Skip to content

[auto-sec] Consolidate Aspire JavaScript template dependency security remediations - #18858

Merged
Adam Ratzman (adamint) merged 18 commits into
mainfrom
dapire/security-deps/aspire-lowrisk-batch
Aug 4, 2026
Merged

[auto-sec] Consolidate Aspire JavaScript template dependency security remediations#18858
Adam Ratzman (adamint) merged 18 commits into
mainfrom
dapire/security-deps/aspire-lowrisk-batch

Conversation

@IEvangelist

@IEvangelist David Pine (IEvangelist) commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

[auto-sec] Canonical — Aspire JavaScript template/playground dependency cluster

Branch: dapire/security-deps/aspire-lowrisk-batch · Label: automated-security
Base: on latest origin/main — rebased 2026-08-03 (onto #18958; clean, 0 conflicts, 0 behind, 0 file overlap). Prior rebase 2026-08-01 folded #18947 + #18594.

Single canonical consolidation PR for the low-risk npm/yarn dependency security remediations across the JavaScript playgrounds, project templates, and JS test fixtures.

Security patches applied

Coverage expansion

Closed 14 previously-uncovered alerts with surgical single-entry lockfile bumps (leaf deps; every parent caret range verified offline with semver; integrity cross-verified out-of-band):

Deferred — VS Code extension (extension/)

The extension installs via the internal dnceng dotnet-public-npm feed (yarn classic, guarded so every resolved URL must point at that feed). That pull-through cache has postcss 8.5.10 mirrored, but 8.5.20 returns 401 Unauthorized (not yet mirrored), which broke the extension bootstrap/unit-test jobs. extension/package.json + extension/yarn.lock are therefore reverted to the origin/main baseline (postcss 8.5.10) to keep the extension build green. Deferred until targets are promoted into the dnceng feed (maintainer/Dependabot with feed write access — not possible from this automation environment):

Deferred — other clusters (documented blockers)

Verification

  • CI: 337 checks GREEN, 0 failures on the pre-rebase head (3 skipped by path filters). The 2026-08-01 rebase folded two unrelated upstream commits (eng/* dcp bump + extension/* fix) with zero overlap on this PR's 38 npm manifests, so the tree diff vs main is byte-identical for the security changes. CI has since re-greened post-rebase: 337 checks GREEN, 0 failures (confirmed 2026-08-02), still 0 commits behind origin/main.
  • MERGEABLE, conflict-free, 0 commits behind origin/main. Remaining BLOCKED state is the repo's human review + needs-area-label gate, not CI.
  • Coverage-expansion edits validated offline (JSON parse + semver range satisfaction) before push.

Related PRs

  • No overlapping open Dependabot PRs on microsoft/aspire (Dependabot security-update PRs are consolidated here). This is the single canonical [auto-sec] PR for the repo's JS dependency cluster.

Copilot AI balanced review requested due to automatic review settings July 22, 2026 11:07
@IEvangelist David Pine (IEvangelist) added the automated-security Automated security fix label Jul 22, 2026
@github-actions

github-actions Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 18858

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 18858"

@github-actions github-actions Bot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Jul 22, 2026
Copilot AI reviewed Jul 22, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Consolidates JavaScript dependency security remediations across Aspire templates and playgrounds.

Changes:

  • Upgrades ESLint and TypeScript ESLint dependencies.
  • Refreshes transitive dependency lock graphs.
  • Upgrades shell-quote to 1.10.0.

Reviewed changes

Copilot reviewed 7 out of 16 changed files in this pull request and generated 7 comments.

