[auto-sec] Consolidate Aspire JavaScript template dependency security remediations#18858
Open
IEvangelist wants to merge 1 commit into
Open
[auto-sec] Consolidate Aspire JavaScript template dependency security remediations#18858IEvangelist wants to merge 1 commit into
IEvangelist wants to merge 1 commit into
Conversation
IEvangelist
requested review from
JamesNK,
davidfowl and
mitchdenny
as code owners
July 22, 2026 11:07
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 18858Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 18858" |
github-actions
Bot
added
the
needs-area-label
Contributor
There was a problem hiding this comment.
Pull request overview
Consolidates JavaScript dependency security remediations across Aspire templates and playgrounds.
Changes:
- Upgrades ESLint and TypeScript ESLint dependencies.
- Refreshes transitive dependency lock graphs.
- Upgrades
shell-quoteto 1.10.0.
Reviewed changes
Copilot reviewed 7 out of 16 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package.json |
Updates lint dependencies. |
src/Aspire.Cli/Templating/Templates/py-starter/frontend/package.json |
Updates lint dependencies. |
src/Aspire.Cli/Templating/Templates/java-starter/frontend/package.json |
Updates lint dependencies. |
src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json |
Refreshes secured transitive dependencies. |
playground/PythonAppHost/frontend/package.json |
Updates lint dependencies. |
playground/PythonAppHost/frontend/package-lock.json |
Refreshes secured transitive dependencies. |
playground/JavaAppHost/frontend/package.json |
Updates lint dependencies. |
playground/JavaAppHost/frontend/package-lock.json |
Refreshes secured transitive dependencies. |
playground/FoundryAgentEnterprise/frontend/package.json |
Updates lint dependencies. |
playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json |
Upgrades shell-quote. |
playground/AspireWithJavaScript/AspireJavaScript.Vite/package.json |
Updates lint dependencies. |
playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json |
Upgrades shell-quote. |
Files not reviewed (9)
- playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json: Generated file
- playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json: Generated file
- playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json: Generated file
- playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
- playground/JavaAppHost/frontend/package-lock.json: Generated file
- playground/PythonAppHost/frontend/package-lock.json: Generated file
- src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
- src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
- src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json: Generated file
| "@types/react-dom": "^19.2.3", | ||
| "@vitejs/plugin-react": "^6.0.0", | ||
| "eslint": "^9.39.1", | ||
| "eslint": "^10.7.0", |
| "@types/react-dom": "^19.2.3", | ||
| "@vitejs/plugin-react": "^6.0.0", | ||
| "eslint": "^9.39.1", | ||
| "eslint": "^10.7.0", |
| "@types/react-dom": "^19.2.3", | ||
| "@vitejs/plugin-react": "^6.0.0", | ||
| "eslint": "^9.39.1", | ||
| "eslint": "^10.7.0", |
| "@types/react-dom": "^19.2.3", | ||
| "@vitejs/plugin-react": "^6.0.0", | ||
| "eslint": "^9.39.1", | ||
| "eslint": "^10.7.0", |
| "@types/react-dom": "^19.2.3", | ||
| "@vitejs/plugin-react": "^6.0.0", | ||
| "eslint": "^9.39.1", | ||
| "eslint": "^10.7.0", |
| "@types/react-dom": "^19.1.9", | ||
| "@vitejs/plugin-react": "^6.0.0", | ||
| "eslint": "^9.36.0", | ||
| "eslint": "^10.7.0", |
| "@typescript-eslint/parser": "^8.64.0", | ||
| "@vitejs/plugin-react": "^6.0.0", | ||
| "eslint": "^9.39.1", | ||
| "eslint": "^10.7.0", |
This comment has been minimized.
This comment has been minimized.
Contributor
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
Contributor
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
Contributor
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
IEvangelist
force-pushed
the
dapire/security-deps/aspire-lowrisk-batch
branch
from
July 23, 2026 11:03
7f1e343 to
7e04e81
Compare
This comment has been minimized.
This comment has been minimized.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 16 changed files in this pull request and generated 1 comment.
