.3 by Dependabot (@dependabot) in #4620
• bump: axios from 0.21.1 to 0.28.0 by Dependabot (@dependabot) in #4621
• bump: ip from 1.1.5 to 1.1.9 by Dependabot (@dependabot) in #4622
• bump: ip from 1.1.5 to 1.1.9 in /testing/browser-functional/browser-echo-bot by Dependabot (@dependabot) in #4623
• bump: es5-ext from 0.10.53 to 0.10.63 by Dependabot (@dependabot) in #4624
• fix: [botframework-connector] Use HashSet instead of string array for endorsement by Carlos Coronado (@crdev13) in #4526
• bump: tar to 6.1.9 by tracyboehrer (@tracyboehrer) in #4627
• bump: axios to 0.21.2 by tracyboehrer (@tracyboehrer) in #4628
• chore: Removed autorest gen related by tracyboehrer (@tracyboehrer) in #4629
• bump: axios and ws by tracyboehrer (@tracyboehrer) in #4630
• bump: follow-redirects from 1.15.5 to 1.15.6 in /testing/browser-functional/browser-echo-bot by Dependabot (@dependabot) in #4633
• bump: follow-redirects from 1.15.5 to 1.15.6 by Dependabot (@dependabot) in #4634
• fix: [#4440][Bot node.js] Compile error for accessing "conversation" and "organizer" fields for get meeting details bot API by Cecilia Avila (@ceciliaavila) in #4442
• bump: express from 4.18.2 to 4.19.2 in /testing/browser-functional/browser-echo-bot by Dependabot (@dependabot) in #4638
• bump: express from 4.17.3 to 4.19.2 by Dependabot (@dependabot) in #4637
• getValue parity by tracyboehrer (@tracyboehrer) in #4639
• chore: Moved @types/jsonwebtoken to dependencies by tracyboehrer (@tracyboehrer) in #4640
• bump: undici from 5.28.3 to 5.28.4 by Dependabot (@dependabot) in #4642

Full Changelog: 4.22.1...4.22.2

Bot Framework JS SDK 4.22.0

This is the January 2024 4.22.0 release for the JS SDK. This contains a security fixes, Sharepoint support, and ASE improvements.

What's Changed

• feat: Add ASE channel validation in #4589

• feat: Add isVisible property to AceData with nanoid in #4606

• feat: Support for SharePoint (Viva) Adaptive Card Extension in #4551

• fix: USGovSingleTenant OAuthEndpoint in #4588

• bump: Update mocha package to avoid vulnerability in #4603

• fix: [#4582] UserAssignedIdentity(WorkloadIdentity) auth fails with 'scope https://api.botframework.com is not valid' in #4607

• fix: Remove old @microsoft/recognizers-text-number version with postinstall scripts in #4608

• fix: [#4544] JwtTokenExtractor.getIdentity:err! FetchError: request to 'login.botframework.com/v1/.well-known/openidconfiguration' in #4583

Proxy notes

The introduction of MSAL in 4.21.0 encountered an issue when used behind a proxy. This version adds an additional way to specify proxy settings. This does require a change to the bot startup code if required.

See this issue for details, and if additional discussion is required: https://github.com/microsoft/botbuilder-js/issues/4544

Bot Framework JS SDK 4.21.4

This is the January 2024 patch release for the JS SDK. This contains a security fix for axios.

What's Changed

• fix: Update axios and fix issue in botframework-connector by Jhonatan Sandoval Velasco (@JhontSouth) in #4592
• fix: Add HTTP method in fetch request by Jhonatan Sandoval Velasco (@JhontSouth) in #4593

NOTICE
Node versions 16 and older no longer have long-term support. Bot Framework SDK still supports Node 16, but users of the SDK should transition to at least Node 18 as soon as possible. We will not be able to continue supporting Node 16 and older bots with this SDK.

Bot Framework JS SDK 4.21.3

This is the December 2023 JS release. This release contains improvements to SN+I functionality.

Bot Framework JS SDK 4.21.1

This is the November 2023 Bot Framework JS SDK patch release. This release contains security related updates.

What's Changed

• fix: [#4545] Zod package - botbuilder-dialogs by Joel Mut (@sw-joelmut) in #4563
• fix: [#4545] Zod package - botbuilder by Joel Mut (@sw-joelmut) in #4561
• fix: [#4545] Zod package - botbuilder-core by Joel Mut (@sw-joelmut) in #4562
• chore: bump browserify-sign from 4.2.1 to 4.2.2 by Dependabot (@dependabot) in #4553
• chore: bump browserify-sign from 4.2.1 to 4.2.2 in /testing/browser-functional/browser-echo-bot by Dependabot (@dependabot) in #4554
• bump: Update babel related dependencies by Joel Mut (@sw-joelmut) in #4556

Full Changelog: 4.21.0...4.21.1