Show a summary per file
File Description
src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package.json Updates lint dependencies.
src/Aspire.Cli/Templating/Templates/py-starter/frontend/package.json Updates lint dependencies.
src/Aspire.Cli/Templating/Templates/java-starter/frontend/package.json Updates lint dependencies.
src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json Refreshes secured transitive dependencies.
playground/PythonAppHost/frontend/package.json Updates lint dependencies.
playground/PythonAppHost/frontend/package-lock.json Refreshes secured transitive dependencies.
playground/JavaAppHost/frontend/package.json Updates lint dependencies.
playground/JavaAppHost/frontend/package-lock.json Refreshes secured transitive dependencies.
playground/FoundryAgentEnterprise/frontend/package.json Updates lint dependencies.
playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json Upgrades shell-quote.
playground/AspireWithJavaScript/AspireJavaScript.Vite/package.json Updates lint dependencies.
playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json Upgrades shell-quote.
Files not reviewed (9)
  • playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json: Generated file
  • playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
  • playground/JavaAppHost/frontend/package-lock.json: Generated file
  • playground/PythonAppHost/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json: Generated file

Comment thread src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package.json Outdated
Comment thread src/Aspire.Cli/Templating/Templates/py-starter/frontend/package.json Outdated
Comment thread src/Aspire.Cli/Templating/Templates/java-starter/frontend/package.json Outdated
Comment thread playground/PythonAppHost/frontend/package.json Outdated
Comment thread playground/JavaAppHost/frontend/package.json Outdated
Comment thread playground/FoundryAgentEnterprise/frontend/package.json Outdated
Comment thread playground/AspireWithJavaScript/AspireJavaScript.Vite/package.json Outdated
@github-actions

This comment has been minimized.

Sign in to view
@github-actions

github-actions Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

chaiphet6669-afk
chaiphet6669-afk reviewed Jul 22, 2026
View reviewed changes

@chaiphet6669-afk chaiphet6669-afk left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

review rewrite

@github-actions

github-actions Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions github-actions Bot mentioned this pull request Jul 22, 2026
Open
Copilot AI review requested due to automatic review settings July 23, 2026 11:03
@IEvangelist
David Pine (IEvangelist) force-pushed the dapire/security-deps/aspire-lowrisk-batch branch from 7f1e343 to 7e04e81 Compare July 23, 2026 11:03
@IEvangelist David Pine (IEvangelist) mentioned this pull request Jul 23, 2026
Closed
@github-actions

This comment has been minimized.

Sign in to view
Copilot AI reviewed Jul 23, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 16 changed files in this pull request and generated 1 comment.

Files not reviewed (9)
  • playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json: Generated file
  • playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
  • playground/JavaAppHost/frontend/package-lock.json: Generated file
  • playground/PythonAppHost/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json: Generated file

Comment thread playground/AspireWithJavaScript/AspireJavaScript.Vite/package.json Outdated
@github-actions

github-actions Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

JamesNK
James Newton-King (JamesNK) reviewed Jul 24, 2026
View reviewed changes

@JamesNK James Newton-King (JamesNK) left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed the existing dependency blockers on the current head:

  • npm ci --ignore-scripts fails with ERESOLVE in both a representative starter and the Vite playground because eslint-plugin-react-hooks only supports ESLint through 9 while these manifests request ESLint 10.
  • The manifests allow Node 22.12, while ESLint 10 requires Node 22.13 or newer.
  • The Vite playground still uses legacy .eslintrc.cjs, which ESLint 10 no longer supports.

The existing unresolved inline threads already identify each affected location, so I have not duplicated them.

@IEvangelist
David Pine (IEvangelist) force-pushed the dapire/security-deps/aspire-lowrisk-batch branch from 7e04e81 to 2ced3cd Compare July 24, 2026 11:04
Copilot AI review requested due to automatic review settings July 24, 2026 11:04
@github-actions

This comment has been minimized.

Sign in to view
Copilot AI reviewed Jul 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 16 changed files in this pull request and generated no new comments.

