Skip to content

[auto-sec] Consolidate aspire dependency security remediations (75 alerts) - #20032

Merged
David Pine (IEvangelist) merged 3 commits into
mainfrom
dapire/security-deps/aspire-npm-lockfiles
Sep 21, 2026
Merged

[auto-sec] Consolidate aspire dependency security remediations (75 alerts)#20032
David Pine (IEvangelist) merged 3 commits into
mainfrom
dapire/security-deps/aspire-npm-lockfiles

Conversation

@IEvangelist

@IEvangelist David Pine (IEvangelist) commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

[auto-sec] aspire dependency security consolidation

Canonical automated-security remediation PR for microsoft/aspire. Converges the repo's open Dependabot alerts into a single change set. No application source changes — only lockfiles plus minimal, same-major overrides / resolutions.

Alerts addressed

Clears 74 of 75 open Dependabot alerts (all npm ecosystem): 2 critical, 28 high, 44 moderate, 1 low. 1 deferred (see below).

Mechanism by manifest kind

Kind Count How
npm package-lock.json 25 targeted overrides + npm install --package-lock-only
pnpm-lock.yaml (AspireWithNode/NodeFrontend) 1 pnpm.overrides + pnpm install
yarn.lock (extension) 1 resolutions + yarn install (dnceng public feed)

Key version bumps

  • next 16.2.11 → 16.3.3 (critical)
  • qs → 6.16.0, fast-uri → 3.1.6, @humanfs/node → 0.16.8, browserslist → 4.28.7, js-yaml → 4.3.2, nanoid → 3.3.18, hono → 4.13.5, postcss-selector-parser → 7.1.3, decode-uri-component → 0.5.0 (npm dirs), @opentelemetry/core → 2.8.0, @opentelemetry/propagator-jaeger → 2.9.0, sharp → 0.35.4, vitest / @vitest/mocker → 4.1.11

extension/yarn.lock feed handling

The VS Code extension resolves yarn deps from the dnceng public Azure Artifacts feed, and CI runs yarn install --frozen-lockfile against it anonymously. Only versions already cached on that feed are anonymously downloadable. To keep the frozen install green, browserslist's transitive data-deps are pinned to the feed's cached versions (all satisfy browserslist@4.28.7's caret ranges):

  • baseline-browser-mapping → 2.11.20, electron-to-chromium → 1.5.420, node-releases → 2.0.54

Deferred alert (1)

decode-uri-component ≥ 0.5.0 in extension/yarn.lock (moderate). The 0.5.0 tarball is not cached on the dnceng public feed (anonymous request returns 401); since CI accesses the feed anonymously, pinning it would break the extension build. Left at the current cached 0.2.2. Unblock: a maintainer with authenticated access to the internal feed regenerates extension/yarn.lock (which primes the cache), after which 0.5.0 becomes anonymously available and this alert clears. Every other extension alert (qs, fast-uri, js-yaml, @humanfs/node, browserslist) is remediated.

Verification

Static check of every alert's installed version in the regenerated lockfiles vs first-patched: 74/75 cleared, 1 deferred as above. No private-feed URLs leaked; local yarn install --frozen-lockfile against dnceng passes.

Superseded / tracked Dependabot PRs

Closed once this canonical PR is green and merged (closure gate): #19513, #19844, #19845, #19863.
Out of scope (non-npm): #19852 (GitHub Actions), #19075 (Maven).

Idempotency

Branch dapire/security-deps/aspire-npm-lockfiles from latest upstream/main. Label automated-security. Prefix [auto-sec].

@IEvangelist David Pine (IEvangelist) added the automated-security Automated security fix label Sep 10, 2026
@IEvangelist David Pine (IEvangelist) mentioned this pull request Sep 10, 2026
Closed
@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20032

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20032"

This was referenced Sep 10, 2026
Closed
Closed
@github-actions github-actions Bot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Sep 10, 2026
@IEvangelist David Pine (IEvangelist) mentioned this pull request Sep 10, 2026
Closed
@aspire-repo-bot
aspire-repo-bot Bot requested a balanced review from Copilot September 10, 2026 14:34
@github-actions

This comment has been minimized.