Files not reviewed (9)
- playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json: Generated file
- playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json: Generated file
- playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json: Generated file
- playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
- playground/JavaAppHost/frontend/package-lock.json: Generated file
- playground/PythonAppHost/frontend/package-lock.json: Generated file
- src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
- src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
- src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json: Generated file
| "@typescript-eslint/parser": "^8.64.0", | ||
| "@vitejs/plugin-react": "^6.0.0", | ||
| "eslint": "^9.39.1", | ||
| "eslint": "^10.7.0", |
Contributor
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
Contributor
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
Contributor
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
JamesNK
reviewed
Jul 24, 2026
JamesNK
left a comment
JamesNK
left a comment
Member
There was a problem hiding this comment.
Confirmed the existing dependency blockers on the current head:
npm ci --ignore-scriptsfails withERESOLVEin both a representative starter and the Vite playground becauseeslint-plugin-react-hooksonly supports ESLint through 9 while these manifests request ESLint 10.- The manifests allow Node 22.12, while ESLint 10 requires Node 22.13 or newer.
- The Vite playground still uses legacy
.eslintrc.cjs, which ESLint 10 no longer supports.
The existing unresolved inline threads already identify each affected location, so I have not duplicated them.
Bumps the npm_and_yarn group with 2 updates in the /playground/AspireWithJavaScript/AspireJavaScript.Vite directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 1 update in the /playground/AspireWithJavaScript/AspireJavaScript.Vue directory: [shell-quote](https://github.com/ljharb/shell-quote). Bumps the npm_and_yarn group with 2 updates in the /playground/FoundryAgentEnterprise/frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 2 updates in the /playground/JavaAppHost/frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 2 updates in the /playground/PythonAppHost/frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 2 updates in the /src/Aspire.Cli/Templating/Templates/java-starter/frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 2 updates in the /src/Aspire.Cli/Templating/Templates/py-starter/frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 2 updates in the /src/Aspire.Cli/Templating/Templates/ts-starter/frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Updates `brace-expansion` from 1.1.13 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.16) Removes `js-yaml` Updates `shell-quote` from 1.8.4 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.10.0) Updates `brace-expansion` from 1.1.13 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.16) Removes `js-yaml` Updates `brace-expansion` from 1.1.13 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.16) Removes `js-yaml` Updates `brace-expansion` from 1.1.13 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.16) Removes `js-yaml` Updates `brace-expansion` from 1.1.13 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.16) Removes `js-yaml` Updates `brace-expansion` from 1.1.13 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.16) Removes `js-yaml` Updates `brace-expansion` from 1.1.13 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.16) Removes `js-yaml` --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
IEvangelist
force-pushed
the
dapire/security-deps/aspire-lowrisk-batch
branch
from
July 24, 2026 11:04
7e04e81 to
2ced3cd
Compare
Contributor
Tests selector (audit mode)The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement. 3 / 100 test projects · 6 jobs, from 16 changed files. Selected test projects (3 / 100)
Selected jobs (6)
How these were chosen — grouped by what changed📦 affected project 📄 📄 📄 📄 📄 📄 📄 📄 📄 📄 🔧 Job reasons
Selection computed for commit |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 16 changed files in this pull request and generated no new comments.