Files not reviewed (9)
  • playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json: Generated file
  • playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
  • playground/JavaAppHost/frontend/package-lock.json: Generated file
  • playground/PythonAppHost/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json: Generated file
Comments suppressed due to low confidence (14)

src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package.json:25

  • ESLint 10 is incompatible with the existing eslint-plugin-react-hooks 5.2.0 dependency: its peer range stops at ESLint 9 (package-lock.json:1051). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
    "eslint": "^10.7.0",

src/Aspire.Cli/Templating/Templates/py-starter/frontend/package.json:25

  • ESLint 10 is incompatible with the existing eslint-plugin-react-hooks 5.2.0 dependency: its peer range stops at ESLint 9 (package-lock.json:1051). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
    "eslint": "^10.7.0",

src/Aspire.Cli/Templating/Templates/java-starter/frontend/package.json:25

  • ESLint 10 is incompatible with the existing eslint-plugin-react-hooks 5.2.0 dependency: its peer range stops at ESLint 9 (package-lock.json:1051). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
    "eslint": "^10.7.0",

playground/PythonAppHost/frontend/package.json:25

  • ESLint 10 is incompatible with the existing eslint-plugin-react-hooks 5.2.0 dependency: its peer range stops at ESLint 9 (package-lock.json:1051). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
    "eslint": "^10.7.0",

playground/JavaAppHost/frontend/package.json:25

  • ESLint 10 is incompatible with the existing eslint-plugin-react-hooks 5.2.0 dependency: its peer range stops at ESLint 9 (package-lock.json:1051). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
    "eslint": "^10.7.0",

playground/FoundryAgentEnterprise/frontend/package.json:25

  • ESLint 10 is incompatible with the existing eslint-plugin-react-hooks 5.2.0 dependency: its peer range stops at ESLint 9 (package-lock.json:1051). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
    "eslint": "^10.7.0",

playground/AspireWithJavaScript/AspireJavaScript.Vite/package.json:27

  • ESLint 10 is incompatible with eslint-plugin-react-hooks 7.0.1: its peer range stops at ESLint 9 (package-lock.json:1436). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
    "eslint": "^10.7.0",

src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package.json:25

  • This upgrade raises ESLint's Node requirement to ^20.19.0 || ^22.13.0 || >=24, but this package still declares Node >=22.12.0 as supported. On Node 22.12 the generated project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
    "eslint": "^10.7.0",

src/Aspire.Cli/Templating/Templates/py-starter/frontend/package.json:25

  • This upgrade raises ESLint's Node requirement to ^20.19.0 || ^22.13.0 || >=24, but this package still declares Node >=22.12.0 as supported. On Node 22.12 the generated project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
    "eslint": "^10.7.0",

src/Aspire.Cli/Templating/Templates/java-starter/frontend/package.json:25

  • This upgrade raises ESLint's Node requirement to ^20.19.0 || ^22.13.0 || >=24, but this package still declares Node >=22.12.0 as supported. On Node 22.12 the generated project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
    "eslint": "^10.7.0",

playground/PythonAppHost/frontend/package.json:25

  • This upgrade raises ESLint's Node requirement to ^20.19.0 || ^22.13.0 || >=24, but this package still declares Node >=22.12.0 as supported. On Node 22.12 the project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
    "eslint": "^10.7.0",

playground/JavaAppHost/frontend/package.json:25

  • This upgrade raises ESLint's Node requirement to ^20.19.0 || ^22.13.0 || >=24, but this package still declares Node >=22.12.0 as supported. On Node 22.12 the project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
    "eslint": "^10.7.0",

playground/FoundryAgentEnterprise/frontend/package.json:25

  • This upgrade raises ESLint's Node requirement to ^20.19.0 || ^22.13.0 || >=24, but this package still declares Node >=22.12.0 as supported. On Node 22.12 the project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
    "eslint": "^10.7.0",

playground/AspireWithJavaScript/AspireJavaScript.Vite/package.json:27

  • This upgrade raises ESLint's Node requirement to ^20.19.0 || ^22.13.0 || >=24, but this package still declares Node >=22.12.0 as supported. On Node 22.12 the project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
    "eslint": "^10.7.0",

@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

Adam Ratzman
Ensure npm global installs use internal registry
d972fa6 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 7bcb8ff2-8403-485d-a153-2fb066e70e4f
Copilot AI review requested due to automatic review settings August 4, 2026 06:25
@github-actions

This comment has been minimized.