Sign in to view
Copilot AI reviewed Sep 10, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Extension restore fails on an unavailable mirrored tarball, and the ESM override breaks a CommonJS dependency.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Consolidates npm security remediations across extension, templates, tests, and playgrounds without application source changes.

Changes:

  • Pins patched transitive dependencies through overrides/resolutions.
  • Regenerates npm, pnpm, and Yarn lockfiles.
  • Updates Next.js and Vitest to patched releases.
File summaries
File Description
extension/package.json Adds security resolutions.
extension/yarn.lock Refreshes resolved extension dependencies.
playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json Locks patched Angular dependencies.
playground/AspireWithJavaScript/AspireJavaScript.Angular/package.json Adds Angular dependency overrides.
playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package-lock.json Locks patched Node dependencies.
playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package.json Overrides qs.
playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json Locks patched React dependencies.
playground/AspireWithJavaScript/AspireJavaScript.React/package.json Adds React dependency overrides.
playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json Locks patched Vite dependencies.
playground/AspireWithJavaScript/AspireJavaScript.Vite/package.json Adds Vite dependency overrides.
tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package.json Overrides qs.
tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package-lock.json Locks patched Vitest dependencies.
tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package.json Pins Vitest packages.
playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json Locks patched Vue dependencies.
playground/AspireWithJavaScript/AspireJavaScript.Vue/package.json Adds Vue dependency overrides.
playground/AspireWithNode/NodeFrontend/package-lock.json Locks patched npm graph.
playground/AspireWithNode/NodeFrontend/package.json Aligns npm and pnpm overrides.
playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml Locks patched pnpm graph.
playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json Locks patched browser dependencies.
playground/BrowserTelemetry/BrowserTelemetry.Web/package.json Adds browser dependency overrides.
playground/FoundryAgentEnterprise/frontend/package-lock.json Locks patched frontend dependencies.
playground/FoundryAgentEnterprise/frontend/package.json Overrides @humanfs/node.
playground/JavaAppHost/api/package-lock.json Locks patched API dependencies.
playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package.json Overrides qs.
playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json Locks patched browser dependencies.
playground/TypeScriptApps/RpsArena/arena-frontend/package.json Adds browser overrides.
playground/TypeScriptApps/RpsArena/node-player/package-lock.json Locks patched qs graph.
playground/TypeScriptApps/RpsArena/node-player/package.json Overrides qs.
src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json Updates Java starter lockfile.
src/Aspire.Cli/Templating/Templates/java-starter/frontend/package.json Overrides @humanfs/node.
src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json Updates Python frontend lockfile.
src/Aspire.Cli/Templating/Templates/py-starter/frontend/package.json Overrides @humanfs/node.
src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json Updates Python starter lockfile.
playground/JavaAppHost/api/package.json Adds telemetry and qs overrides.
playground/JavaAppHost/frontend/package-lock.json Updates Java frontend lockfile.
playground/JavaAppHost/frontend/package.json Overrides @humanfs/node.
playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json Locks patched qs graph.
playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package.json Overrides qs.
playground/PythonAppHost/frontend/package-lock.json Updates Python playground lockfile.
playground/PythonAppHost/frontend/package.json Overrides @humanfs/node.
playground/TypeScriptAppHost/express-api/package-lock.json Locks patched qs graph.
playground/TypeScriptAppHost/express-api/package.json Overrides qs.
playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json Locks patched qs graph.
src/Aspire.Cli/Templating/Templates/py-starter/package.json Overrides @humanfs/node.
src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json Updates TypeScript frontend lockfile.
src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package.json Overrides @humanfs/node.
src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json Updates TypeScript starter lockfile.
src/Aspire.Cli/Templating/Templates/ts-starter/package.json Overrides @humanfs/node.
src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package-lock.json Updates project-template lockfile.
src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package.json Overrides @humanfs/node.
tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json Locks patched Next.js graph.
tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package.json Updates Next.js and overrides.
tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package-lock.json Locks patched qs graph.
Review details

Files not reviewed (26)

  • playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml: Generated file
  • playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json: Generated file
  • playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
  • playground/JavaAppHost/api/package-lock.json: Generated file
  • playground/JavaAppHost/frontend/package-lock.json: Generated file
  • playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json: Generated file
  • playground/PythonAppHost/frontend/package-lock.json: Generated file
  • playground/TypeScriptAppHost/express-api/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/node-player/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json: Generated file
  • src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package-lock.json: Generated file
  • tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json: Generated file
  • tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package-lock.json: Generated file
  • tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package-lock.json: Generated file
  • Files reviewed: 26/53 changed files
  • Comments generated: 1
  • Review effort level: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Comment thread extension/package.json Outdated
@IEvangelist
[auto-sec] Consolidate aspire npm/pnpm/yarn dependency security remed…
1f91553 
…iations

Clears 74 of 75 open Dependabot alerts (all npm ecosystem) across 27 manifests
via targeted overrides/resolutions + lockfile regeneration. No application source
changes.

Ecosystem mechanism:
- 25 package-lock.json: npm overrides + npm install --package-lock-only
- 1 pnpm-lock.yaml (AspireWithNode/NodeFrontend): pnpm.overrides
- 1 yarn.lock (extension): resolutions (dnceng public feed preserved)

Key bumps: next 16.2.11->16.3.3 (critical), qs 6.16.0, fast-uri 3.1.6,
@humanfs/node 0.16.8, browserslist 4.28.7, js-yaml 4.3.2, nanoid 3.3.18,
hono 4.13.5, postcss-selector-parser 7.1.3, @opentelemetry/core 2.8.0, sharp
0.35.4, vitest 4.1.11.

extension/yarn.lock: pinned browserslist's transitive data-deps to versions
cached on the dnceng public feed (baseline-browser-mapping 2.11.20,
electron-to-chromium 1.5.420, node-releases 2.0.54) so the anonymous
--frozen-lockfile CI install resolves.

Deferred (1 alert): decode-uri-component >=0.5.0 in extension/yarn.lock. The
0.5.0 tarball is not cached on the dnceng public feed (anonymous 401) and the CI
feed access is anonymous, so pinning it would break the extension build. Kept at
the current cached 0.2.2 pending a maintainer regenerating the lock through the
authenticated internal feed to prime the cache.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@IEvangelist
David Pine (IEvangelist) force-pushed the dapire/security-deps/aspire-npm-lockfiles branch from 3f2ecfd to 1f91553 Compare September 10, 2026 14:56
@aspire-repo-bot
aspire-repo-bot Bot requested a balanced review from Copilot September 10, 2026 14:57
@github-actions

This comment has been minimized.

Sign in to view
Copilot AI reviewed Sep 10, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The broad multi-manager lockfile refresh and feed-sensitive extension restore require final CI and human validation.

Review details

Files not reviewed (26)

  • playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml: Generated file
  • playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json: Generated file
  • playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
  • playground/JavaAppHost/api/package-lock.json: Generated file
  • playground/JavaAppHost/frontend/package-lock.json: Generated file
  • playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json: Generated file
  • playground/PythonAppHost/frontend/package-lock.json: Generated file
  • playground/TypeScriptAppHost/express-api/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/node-player/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json: Generated file
  • src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package-lock.json: Generated file
  • tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json: Generated file
  • tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package-lock.json: Generated file
  • tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package-lock.json: Generated file
  • Files reviewed: 26/53 changed files
  • Comments generated: 0 new
  • Review effort level: Balanced

@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions github-actions Bot mentioned this pull request Sep 11, 2026
Open
David Pine
Merge upstream main and resolve dependency security conflicts
683298c 
Preserve newer upstream dependency versions and regenerate lockfiles for the security remediations still needed. Retain existing Yarn and pnpm fixes and platform-specific lockfile metadata.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@aspire-repo-bot
aspire-repo-bot Bot requested a balanced review from Copilot September 21, 2026 13:06
@github-actions

This comment has been minimized.

