Skip to content

Commit c3f2f5b

Browse files
IEvangelistCopilotellahathawayCopilot
authored
[auto-sec] Consolidate npm security remediations (vite, Angular, undici, hono, protobufjs, and more) (#18735)
* [auto-sec] Consolidate npm security remediations across all frontend manifests Addresses 100+ Dependabot security alerts across 29 npm/yarn/pnpm manifests in playground/, src/Aspire.Cli/Templating/Templates/, src/Aspire.ProjectTemplates/, tests/, and extension/. ## Packages fixed (via overrides/resolutions/pnpm.overrides or direct version bumps): ### CVE remediations - vite: bumped to ^8.0.16 (was ^8.0.0) — CVE-2026-53571 (high), CVE-2026-53632 (medium) - vite 7.x projects: override to 7.3.5 - vite 6.x projects: bumped to ^6.4.3 - @angular/core + @angular/common + @angular/compiler + Angular ecosystem: - playground/AspireJavaScript.Angular: pinned all @angular/* to 21.2.17 via overrides — CVE-2026-54266/54267/54268 (high), CVE-2026-54265 (medium) - hono: 4.12.25 — CVE-2026-54286/54287/54288/54289/54290 - http-proxy-middleware: 3.0.7 — CVE-2026-55602 (medium), CVE-2026-55603 (high) - piscina: 5.2.0 — CVE-2026-55388 (high) - webpack-dev-server: bumped to ^5.2.5 — CVE-2026-9595 (medium) - undici: 7.28.0 (npm/yarn), 6.27.0 (yarn test) — multiple CVEs (high/medium/low) - js-yaml: 4.2.0 — CVE-2026-53550 (medium) - @babel/core: bumped to ^7.29.6 — CVE-2026-49356 (low) - protobufjs: 8.6.0 — CVE-2026-48712/54269/54270 (high/medium) - @opentelemetry/core: 2.8.0 — CVE-2026-54285 (medium) - launch-editor: 2.14.1 — CVE-2026-53632 (medium) - markdown-it: 14.2.0 — CVE-2026-48988 (medium) - form-data: 4.0.6 — CVE-2026-12143 (high) - tmp: 0.2.7 — CVE-2026-49982 (high) - tar: 7.5.16 — CVE-2026-53655 (medium) - esbuild: 0.28.1 — GHSA-g7r4-m6w7-qqqr (low) - brace-expansion: 5.0.7 — moderate vuln in py-starter/ts-starter templates ### Lockfile regeneration - All package-lock.json files regenerated with 'npm install --package-lock-only' - extension/yarn.lock regenerated with yarn v1 (resolutions applied) - NodeFrontend pnpm-lock.yaml regenerated with pnpm - tests/PolyglotAppHosts pnpm-lock.yaml regenerated Note: tests/PolyglotAppHosts/TypeScript.PackageManagers.Yarn yarn.lock has resolutions added to package.json; lockfile will be regenerated on next 'yarn install' run (requires Yarn v4). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * [auto-sec] Align E2E test with undici 7.28.0 lock Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Regenerate Yarn fixture lockfile Update the Yarn 4 lockfile to reflect the security resolutions for esbuild, tar, and undici so immutable installs succeed. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: ba8c860a-2cf2-4af4-8297-79de367a57a9 * Add polyglot code-generator signal to pr-docs-check catalog (#18766) * Add polyglot code-generator signal to pr-docs-check catalog Adds a Group A path signal (polyglot_code_generator_changed) so changes under src/Aspire.Hosting.CodeGeneration.* and src/Shared/CodeGeneration/ gate docs review. These generate the polyglot SDK source consumers write against, so a change there can be breaking even when the C# API and RPC payload are unchanged. Closes the blind spot from #18698, which was misclassified as internal_refactor (signal_count == 0) because no signal covered generated polyglot output. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Match previous_filename for renamed files in Group A path triggers GitHub reports a rename with the destination in `filename` and the source in `previous_filename`. The Group A path-trigger loop matched only `filename`, so relocating a watched file to an untracked path (an outbound rename) slipped through as signal_count == 0 even though the `any` status filter is meant to include renames. The loop now also matches `previous_filename` for renamed entries and records the path that actually matched. Adds an outbound-rename regression test. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Address npm remediation review feedback Align tsx and esbuild compatibility, scope Angular transitive overrides, and refresh affected npm, Yarn, pnpm, and Bun locks. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c9776bc3-78cf-43d0-89c1-8727485c2dc3 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Ella Hathaway <67609881+ellahathaway@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
1 parent 9fb7463 commit c3f2f5b