Sign in to view
Copilot AI reviewed Aug 4, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review details

Files not reviewed (22)
  • playground/AspireWithBun/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml: Generated file
  • playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json: Generated file
  • playground/DotnetProject/TypeScriptAppHost/package-lock.json: Generated file
  • playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
  • playground/JavaAppHost/frontend/package-lock.json: Generated file
  • playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json: Generated file
  • playground/PythonAppHost/frontend/package-lock.json: Generated file
  • playground/TypeScriptAppHost/express-api/package-lock.json: Generated file
  • playground/TypeScriptAppHost/package-lock.json: Generated file
  • playground/TypeScriptAppHost/vite-frontend/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/AppHost/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptFunctions/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/node-player/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json: Generated file
  • Files reviewed: 31/193 changed files
  • Comments generated: 1
  • Review effort level: Balanced

Comment thread src/Aspire.Cli/Agents/Playwright/PlaywrightCliInstaller.cs
Adam Ratzman
Make brace-expansion overrides npm 10 compatible
8fa1a14 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 7bcb8ff2-8403-485d-a153-2fb066e70e4f
Copilot AI review requested due to automatic review settings August 4, 2026 06:53
@github-actions

This comment has been minimized.

Sign in to view
Copilot AI reviewed Aug 4, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review details

Files not reviewed (22)
  • playground/AspireWithBun/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml: Generated file
  • playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json: Generated file
  • playground/DotnetProject/TypeScriptAppHost/package-lock.json: Generated file
  • playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
  • playground/JavaAppHost/frontend/package-lock.json: Generated file
  • playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json: Generated file
  • playground/PythonAppHost/frontend/package-lock.json: Generated file
  • playground/TypeScriptAppHost/express-api/package-lock.json: Generated file
  • playground/TypeScriptAppHost/package-lock.json: Generated file
  • playground/TypeScriptAppHost/vite-frontend/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/AppHost/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptFunctions/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/node-player/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json: Generated file
  • Files reviewed: 31/193 changed files
  • Comments generated: 1
  • Review effort level: Balanced

Comment thread src/Aspire.Hosting.JavaScript/JavaScriptHostingExtensions.cs
Adam Ratzman
Harden package integrity verification
ac0b667 
Bind npm DSSE provenance to the requested package identity and downloaded tarball digest, and normalize accepted pnpm integrity hashes before Docker verification.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 7bcb8ff2-8403-485d-a153-2fb066e70e4f
Copilot AI review requested due to automatic review settings August 4, 2026 07:48
@github-actions

This comment has been minimized.

Sign in to view
Copilot AI reviewed Aug 4, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review details

Files not reviewed (21)
  • playground/AspireWithBun/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml: Generated file
  • playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json: Generated file
  • playground/DotnetProject/TypeScriptAppHost/package-lock.json: Generated file
  • playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
  • playground/JavaAppHost/frontend/package-lock.json: Generated file
  • playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json: Generated file
  • playground/PythonAppHost/frontend/package-lock.json: Generated file
  • playground/TypeScriptAppHost/express-api/package-lock.json: Generated file
  • playground/TypeScriptAppHost/package-lock.json: Generated file
  • playground/TypeScriptAppHost/vite-frontend/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/AppHost/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptFunctions/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/node-player/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json: Generated file
Suppressed comments (2)

src/Aspire.Cli/Npm/NpmRunner.cs:49

  • This security-sensitive routing change is not behaviorally covered. PackageRegistry_UsesCanonicalInternalFeed only reflects over constants, so it still passes if ResolvePackageAsync stops passing this constant to npm. Add a fake-npm test that invokes ResolvePackageAsync and asserts the complete view ... --registry <internal-feed> argument list.
    src/Aspire.Cli/Npm/NpmRunner.cs:97
  • The new internal-feed routing for downloaded tarballs also lacks an execution-level regression test. The reflection test proves only that a registry constant exists, not that PackAsync uses it. Add a fake-npm test that invokes PackAsync and verifies pack ... --pack-destination ... --registry <internal-feed>.
  • Files reviewed: 31/195 changed files
  • Comments generated: 1
  • Review effort level: Balanced

