[Eugene (OEvgeny)]

Clears 8 Dependabot alerts on samples/package-lock.json, which pins botframework-webchat@4.19.1-main.20260529.

Changelog Entry

Changed

• 🏫 Samples: bumped botframework-webchat@4.19.3-main.20261105.058fca6, clearing sanitize-html, valibot and katex security alerts, in PR #6019, by @OEvgeny

Description

The samples' pinned May nightly still resolves sanitize-html@2.17.4, valibot@1.3.1 and katex@0.16.45. They now pin 4.19.3-main.20261105.058fca6, which has #5987 and #6001.

Design

• Bumped the pin instead of adding overrides, which the next npm run bump would drop anyway.
• Resolved with --min-release-age=7, exempting only the Web Chat packages and @angular/* (Speech SDK 1.17.0 peers, kept at 22.2.4), so the nightly is the only new version under 7 days old.

Specific Changes

• 9 sample package.json files: botframework-webchat (and botframework-webchat-api in f.selectable-activity) on 4.19.3-main.20261105.058fca6

• samples/package-lock.json: sanitize-html@2.18.1, valibot@1.4.2, katex@0.19.1; drops deepmerge

• I have added tests and executed them locally

• I have added .changelog/<PR#>-<slug>.md

• I have updated documentation

Review Checklist

This section is for contributors to review your work.

• Accessibility reviewed (tab order, content readability, alt text, color contrast)
• Browser and platform compatibilities reviewed
• CSS styles reviewed (minimal rules, no z-index)
• Documents reviewed (docs, samples, live demo)
• Internationalization reviewed (strings, unit formatting)
• package.json and package-lock.json reviewed
• Security reviewed (no data URIs, check for nonce leak)
• Tests reviewed (coverage, legitimacy)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.