Sign in to view
Copilot AI reviewed Sep 21, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Both shipped starter lockfiles now use the dnceng feed, violating their public-registry test and customer restore contract.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 2 High severity

Open (2)
Files not reviewed (13)
  • playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml: Generated file
  • playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json: Generated file
  • playground/JavaAppHost/api/package-lock.json: Generated file
  • playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json: Generated file
  • playground/TypeScriptAppHost/express-api/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/node-player/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json: Generated file
  • tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json: Generated file
  • tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package-lock.json: Generated file

Comment thread src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json Outdated
Comment thread src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json Outdated
@github-actions

github-actions Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

David Pine
Preserve public npm registry in shipped starter lockfiles
2771a92 
Regenerate the Python and TypeScript AppHost lockfiles against registry.npmjs.org. Retain the security-patched dependency versions and graph while removing repository feed URLs introduced during merge conflict resolution.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@aspire-repo-bot
aspire-repo-bot Bot requested a balanced review from Copilot September 21, 2026 14:49
@github-actions

github-actions Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

Tests selector

3 / 99 PR test projects · 6 PR jobs, from 27 changed files.

Selected PR test projects (3 / 99)

Aspire.Cli.EndToEnd.Tests, Aspire.Cli.Tests, Aspire.Playground.Tests

Selected PR jobs (6)

cli-starter-validation, extension-e2e, extension-unit, polyglot, typescript-api-compat, typescript-sdk

How these were chosen — grouped by what changed

📦 affected project Aspire.Cli
→ 1 test: Aspire.Cli.EndToEnd.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.React/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithNode/NodeFrontend/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithNode/NodeFrontend/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/BrowserTelemetry/BrowserTelemetry.Web/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/JavaAppHost/api/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/JavaAppHost/api/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptAppHost/express-api/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptAppHost/express-api/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/RpsArena/node-player/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/RpsArena/node-player/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

🔧 src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json (changed source)
→ 1 via the project graph: Aspire.Cli.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package.json (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package-lock.json (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package.json (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

Job reasons

Job Triggered by
cli-starter-validation affected project Aspire.Cli
extension-e2e • extension/package.json, extension/yarn.lock, src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json, src/Aspire.Cli/Templating/Templates/py-starter/package.json, src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json, src/Aspire.Cli/Templating/Templates/ts-starter/package.json
• affected project Aspire.Cli
extension-unit extension/package.json, extension/yarn.lock
polyglot affected project Aspire.Cli
typescript-api-compat affected project Aspire.Cli
typescript-sdk src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json, src/Aspire.Cli/Templating/Templates/ts-starter/package.json

Selection computed for commit 2771a92.

Copilot AI reviewed Sep 21, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The dependency overrides and regenerated lockfiles are consistent, with no unresolved code issue found beyond the documented deferred alert.

Review effort: Balanced
Findings: None

Resolved since last review (2)
Files not reviewed (13)
  • playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml: Generated file
  • playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json: Generated file
  • playground/JavaAppHost/api/package-lock.json: Generated file
  • playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json: Generated file
  • playground/TypeScriptAppHost/express-api/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/node-player/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json: Generated file
  • tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json: Generated file
  • tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package-lock.json: Generated file

@github-actions

github-actions Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@IEvangelist
David Pine (IEvangelist) merged commit 32e2ee8 into main Sep 21, 2026
527 of 538 checks passed
@github-actions github-actions Bot added this to the 13.6 milestone Sep 21, 2026
@aspire-repo-bot

aspire-repo-bot Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

✅ No documentation update needed.

Step 5 branch taken: docs_required → true false positive (no concrete documentation edit possible)

Although signals.json reports recommendation: "docs_required" with 2 triggered signals, on inspection both are false positives that do not correspond to any Aspire user-facing feature, CLI flag, API, or behavior change:

Triggered signals (2):

  1. pr_body_has_cli_flag_mention — evidence hint: des` + `npm install --package-lock-only` | | `pnpm-lock.yaml` (AspireWithNode/NodeFrontend) | 1 | `. This matched the generic flag-mention pattern against npm install --package-lock-only, which is a standard npm CLI flag used to regenerate lockfiles during the remediation process — not an Aspire CLI flag, option, or command. There is no Aspire-facing flag change here.
  2. pr_label_security — evidence hint: automated-security. This label is applied to this PR's automated dependency-remediation workflow (consolidating Dependabot alerts into lockfile updates), not to a security feature, vulnerability disclosure, or behavior change within Aspire itself that a user would need to read about.

Verification performed: searched src/frontend/src/content/docs/ for package-lock-only, automated-security, decode-uri-component, and browserslist — no matches, confirming these are not existing documented concepts and, more importantly, are not concepts that need new documentation, since they don't describe any change to Aspire's product surface.