Comment thread src/Aspire.Cli/Npm/NpmRunner.cs Outdated
@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

Adam Ratzman
Disable npm lifecycle scripts during tool install
e9f4b70 
Install the verified Playwright CLI tarball with --ignore-scripts so unverified transitive dependencies cannot execute lifecycle code. Update the cross-platform argument capture test.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 7bcb8ff2-8403-485d-a153-2fb066e70e4f
Copilot AI review requested due to automatic review settings August 4, 2026 09:08
@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Tests selector (audit mode)

The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement.

13 / 100 test projects · 7 jobs, from 192 changed files.

Selected test projects (13 / 100)

Aspire.Cli.EndToEnd.Tests, Aspire.Cli.Tests, Aspire.Hosting.Azure.Kubernetes.Tests, Aspire.Hosting.Azure.Tests, Aspire.Hosting.Blazor.Tests, Aspire.Hosting.CodeGeneration.TypeScript.Tests, Aspire.Hosting.Dotnet.Tests, Aspire.Hosting.JavaScript.Tests, Aspire.Hosting.Radius.Tests, Aspire.Hosting.Tests, Aspire.Playground.Tests, Aspire.Templates.Tests, Infrastructure.Tests

Selected jobs (7)

cli-starter, deployment-e2e, extension-e2e, extension-unit, polyglot, typescript-api-compat, typescript-sdk

How these were chosen — grouped by what changed

⚠️ 9 of the 13 selected test projects come from a single change — src/Aspire.Hosting.JavaScript/JavaScriptHostingExtensions.cs.

🔧 src/Aspire.Hosting.JavaScript/JavaScriptHostingExtensions.cs (changed source)
→ 1 directly: Aspire.Hosting.JavaScript.Tests
→ 8 via the project graph: Aspire.Hosting.Azure.Kubernetes.Tests (2 hops), Aspire.Hosting.Azure.Tests, Aspire.Hosting.Blazor.Tests (2 hops), Aspire.Hosting.CodeGeneration.TypeScript.Tests, Aspire.Hosting.Dotnet.Tests (2 hops), Aspire.Hosting.Radius.Tests (2 hops), Aspire.Hosting.Tests, Aspire.Playground.Tests

📦 affected project Aspire.Cli
→ 1 test: Aspire.Cli.EndToEnd.Tests

📄 .github/workflows/polyglot-validation/Dockerfile.typescript (changed)
→ 1 directly: Infrastructure.Tests

📄 playground/AspireWithBun/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.Angular/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.React/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.Vite/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.Vue/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithNode/NodeFrontend/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithNode/NodeFrontend/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/DotnetProject/TypeScriptAppHost/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/FoundryAgentEnterprise/frontend/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/FoundryAgentEnterprise/frontend/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/JavaAppHost/frontend/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/JavaAppHost/frontend/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/PythonAppHost/frontend/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/PythonAppHost/frontend/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptAppHost/express-api/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptAppHost/express-api/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptAppHost/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptAppHost/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptAppHost/vite-frontend/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptAppHost/vite-frontend/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/AzureFunctionsSample/AppHost/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/AzureFunctionsSample/AppHost/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/AzureFunctionsSample/TypeScriptFunctions/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/RpsArena/arena-frontend/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/RpsArena/node-player/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/RpsArena/node-player/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/RpsArena/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/RpsArena/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

🔧 src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package-lock.json (changed source)
→ 1 directly: Aspire.Templates.Tests

