4.19.2 Release checklist

This is a maintainer release checklist with every item already ticked, so there is no code change to start from. The files it names are CHANGELOG.md, package.json, package-lock.json, servicingPlan.json and the root docker-compose.yml and Dockerfile*. A newcomer would need the release process itself to act on it, so it is not a first task.

Checklist

Build

1. Bump MockBot to latest Bot Framework SDK release (not needed for patch release)
   • https://www.npmjs.com/package/botbuilder/v/latest
2. Bump botframework-directlinejs to 0.15.5 in PR #XXX
3. Update README.md with feature notes
4. Bump to 4.19.2
   • Update CHANGELOG.md to mark specific changes in 4.19.2
   • Run npm version --no-git-tag-version 4.19.2
   • Merged into v4.19.2, the PR number is #5869
   • Commit is 35afdb3
   • Do not merge any other unrelated changes after this PR. Any other PR merged, will need to be re-tested
5. Run build pipeline manually, set "Generate_Prod_Version_Number" to true
   • (This will not push to NPM or CDN)
   • Pipeline name is BotFramework-WebChat-Buddy
   • The build number is 20261008.2 and commit is 35afdb3
6. Run and wait for WebChat-release-testing pipeline to complete
   • Create a new tag/release v4.19.2 on WebChat-release-testing repo
   • Download *.tgz from the build
   • Compress *.tgz into tarballs.tar
   • Attach tarballs.tar to the release
   • Run the job with "Tag to deploy from" of v4.19.2
   • The job ID is 106
7. Check component governance and make sure there are no high/critical related to code under /packages/ folder (We are on QFE)
   • There could be some for projects under /samples/ folder, as they are pointing to previous version of Web Chat
8. Add manual tests to WebChat-release-testing as needed

Test

The test should run against the build artifacts from Azure Pipelines.

1. Manual testing on major browsers using webchat-release-testing
   • Before starting testing, update all the browser version to latest
   • Chrome 154.0.8037.99
   • Edge 154.0.4258.62
   • Firefox 157.0.1
   • IE11 (Windows 11 22H2 23531.1001)
   • macOS Safari 18.5 (xxxxx.x.xx.xxx.x)
   • iOS Safari 26.7
   • iPadOS Safari 26.6.1
   • Android Chrome 154.0.8037.92
2. Test specific fixes related to 4.19.2 and previous releases

Note: when the bot is sending a long message (say, markdown) via Direct Line Speech, the service may kill the connection. This is an issue on Direct Line Speech service and is not an issue about Web Chat.

Release

1. Make sure you are on main or qfe branch, run git status to check
2. git pull -ff
3. Verify /package.json, /package-lock.json, and CHANGELOG.md has a version of 4.19.2
4. git log
   • Verify the latest commit is 35afdb3
5. git tag v4.19.2
6. git push -u upstream v4.19.2
   • You do not need to kick off a build again, use the existing build
7. Create a new GitHub release
   • Copy entries from CHANGELOG.md
   • Subresource Integrity can be generated by
     • From local: for file in $(ls *.js); do echo $file $(cat $file | openssl dgst -sha384 -binary | openssl base64 -A); done
     • From CDN: curl -H 'Accept-Encoding: gzip' https://cdn.botframework.com/botframework-webchat/4.19.2/webchat.js | gunzip - | openssl dgst -sha384 -binary | openssl base64 -A
   • Attach assets including 3 JS files, stats.json and 6 tarballs
     • You can copy the artifacts from the BotFramework-WebChat-Official build
     • Tarballs download from npmjs

       curl -LO https://registry.npmjs.org/botframework-directlinespeech-sdk/-/botframework-directlinespeech-sdk-4.19.2.tgz
       curl -LO https://registry.npmjs.org/botframework-webchat/-/botframework-webchat-4.19.2.tgz
       curl -LO https://registry.npmjs.org/botframework-webchat-core/-/botframework-webchat-core-4.19.2.tgz
       curl -LO https://registry.npmjs.org/botframework-webchat-api/-/botframework-webchat-api-4.19.2.tgz
       curl -LO https://registry.npmjs.org/botframework-webchat-component/-/botframework-webchat-component-4.19.2.tgz
       

8. Kick off release to NPM
   • Release name is [ESRP] Nightly release
   • The build number is 20261008.2
   • The release number is 20261008.1 and commit is 35afdb3
   • Retain the release indefinitely
9. Kick off release to CDN (cutoff at 10 PM PST, Sun-Wed only)
   1. Prepare the message for approval
      • If there are any breaking changes, explain in the email if it will affect any customers
      • Release name is [[PROD]]Push-WebChat-Official-to-Prod-CDN-with-approval
      • The build number is XXXXXX, release number is 6 and commit is xxxxxxx
      • Script build number is 320590 (this is fixed)
   2. Send message to approvers
   3. Retain the build indefinitely