162 files changed

Lines changed: 13619 additions & 14141 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎extension/package.json‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1082,17 +1082,20 @@
10821082
"serialize-javascript": "7.0.5",
10831083
"flatted": "3.4.2",
10841084
"lodash": "4.18.1",
1085-
"undici": "7.27.0",
1085+
"undici": "7.28.0",
10861086
"path-to-regexp": "8.4.2",
10871087
"@sinonjs/fake-timers": "13.0.5",
10881088
"picomatch": "2.3.2",
10891089
"underscore": "1.13.8",
10901090
"postcss": "8.5.10",
10911091
"uuid": "14.0.0",
1092-
"tmp": "0.2.6",
1092+
"tmp": "0.2.7",
10931093
"@nevware21/ts-utils": "0.14.0",
10941094
"fast-uri": "3.1.2",
10951095
"qs": "6.15.2",
1096-
"ws": "8.21.0"
1096+
"ws": "8.21.0",
1097+
"js-yaml": "4.2.0",
1098+
"markdown-it": "14.2.0",
1099+
"form-data": "4.0.6"
10971100
}
10981101
}

‎extension/src/test/e2eLaunchProfile.test.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,9 +112,9 @@ suite('E2E launch profile', () => {
112112
const internalFeed = 'https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/';
113113

114114
assert.strictEqual(packageJson.devDependencies['vscode-extension-tester'], '8.23.0');
115-
assert.strictEqual(packageJson.resolutions.undici, '7.27.0');
115+
assert.strictEqual(packageJson.resolutions.undici, '7.28.0');
116116
assert.ok(lockfile.includes('vscode-extension-tester@8.23.0'));
117-
assert.ok(lockfile.includes('undici@7.27.0'));
117+
assert.ok(lockfile.includes('undici@7.28.0'));
118118
assert.ok(lockfile.split(/\r?\n/).filter(l => /^\s*resolved\s+"/.test(l)).every(l => l.includes(internalFeed)));
119119
assert.ok(workflow.includes('NPM_REGISTRY: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/'));
120120
assert.ok(fs.existsSync(path.join(extensionRoot, 'scripts', 'validate-lockfile-registry.cjs')));

‎extension/yarn.lock‎

Lines changed: 47 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1563,7 +1563,7 @@ bach@^2.0.1:
15631563

15641564
balanced-match@^1.0.0:
15651565
version "1.0.2"
1566-
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/balanced-match/-/balanced-match-1.0.2.tgz"
1566+
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/balanced-match/-/balanced-match-1.0.2.tgz#e83e3a7e3f300b34cb9d87f615fa0cbf357690ee"
15671567
integrity sha1-6D46fj8wCzTLnYf2FfoMvzV2kO4=
15681568

15691569
balanced-match@^4.0.2:
@@ -1655,24 +1655,24 @@ boundary@^2.0.0:
16551655
integrity sha1-FpyLHw1Ezywlk4lnoyjzfgpOXvw=
16561656

16571657
brace-expansion@^1.1.7:
1658-
version "1.1.13"
1659-
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/brace-expansion/-/brace-expansion-1.1.13.tgz"
1660-
integrity sha1-03h1wB3J7/mI3UnREqV8tntU7+Y=
1658+
version "1.1.16"
1659+
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/brace-expansion/-/brace-expansion-1.1.16.tgz#723d3a30c0558c225abc9fc479a73e14e26c3c2f"
1660+
integrity sha1-cj06MMBVjCJavJ/Eeac+FOJsPC8=
16611661
dependencies:
16621662
balanced-match "^1.0.0"
16631663
concat-map "0.0.1"
16641664

16651665
brace-expansion@^2.0.2:
1666-
version "2.0.3"
1667-
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/brace-expansion/-/brace-expansion-2.0.3.tgz"
1668-
integrity sha1-BJMzi91Y4xmxA5xnz37kOYksAdk=
1666+
version "2.1.2"
1667+
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/brace-expansion/-/brace-expansion-2.1.2.tgz#0bba2271feb7d458b0d31ad13625aaa4754431e2"
1668+
integrity sha1-C7oicf631Fiw0xrRNiWqpHVEMeI=
16691669
dependencies:
16701670
balanced-match "^1.0.0"
16711671

16721672
brace-expansion@^5.0.5:
1673-
version "5.0.5"
1674-
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/brace-expansion/-/brace-expansion-5.0.5.tgz"
1675-
integrity sha1-3MOjcRa3nz4bRtuZTO1dVw6TD9s=
1673+
version "5.0.7"
1674+
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/brace-expansion/-/brace-expansion-5.0.7.tgz#1b0e46965b479dad65af737b4a02790a05498337"
1675+
integrity sha1-Gw5GlltHna1lr3N7SgJ5CgVJgzc=
16761676
dependencies:
16771677
balanced-match "^4.0.2"
16781678

@@ -2080,7 +2080,7 @@ compare-versions@^6.1.1:
20802080

20812081
concat-map@0.0.1:
20822082
version "0.0.1"
2083-
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/concat-map/-/concat-map-0.0.1.tgz"
2083+
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/concat-map/-/concat-map-0.0.1.tgz#d8a96bd77fd68df7793a73036a3ba0d5405d477b"
20842084
integrity sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=
20852085