🔧 src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package.json (changed source)
→ 1 directly: Aspire.Templates.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package.json (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package-lock.json (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package.json (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.Tests/Agents/PlaywrightCliInstallerTests.cs (changed test)
→ 1 directly: Aspire.Cli.Tests

🧪 tests/Aspire.Cli.Tests/Agents/SigstoreNpmProvenanceCheckerTests.cs (changed test)
→ 1 directly: Aspire.Cli.Tests

🧪 tests/Aspire.Cli.Tests/Npm/NpmRunnerTests.cs (changed test)
→ 1 directly: Aspire.Cli.Tests

🧪 tests/Aspire.Cli.Tests/Templating/TemplatePackageLockTests.cs (changed test)
→ 1 directly: Aspire.Cli.Tests

🧪 tests/Aspire.Cli.Tests/TestServices/FakePlaywrightServices.cs (changed test)
→ 1 directly: Aspire.Cli.Tests

🧪 tests/Aspire.Hosting.JavaScript.Tests/AddJavaScriptAppTests.cs (changed test)
→ 1 directly: Aspire.Hosting.JavaScript.Tests

🧪 tests/Aspire.Hosting.JavaScript.Tests/Snapshots/AddJavaScriptAppTests.VerifyPnpmDockerfileWhenPublishedAsPackageScript_hasLockFile=False.verified.txt (changed test)
→ 1 directly: Aspire.Hosting.JavaScript.Tests

🧪 tests/Aspire.Hosting.JavaScript.Tests/Snapshots/AddJavaScriptAppTests.VerifyPnpmDockerfileWhenPublishedAsPackageScript_hasLockFile=True.verified.txt (changed test)
→ 1 directly: Aspire.Hosting.JavaScript.Tests

🧪 tests/Aspire.Hosting.JavaScript.Tests/Snapshots/AddJavaScriptAppTests.VerifyPnpmDockerfile_hasLockFile=False.verified.txt (changed test)
→ 1 directly: Aspire.Hosting.JavaScript.Tests

🧪 tests/Aspire.Hosting.JavaScript.Tests/Snapshots/AddJavaScriptAppTests.VerifyPnpmDockerfile_hasLockFile=True.verified.txt (changed test)
→ 1 directly: Aspire.Hosting.JavaScript.Tests

🧪 tests/Aspire.Hosting.JavaScript.Tests/Snapshots/AddViteAppTests.VerifyDockerfileWhenNextJsAppUsesPnpm.verified.txt (changed test)
→ 1 directly: Aspire.Hosting.JavaScript.Tests

🧪 tests/Aspire.Hosting.JavaScript.Tests/Snapshots/AddViteAppTests.VerifyDockerfileWhenPackageScriptUsesPnpm.verified.txt (changed test)
→ 1 directly: Aspire.Hosting.JavaScript.Tests

🧪 tests/Infrastructure.Tests/Pipelines/NpmCliPackageTests.cs (changed test)
→ 1 directly: Infrastructure.Tests

