Bump axios and @microsoft/agents-hosting-express in /samples/nodejs/copilotstudio-skill

[dependabot]

Removes axios. It's no longer used after updating ancestor dependency @microsoft/agents-hosting-express. These dependencies need to be updated together.

Removes axios

Updates @microsoft/agents-hosting-express from 1.5.1 to 1.7.1

Release notes

Sourced from @​microsoft/agents-hosting-express's releases.

Version 1.7

This release adds an Entra auth sidecar, streaming attachment support, broader web API compatibility, and moves the codebase to TypeScript 6+.

✨ New Features

• Entra auth sidecar — Initial version of an Entra authentication sidecar. (#1155) • Attachments in streaming responses — Added  addAttachment  to  StreamingResponse , so you can now include attachments while streaming. (#1154) • Diverse web API support — Enhanced  agents-hosting  to support a broader range of web APIs, expanding hosting flexibility beyond Express/Fastify. (#1135)

🔧 Improvements

• Faster per-activity auth — Fixed fresh token fetches on every activity that were adding latency; tokens are now handled more efficiently. (#1179, #1164) • Clearer public auth types — Clarified the public auth scope constant types in  agents-hosting . (#1163)

🧹 Modernization & Cleanup

• TypeScript 6+ — Upgraded the codebase to TypeScript 6+. (#1150) • Consistent error handling — Updated all remaining  throw Error  calls to use  ErrorHelper , completing the standardized error pattern across the codebase. (#1149) • Compat script fix — Fixed the API compatibility script. (#1161)

Full Changelog: microsoft/Agents-for-js@v1.6...v1.7

Version 1.6

This release brings a new Slack extension, expanded authentication options, transport and hosting improvements, and a major dependency modernization effort (goodbye axios, lodash, and uuid).

✨ New Features

• Slack extension — A new extension lets developers call Slack APIs directly from their agents. (#1060) • Named Pipe support — Added Named Pipe transport with accompanying tests, enabling new local/inter-process hosting scenarios. (#1126) • Targeted activity support — Added the  isTargetedActivity  parameter. (#1046) • Azure region support — You can now pass  azureRegion  through the SDK. (#1054) • ContainerIMDS auth type — New authentication type for containerized/managed-identity environments. (#1123) • Agent settings report — Agents can now surface a report of their current settings for easier diagnostics. (#1089) • Programmatic citation icons —  ClientCitationIconName  is now programmatically accessible. (#1100) • serviceUrl validation & env parsing utilities — New helpers for validating service URLs and parsing environment configuration. (#1134)

🔧 Improvements

• Customizable  startServer  —  startServer  now supports server customization for greater hosting flexibility. (#1047, #1009) • Simplified auth configuration —  AuthConfiguration  loading now uses  EnvParser , streamlining setup. (#1119) • Workload identity alignment — Workload identity configuration now matches the current Connection Configuration Specification. (#1079, #1044) • Identity agent headers — Identity agents created with the Agents SDK now send headers to M365. (#1118) • OpenTelemetry span links — Proactive operations now emit span links for better trace correlation. (#1138) • Better proactive messaging — Improved  createConversation  behavior in proactive scenarios and always set the  from  field. (#1087) • Composite M365 channel handling — OAuth conversation references now use the base channel for composite M365 channel IDs, and agent-channel conversation IDs are sanitized after truncation in ConnectorClient URLs. (#1104, #1115)

🧹 Modernization & Dependency Cleanup

• axios → native fetch — Replaced axios with the platform-native  fetch , including samples and docs. (#1139, #1140, #1124) • Removed lodash — Refactored  AdditionalProperties  handling in the  Recognizer  class to drop the lodash dependency. (#1098)

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.