Nature of the change: The PR body explicitly states "No application source changes — only lockfiles plus minimal, same-major overrides / resolutions." All 27 changed files are package.json, package-lock.json, yarn.lock, or pnpm-lock.yaml files across playground samples, templates, test fixtures, and the VS Code extension — pure npm/pnpm/yarn dependency version bumps to remediate Dependabot security alerts (e.g. next 16.2.11→16.3.3, qs, browserslist, etc.). None of these are Aspire public

(summary truncated)

This was referenced Sep 21, 2026
Closed
Open
@github-actions

github-actions Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

⚠️ CI Failure Analysis: Possible Flaky Test(s)

The CI build failed due to test failure(s) that appear unrelated to the PR changes. These may be flaky tests.

Suspected flaky test(s):

  • Aspire Blazor browser debugger E2E hits a managed breakpoint for standalone in job Tests / Run VS Code extension E2E tests / VS Code extension E2E (Windows, browser-debugger)
    • Error: Failed to apply E2E control revision 1790010306876: Error: Timed out after 295072ms waiting for pwa-msedge child session for Blazor WASM root '3ea58472-1f31-4783-9985-8a2054c68ec0'. Last error: . State: {"debugSessions":[{"id":"764f6cf2-6d48-414a-b99a-835cc94bf1e4","type":"monovsdbg_wasm","name":"Wasm Managed Debugger", ...}]}
    • Stack Trace (first frames):
Error: Failed to apply E2E control revision 1790010306876: Error: Timed out after 295072ms waiting for pwa-msedge child session for Blazor WASM root '3ea58472-1f31-4783-9985-8a2054c68ec0'. Last error: <none>. State: {...}
  • Why likely flaky: Timeout waiting for the pwa-msedge child debug session for a Blazor WASM root is a known intermittent timing issue in the VS Code extension E2E browser-debugger suite, unrelated to the PR which only touches package.json/lockfile dependency versions.
  • Aspire dynamic debug configuration E2E "after each" hook for "re-resolves the selected AppHost by dynamic configuration name in duplicate-alias workspaces" in job Tests / Run VS Code extension E2E tests / VS Code extension E2E (Windows, dynamic-debug-configuration)
    • Error: Dynamic debug configuration E2E teardown failed.
  1. Error: EBUSY: resource busy or locked, rmdir 'C:\Users\runneradmin\AppData\Local\Temp\aev-drchR9\workspace.e2e-dynamic-debug\first'
  • Stack Trace (first frames):
AggregateError: Dynamic debug configuration E2E teardown failed.
1. Error: EBUSY: resource busy or locked, rmdir 'C:\Users\runneradmin\AppData\Local\Temp\aev-drchR9\workspace\.e2e-dynamic-debug\first'
    at runE2eTeardown (out\test-e2e\test-e2e\helpers\fixtures.js:217:15)
    at async Context.<anonymous> (out\test-e2e\test-e2e\dynamicDebugConfiguration.e2e.test.js:62:9)
  • Why likely flaky: EBUSY resource-busy errors on rmdir of a Windows temp workspace directory during E2E test teardown are a known recurring infrastructure/timing issue (antivirus/file-handle contention), unrelated to the PR's dependency lockfile changes.

Suggested actions:

  • Re-run the failed CI jobs to confirm if the failure is intermittent
  • If the test continues to fail, consider quarantining it using /quarantine-test <test name> <issue URL>
  • Search existing issues to see if this test is already known to be flaky

You can re-run the failed jobs from the workflow run page.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Balanced
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@mitchdenny Mitch Denny (mitchdenny) mitchdenny approved these changes
@adamint Adam Ratzman (adamint) Awaiting requested review from adamint adamint is a code owner
@ellahathaway Ella Hathaway (ellahathaway) Awaiting requested review from ellahathaway ellahathaway is a code owner
@JamesNK James Newton-King (JamesNK) Awaiting requested review from JamesNK JamesNK is a code owner
@davidfowl David Fowler (davidfowl) Awaiting requested review from davidfowl davidfowl is a code owner

Assignees

No one assigned

Labels

automated-security Automated security fix needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners

Projects

None yet

Milestone

13.6

Development

Successfully merging this pull request may close these issues.

3 participants

@IEvangelist @mitchdenny