[Sean Larkin (TheLarkInn)]

Summary

Update the Azure storage build-cache plugin to @azure/identity ~4.14.1, which requires @azure/msal-node ^7.1.0. The existing ~4.13.1 range cannot select this update and currently resolves MSAL Node 6.0.1 in a fresh published Rush installation.

Details

Reproduced using only public npm packages:

mkdir rush-msal-repro && cd rush-msal-repro
printf '{"private":true,"dependencies":{"@microsoft/rush-lib":"5.182.1"}}\n' > package.json
npm install --package-lock-only --ignore-scripts --no-audit --no-fund --registry https://registry.npmjs.org

The resulting lockfile contains this dependency chain:

@microsoft/rush-lib@5.182.1
  @rushstack/rush-azure-storage-build-cache-plugin@5.182.1
    @azure/identity@4.13.3       (requested ~4.13.1)
      @azure/msal-node@6.0.1    (requested ^6.0.0)

This changes the published dependency range, not just the monorepo's lockfile or an application-level override. The updated plugin resolves Azure Identity 4.14.1 and MSAL Node 7.1.2. Unrelated lockfile entries are unchanged; the older Azure Identity used by other development tools is retained.

Added two offline regression checks: Azure Identity's declared MSAL minimum must be at least 7.1.0, and the MSAL package actually resolved from Azure Identity must meet that minimum. Test-only semver dependencies are declared explicitly.

Compatibility: Azure Identity 4.14.1 requires Node.js 22 or newer, as does 4.13.3 currently selected by the previous range in fresh installs. Validation used the repository-supported Node.js 22.23.4. No authentication-flow or public API code is changed.

How it was tested

• Both new regression checks fail with the original Azure Identity dependency; all 33 existing plugin tests still pass.
• rush build --to @rushstack/rush-azure-storage-build-cache-plugin passes, including the dependency closure, type-checking, lint, and API extraction.
• rush test --only @rushstack/rush-azure-storage-build-cache-plugin passes all 35 tests.
• rush install --subspace default --max-install-attempts 1 accepts the final lockfile and generated repository state.
• rush change --verify --no-fetch --target-branch origin/main passes.
• Packed the updated plugin with rush-pnpm pack and installed it alongside public @microsoft/rush-lib@5.182.1 in a separate clean fixture. npm deduplicates Rush's plugin dependency to the packed plugin and resolves @azure/identity@4.14.1 -> @azure/msal-node@7.1.2.

Includes a Rush patch change file.