ci: upgrade ESRP Release task to v14

.azure-pipelines/ci-build-production.yml

@@ -126,7 +126,7 @@ extends:
                   steps:
                     - checkout: none
                     - download: none
-                    - task: EsrpRelease@9
+                    - task: EsrpRelease@14
                       displayName: Publish npm package via ESRP Release
                       inputs:
                         connectedservicename: Federated DevX ESRP Managed Identity Connection

CONTRIBUTING.md

@@ -146,7 +146,7 @@ The **Build** stage tests the SDK on Windows with Node.js 22, 24, and 26, and bu
 
 To validate the migration before merging, manually queue **Graph JS SDK Build pipeline** against the PR branch. Manual runs remain build-only and never deploy to npm, including manual runs targeting a tag. An Azure DevOps administrator may need to authorize the `1ESPipelineTemplates/1ESPipelineTemplates` repository and the `Azure-Pipelines-1ESPT-ExDShared` pool for this pipeline. Confirm that the pool provides the Windows and Ubuntu images used here, including Chrome for the Windows browser tests, and that the template's SDL checks pass. Download `sdk-build` and inspect/install the tarball in a clean consumer project before releasing.
 
-After a successful validation and merge to `main`, push a release tag in the `vX.X.X` format whose numeric version matches `package.json`, such as `v3.1.0`, on the intended release commit. The tag trigger uses Azure's `v*.*.*` wildcard filter, not a regular expression. A build-time equality check additionally requires the entire tag to equal `v` followed by the package version before packing. It does not independently validate semantic-version syntax. Unprefixed tag pushes do not trigger a release. The separate **Publish** stage runs only after the build and tests succeed, and only for CI runs triggered by a `v`-prefixed tag push. Its production deployment job consumes the same `sdk-build` tarball and submits it to `EsrpRelease@9` for npm package distribution. The 1ES release job cannot emit artifact outputs; neither packing nor building runs again during deployment. Creating or pushing a release tag is a release action; do not do so for build-only validation.
+After a successful validation and merge to `main`, push a release tag in the `vX.X.X` format whose numeric version matches `package.json`, such as `v3.1.0`, on the intended release commit. The tag trigger uses Azure's `v*.*.*` wildcard filter, not a regular expression. A build-time equality check additionally requires the entire tag to equal `v` followed by the package version before packing. It does not independently validate semantic-version syntax. Unprefixed tag pushes do not trigger a release. The separate **Publish** stage runs only after the build and tests succeed, and only for CI runs triggered by a `v`-prefixed tag push. Its production deployment job consumes the same `sdk-build` tarball and submits it to `EsrpRelease@14` for npm package distribution. This task uses a Node.js 20 handler instead of the end-of-life Node.js 16 handler in v9. The 1ES release job cannot emit artifact outputs; neither packing nor building runs again during deployment. Creating or pushing a release tag is a release action; do not do so for build-only validation.
 
 Deployment reuses the TypeScript SDK's `msgraph-npm-org` environment, federated DevX ESRP service connection, certificate references, and configured release owners/approvers. Before pushing a release tag, authorize this pipeline to use those resources, verify the environment's approval/check policies, confirm ESRP is authorized to distribute `@microsoft/microsoft-graph-client`, and confirm the intended npm dist-tag policy. The shared configuration's name alone does not establish access to this package's `@microsoft` scope. Check that the release version is not already published.