Job reasons

Job Triggered by
cli-starter • affected project Aspire.Cli
• selected test Aspire.Cli.Tests
deployment-e2e • src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package-lock.json, src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package.json
• affected project Aspire.Cli
extension-e2e • extension/package.json, extension/scripts/prepareCorepackYarn.mjs, extension/yarn.lock, src/Aspire.Cli/Agents/Playwright/PlaywrightCliInstaller.cs, src/Aspire.Cli/Npm/INpmProvenanceChecker.cs, src/Aspire.Cli/Npm/INpmRunner.cs, src/Aspire.Cli/Npm/NpmRunner.cs, src/Aspire.Cli/Npm/SigstoreNpmProvenanceChecker.cs, src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json, src/Aspire.Cli/Templating/Templates/java-starter/frontend/package.json, src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json, src/Aspire.Cli/Templating/Templates/py-starter/frontend/package.json, src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json, src/Aspire.Cli/Templating/Templates/py-starter/package.json, src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json, src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package.json, src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json, src/Aspire.Cli/Templating/Templates/ts-starter/package.json, src/Aspire.Hosting.JavaScript/JavaScriptHostingExtensions.cs, tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json, tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package.json, tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package-lock.json, tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package.json, tests/Aspire.Cli.Tests/Agents/PlaywrightCliInstallerTests.cs, tests/Aspire.Cli.Tests/Agents/SigstoreNpmProvenanceCheckerTests.cs, tests/Aspire.Cli.Tests/Npm/NpmRunnerTests.cs, tests/Aspire.Cli.Tests/Templating/TemplatePackageLockTests.cs, tests/Aspire.Cli.Tests/TestServices/FakePlaywrightServices.cs
• affected project Aspire.Cli
extension-unit extension/package.json, extension/scripts/prepareCorepackYarn.mjs, extension/yarn.lock
polyglot • .github/workflows/polyglot-validation/Dockerfile.typescript, tests/PolyglotAppHosts/Aspire.Hosting.Azure.AppConfiguration/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.AppConfiguration/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.AppContainers/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.AppContainers/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.AppService/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.AppService/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.ApplicationInsights/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.ApplicationInsights/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.CognitiveServices/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.CognitiveServices/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.ContainerRegistry/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.ContainerRegistry/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.CosmosDB/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.CosmosDB/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.EventHubs/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.EventHubs/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Functions/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Functions/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.KeyVault/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.KeyVault/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Kusto/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Kusto/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Network/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Network/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.OperationalInsights/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.OperationalInsights/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.PostgreSQL/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.PostgreSQL/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Redis/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Redis/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Search/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Search/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.ServiceBus/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.ServiceBus/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.SignalR/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.SignalR/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Sql/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Sql/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Storage/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.Storage/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.WebPubSub/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure.WebPubSub/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Azure/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Blazor/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.DevTunnels/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.DevTunnels/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Docker/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Docker/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.EntityFrameworkCore/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.EntityFrameworkCore/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Foundry/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Foundry/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Garnet/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Garnet/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.GitHub.Models/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.GitHub.Models/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Go/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Go/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.JavaScript/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.JavaScript/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Kafka/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Kafka/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Keycloak/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Keycloak/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Kubernetes/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Kubernetes/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Maui/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Maui/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Milvus/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Milvus/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.MongoDB/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.MongoDB/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.MySql/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.MySql/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Nats/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Nats/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.OpenAI/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.OpenAI/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Oracle/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Oracle/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Orleans/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Orleans/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.PostgreSQL/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.PostgreSQL/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Python/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Python/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Qdrant/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Qdrant/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.RabbitMQ/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.RabbitMQ/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Redis/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Redis/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Seq/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Seq/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.SqlServer/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.SqlServer/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Valkey/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Valkey/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting.Yarp/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting.Yarp/TypeScript/package.json, tests/PolyglotAppHosts/Aspire.Hosting/TypeScript/package-lock.json, tests/PolyglotAppHosts/Aspire.Hosting/TypeScript/package.json, tests/PolyglotAppHosts/TypeScript.PackageManagers.Bun/TypeScript/bun.lock, tests/PolyglotAppHosts/TypeScript.PackageManagers.Bun/TypeScript/package.json, tests/PolyglotAppHosts/TypeScript.PackageManagers.Npm/TypeScript/package-lock.json, tests/PolyglotAppHosts/TypeScript.PackageManagers.Pnpm/TypeScript/package.json, tests/PolyglotAppHosts/TypeScript.PackageManagers.Pnpm/TypeScript/pnpm-lock.yaml, tests/PolyglotAppHosts/TypeScript.PackageManagers.Yarn/TypeScript/package.json, tests/PolyglotAppHosts/TypeScript.PackageManagers.Yarn/TypeScript/yarn.lock
• affected project Aspire.Cli
typescript-api-compat affected project Aspire.Cli
typescript-sdk src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json, src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package.json, src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json, src/Aspire.Cli/Templating/Templates/ts-starter/package.json, tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package-lock.json, tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package.json

Selection computed for commit e9f4b70.

