Fix Component Governance alert: Upgrade underscore from 1.12.1 to 1.13.8

[sunbrk]

Description

This PR upgrades the underscore dependency from version 1.12.1 to 1.13.8 to resolve a component governance security alert.

Changes Made

• Updated underscore version in package.json overrides section from 1.12.1 to 1.13.8
• Regenerated pnpm-lock.yaml to reflect the updated dependency version

Why This Change is Needed

• Security Fix: Addresses a component governance alert flagging underscore version 1.12.1 as vulnerable
• Compliance: Ensures the project meets security compliance requirements
• Risk Mitigation: Upgrades to a patched version (1.13.8) that resolves known security issues

Files Modified

• package.json - Updated underscore version in overrides
• pnpm-lock.yaml - Lock file updated via pnpm install

Validation

Validation performed:

• ✅ Dependencies installed successfully with pnpm install
• ✅ No breaking changes expected (minor version upgrade from 1.12.x to 1.13.x)
• ✅ All existing functionality should remain intact

Unit Tests added:

No

End-to-end tests added:

No

Additional Requirements

Change file added:

Yes

[github-actions]

size-limit report 📦

Path	Size	Loading time (3g)	Running time (snapdragon)	Total time
packages/teams-js/dist/esm/packages/teams-js/src/index.js	202.69 KB (0%)	4.1 s (0%)	1.8 s (+8.4% 🔺)	5.9 s

[Copilot]

Pull request overview

Upgrades the underscore dependency override to address a component governance security alert, updating the root dependency override and regenerating the pnpm lockfile accordingly.

Changes:

• Bumped underscore override from 1.12.1 to 1.13.8 in root package.json.
• Regenerated pnpm-lock.yaml to resolve and pin underscore@1.13.8.
• Added a Beachball change file recording the security-related dependency upgrade.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates the pnpm override to force underscore@1.13.8.
pnpm-lock.yaml	Reflects the resolved underscore@1.13.8 version and integrity in the lockfile.
change/@microsoft-teams-js-a8f7b2c1-5d4e-4a9c-8b3f-7c6e9d2a1b5e.json	Adds a patch change entry documenting the security-driven upgrade.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The pnpm overrides-explanation section documents why each override exists, but there is no entry for the underscore override. Since this PR updates the override version for a security alert, please add an underscore key under pnpm.overrides-explanation describing the reason and any relevant context (e.g., the component governance/vulnerability motivation) so future maintainers know why it’s pinned.

[aeunms]

@sunbrk I think this is a good idea too, but given this is a security concern I support merging now and keeping an ADO item tracked to follow up on this.

[aeunms]

@sunbrk I think this is a good idea too, but given this is a security concern I support merging now and keeping an ADO item tracked to follow up on this.