Files not reviewed (9)
- playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json: Generated file
- playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json: Generated file
- playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json: Generated file
- playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
- playground/JavaAppHost/frontend/package-lock.json: Generated file
- playground/PythonAppHost/frontend/package-lock.json: Generated file
- src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
- src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
- src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json: Generated file
Comments suppressed due to low confidence (14)
src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package.json:25
- ESLint 10 is incompatible with the existing
eslint-plugin-react-hooks5.2.0 dependency: its peer range stops at ESLint 9 (package-lock.json:1051). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
"eslint": "^10.7.0",
src/Aspire.Cli/Templating/Templates/py-starter/frontend/package.json:25
- ESLint 10 is incompatible with the existing
eslint-plugin-react-hooks5.2.0 dependency: its peer range stops at ESLint 9 (package-lock.json:1051). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
"eslint": "^10.7.0",
src/Aspire.Cli/Templating/Templates/java-starter/frontend/package.json:25
- ESLint 10 is incompatible with the existing
eslint-plugin-react-hooks5.2.0 dependency: its peer range stops at ESLint 9 (package-lock.json:1051). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
"eslint": "^10.7.0",
playground/PythonAppHost/frontend/package.json:25
- ESLint 10 is incompatible with the existing
eslint-plugin-react-hooks5.2.0 dependency: its peer range stops at ESLint 9 (package-lock.json:1051). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
"eslint": "^10.7.0",
playground/JavaAppHost/frontend/package.json:25
- ESLint 10 is incompatible with the existing
eslint-plugin-react-hooks5.2.0 dependency: its peer range stops at ESLint 9 (package-lock.json:1051). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
"eslint": "^10.7.0",
playground/FoundryAgentEnterprise/frontend/package.json:25
- ESLint 10 is incompatible with the existing
eslint-plugin-react-hooks5.2.0 dependency: its peer range stops at ESLint 9 (package-lock.json:1051). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
"eslint": "^10.7.0",
playground/AspireWithJavaScript/AspireJavaScript.Vite/package.json:27
- ESLint 10 is incompatible with
eslint-plugin-react-hooks7.0.1: its peer range stops at ESLint 9 (package-lock.json:1436). A clean npm install can therefore fail with a peer-resolution error. Upgrade the plugin to 7.1.0 or later (the first release declaring ESLint 10 support) and regenerate the lockfile, or retain ESLint 9.
"eslint": "^10.7.0",
src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package.json:25
- This upgrade raises ESLint's Node requirement to
^20.19.0 || ^22.13.0 || >=24, but this package still declares Node>=22.12.0as supported. On Node 22.12 the generated project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
"eslint": "^10.7.0",
src/Aspire.Cli/Templating/Templates/py-starter/frontend/package.json:25
- This upgrade raises ESLint's Node requirement to
^20.19.0 || ^22.13.0 || >=24, but this package still declares Node>=22.12.0as supported. On Node 22.12 the generated project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
"eslint": "^10.7.0",
src/Aspire.Cli/Templating/Templates/java-starter/frontend/package.json:25
- This upgrade raises ESLint's Node requirement to
^20.19.0 || ^22.13.0 || >=24, but this package still declares Node>=22.12.0as supported. On Node 22.12 the generated project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
"eslint": "^10.7.0",
playground/PythonAppHost/frontend/package.json:25
- This upgrade raises ESLint's Node requirement to
^20.19.0 || ^22.13.0 || >=24, but this package still declares Node>=22.12.0as supported. On Node 22.12 the project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
"eslint": "^10.7.0",
playground/JavaAppHost/frontend/package.json:25
- This upgrade raises ESLint's Node requirement to
^20.19.0 || ^22.13.0 || >=24, but this package still declares Node>=22.12.0as supported. On Node 22.12 the project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
"eslint": "^10.7.0",
playground/FoundryAgentEnterprise/frontend/package.json:25
- This upgrade raises ESLint's Node requirement to
^20.19.0 || ^22.13.0 || >=24, but this package still declares Node>=22.12.0as supported. On Node 22.12 the project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
"eslint": "^10.7.0",
playground/AspireWithJavaScript/AspireJavaScript.Vite/package.json:27
- This upgrade raises ESLint's Node requirement to
^20.19.0 || ^22.13.0 || >=24, but this package still declares Node>=22.12.0as supported. On Node 22.12 the project satisfies its own engine range but cannot run this linter. Raise the package's 22.x minimum to 22.13 and regenerate the lockfile.
"eslint": "^10.7.0",
Contributor
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
Contributor
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
Contributor
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Canonical security remediation cluster: Aspire JavaScript template npm vulnerabilities (low-risk patch/minor batch)
Last refreshed: 2026-07-24 06:17:43 -05:00
Alerts addressed by this canonical PR
brace-expansion)postcss)js-yaml)Version changes in this PR
package.json/package-lock.jsonupdates across JavaScript starter/template fronts under:playground/*src/Aspire.Cli/Templating/Templates/*/frontendVerification status
Tests / Hosting.Docker / Hosting.Docker (ubuntu-latest)Superseded / tracked overlap PRs
Closure gate is not satisfied yet; overlap PR remains open and linked.