Post-release verification - complete within 30 minutes after release to NPM

• Test using webchat-release-testing
  1. Run and wait for WebChat-release-testing pipeline to complete
     • Run the job with "Version to deploy" of 4.19.2
     • The job ID is xxx
  2. Clone the GH Pages and check SHA
     • Using script tags from https://github.com/microsoft/BotFramework-WebChat/releases/tag/v4.19.2, with subresource integrity

       <script
       crossorigin="anonymous"
       integrity="sha384-ERvWMqZ/DEbYmsceJGEv19b+JMB1Z7LdOWfTmNqxR+CoSPu9K4IrStj7AJ9oqhgM"
       src="https://github.com/microsoft/BotFramework-WebChat/releases/download/v4.19.2/webchat.js"
       ></script>
       
       <script
       crossorigin="anonymous"
       integrity="sha384-9Lgcr0JMafYUZ3cTDrfbd5z+qdjKX83cV+nf7x/rSE5OAySwf/hRaMtYK2B8KMxi"
       src="https://github.com/microsoft/BotFramework-WebChat/releases/download/v4.19.2/webchat-es5.js"
       ></script>
       
       <script
       crossorigin="anonymous"
       integrity="sha384-QAcLvzyinyE4D/JsoYeB0W0Atv9s9bOshNt/n9SpqisN9W/yGfFcqkrHFztczYwY"
       src="https://github.com/microsoft/BotFramework-WebChat/releases/download/v4.19.2/webchat-minimal.js"
       ></script>
       

  3. npx serve (at repo root)
  4. Go to http://localhost:5000/ to test

Notification to interested parties

• Update partner page on Adaptive Cards doc (Not updating for QFE)
  • https://docs.microsoft.com/en-us/adaptive-cards/resources/partners
  • PR at https://github.com/MicrosoftDocs/AdaptiveCards/pull/XXX
• Notify related parties for the following fixes
  • Azure Bot Services
  • Copilot Studio
  • Omnichannel

Post-release checklist

These are chores that we should do before starting the cycle to reduce ripple effects if we do it in mid-cycle.

Tips:

• Clean your repo before start
• Remove node_modules from all folder
  • git clean -fdx
• Never delete package-lock.json
• If you mess it up, tableflip and redo
• In component/package.json
  • Remove reference to botframework-webchat-core by hand-modifying package.json
  • Then, npm install (symlinks will be broken afterward)
  • Then, add those references back by hand-modifying package.json
  • This also applies for other packages with similar dependencies/symlinks
  • To build afterward, do tableflip to rebuild those symlinks

Applies to all releases

This list should be copied to versions in the future.

• If on QFE branch, make sure CHANGELOG.md and version number bump is cherry-picked to main
  • git checkout main
  • git cherry-pick XXX (the commitish for bumping version number and CHANGELOG.md)
• If needed, correct the date for 4.19.2 in CHANGELOG.md in PR #XXX
  • There could be last minute fixes that could push the planned date later than the one in CHANGELOG.md
• Bump package.json to 4.19.3-0 in PR #XXX
  • Run npm version prepatch --no-git-tag-version
• Update servicingPlan.json in PR #XXXX (CDN is currently out of service)
  • Add deprecation notes for previous versions
  • Subresource integrity hash from https://github.com/microsoft/BotFramework-WebChat/releases/tag/v4.17.1
• Update all samples to use 4.19.2 in PR #XXXX (CDN is currently out of service)
  • Some samples are pointing to GitHub Releases because the sample need new features from daily build
  • Search "https://github.com/microsoft/BotFramework-WebChat/releases/download/"
    • And replace with "https://cdn.botframework.com/botframework-webchat/latest/"
• Clean up unnecessary branch on official repo
• Understand production-hitting vulnerabilities (This is QFE)
  • Create a new folder
  • Run npm init with default values
  • Run npm install [email protected] [email protected]
  • Look at the result and see if there are any production-hitting vulnerabilities, investigate if needed
    • No vulnerabilities found
• Bump in Copilot Studio (This is QFE)
• Update accessibility conformance report (This is QFE)
  • For any accessibility bugs resolved, remove them from external notes
  • Update version number and publish date

Applies to major/minor releases

Bump all dependencies to latest version

In PR #XXXX, we are bumping most dependencies to latest version.

After bumping, if a package broke compatibility, we should investigate:

• Upgrade our code to use the latest package if possible, otherwise;
• Add it to package.json/pinDependencies to prevent bumping deliberately
  • Pinning dependencies incur unpredictable technical debts, say, security issue found in the unsupported version, causing us slow to react
  • Every time we bump, we need to go through the whole pinDependencies list

• Run npm run bump
• Run npm audit fix to make sure everything is fixed
• List steps to verify bumping microsoft-cognitiveservices-speech-sdk

Bump Docker image

The Docker image can be found at root docker-compose.yml and Dockerfile*.

• Docker container for headless Chrome in PR #XXXX