Copilot AI reviewed Aug 4, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review details

Files not reviewed (21)
  • playground/AspireWithBun/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml: Generated file
  • playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json: Generated file
  • playground/DotnetProject/TypeScriptAppHost/package-lock.json: Generated file
  • playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
  • playground/JavaAppHost/frontend/package-lock.json: Generated file
  • playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json: Generated file
  • playground/PythonAppHost/frontend/package-lock.json: Generated file
  • playground/TypeScriptAppHost/express-api/package-lock.json: Generated file
  • playground/TypeScriptAppHost/package-lock.json: Generated file
  • playground/TypeScriptAppHost/vite-frontend/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/AppHost/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptFunctions/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/node-player/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json: Generated file
  • Files reviewed: 31/195 changed files
  • Comments generated: 0 new
  • Review effort level: Balanced

@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@adamint
Adam Ratzman (adamint) merged commit 77f62fc into main Aug 4, 2026
677 of 680 checks passed
@adamint
Adam Ratzman (adamint) deleted the dapire/security-deps/aspire-lowrisk-batch branch August 4, 2026 10:07
@microsoft-github-policy-service microsoft-github-policy-service Bot added this to the 13.5 milestone Aug 4, 2026
@aspire-repo-bot

aspire-repo-bot Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

✅ No documentation update needed.

No documentation PR needed — all triggered signals are false positives for this security dependency update.

Step 5 branch taken: docs_required → true false positive (no concrete documentation edit to make)

Triggered signals (5):

  • diff_scan_skipped_due_to_missing_patch — src/Aspire.Hosting.JavaScript/JavaScriptHostingExtensions.cs is listed as modified in the PR but has 0 additions and 0 deletions; there is no actual content change to scan, making this signal a false positive.
  • project_template_changed — aspire-ts-cs-starter/frontend/package.json and package-lock.json changed only to bump transitive npm security dependencies (postcss 8.5.10 → 8.5.20, brace-expansion patches). This is a dependency version bump with no change to template behavior or user-visible surface.
  • pr_body_has_cli_flag_mention — The --lockfile-only flag mentioned in the PR body is npm's own CLI flag, cited only to explain why some automation-deferred remediations could not be applied in this environment. It is not an Aspire CLI flag.
  • pr_body_has_security_marker — GHSA advisories (GHSA-r28c-9q8g-f849, GHSA-6g55-p6wh-862q, etc.) refer to transitive npm package vulnerabilities (postcss, tar, brace-expansion). No Aspire API, configuration, or user-facing behavior changed.
  • pr_label_security — The automated-security label confirms this is an automated security dependency consolidation PR, not a user-facing feature or breaking change.

All 195 changed files are npm lock/manifest files, CI configuration, and internal security tooling. No new Aspire public APIs, CLI flags, configuration keys, or documented behaviors were introduced or modified.

@IEvangelist David Pine (IEvangelist) mentioned this pull request Aug 4, 2026
Merged
Open
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@adamint Adam Ratzman (adamint) adamint left review comments
Copilot code review Copilot
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@JamesNK James Newton-King (JamesNK) JamesNK approved these changes
@mitchdenny Mitch Denny (mitchdenny) Awaiting requested review from mitchdenny mitchdenny is a code owner
@davidfowl David Fowler (davidfowl) Awaiting requested review from davidfowl davidfowl is a code owner
@ellahathaway Ella Hathaway (ellahathaway) Awaiting requested review from ellahathaway ellahathaway is a code owner
+1 more reviewer
@chaiphet6669-afk chaiphet6669-afk chaiphet6669-afk left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

automated-security Automated security fix needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners

Projects

None yet

Milestone

13.5

Development

Successfully merging this pull request may close these issues.

7 participants

@IEvangelist @mitchdenny @JamesNK @adamint @chaiphet6669-afk @SkynetBot-001