20862086
concat-with-sourcemaps@^1.0.0:
@@ -3047,16 +3047,16 @@ form-data-encoder@^4.0.2:
30473047
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/form-data-encoder/-/form-data-encoder-4.1.0.tgz#497cedc94810bd5d53b99b5d4f6c152d5cbc9db2"
30483048
integrity sha1-SXztyUgQvV1TuZtdT2wVLVy8nbI=
30493049

3050-
form-data@^4.0.0:
3051-
version "4.0.5"
3052-
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/form-data/-/form-data-4.0.5.tgz"
3053-
integrity sha1-tJ5IhYBF/0y/awPhgFzrytNnkFM=
3050+
form-data@4.0.6, form-data@^4.0.0:
3051+
version "4.0.6"
3052+
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/form-data/-/form-data-4.0.6.tgz#28e864e1b786dbebb68db1f452f9635278665827"
3053+
integrity sha1-KOhk4beG2+u2jbH0UvljUnhmWCc=
30543054
dependencies:
30553055
asynckit "^0.4.0"
30563056
combined-stream "^1.0.8"
30573057
es-set-tostringtag "^2.1.0"
3058-
hasown "^2.0.2"
3059-
mime-types "^2.1.12"
3058+
hasown "^2.0.4"
3059+
mime-types "^2.1.35"
30603060

30613061
forwarded@0.2.0:
30623062
version "0.2.0"
@@ -3461,6 +3461,13 @@ hasown@^2.0.2:
34613461
dependencies:
34623462
function-bind "^1.1.2"
34633463

3464+
hasown@^2.0.4:
3465+
version "2.0.4"
3466+
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/hasown/-/hasown-2.0.4.tgz#8c62d8cb90beb2aad5d0a5b67581ad9854c3f003"
3467+
integrity sha1-jGLYy5C+sqrV0KW2dYGtmFTD8AM=
3468+
dependencies:
3469+
function-bind "^1.1.2"
3470+
34643471
he@1.2.0, he@^1.2.0:
34653472
version "1.2.0"
34663473
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/he/-/he-1.2.0.tgz"
@@ -3938,10 +3945,10 @@ js-tokens@^4.0.0:
39383945
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/js-tokens/-/js-tokens-4.0.0.tgz"
39393946
integrity sha1-GSA/tZmR35jjoocFDUZHzerzJJk=
39403947

3941-
js-yaml@^4.1.0, js-yaml@^4.1.1:
3942-
version "4.1.1"
3943-
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/js-yaml/-/js-yaml-4.1.1.tgz#854c292467705b699476e1a2decc0c8a3458806b"
3944-
integrity sha1-hUwpJGdwW2mUduGi3swMijRYgGs=
3948+
js-yaml@4.2.0, js-yaml@^4.1.0, js-yaml@^4.1.1:
3949+
version "4.2.0"
3950+
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/js-yaml/-/js-yaml-4.2.0.tgz#2bd9e85682dd91bd469afb809d816043b3d49524"
3951+
integrity sha1-K9noVoLdkb1GmvuAnYFgQ7PUlSQ=
39453952
dependencies:
39463953
argparse "^2.0.1"
39473954

@@ -4116,10 +4123,10 @@ liftoff@^5.0.1:
41164123
rechoir "^0.8.0"
41174124
resolve "^1.20.0"
41184125

4119-
linkify-it@^5.0.0:
4120-
version "5.0.0"
4121-
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/linkify-it/-/linkify-it-5.0.0.tgz"
4122-
integrity sha1-nvI4v6bccL2Of5VytS02mvVptCE=
4126+
linkify-it@^5.0.1:
4127+
version "5.0.2"
4128+
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/linkify-it/-/linkify-it-5.0.2.tgz#d3be0a693af3da9df3883f1e346a0e97461a8c19"
4129+
integrity sha1-074KaTrz2p3ziD8eNGoOl0YajBk=
41234130
dependencies:
41244131
uc.micro "^2.0.0"
41254132

@@ -4268,14 +4275,14 @@ map-cache@^0.2.0:
42684275
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/map-cache/-/map-cache-0.2.2.tgz"
42694276
integrity sha1-wyq9C9ZSXZsFFkW7TyasXcmKDb8=
42704277

4271-
markdown-it@^14.0.0, markdown-it@^14.1.0:
4272-
version "14.1.1"
4273-
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/markdown-it/-/markdown-it-14.1.1.tgz"
4274-
integrity sha1-hW+Qtm/DmucK/9JcGxi1gdfe7h8=
4278+
markdown-it@14.2.0, markdown-it@^14.0.0, markdown-it@^14.1.0:
4279+
version "14.2.0"
4280+
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/markdown-it/-/markdown-it-14.2.0.tgz#06d48d9035e77d5b1c85adb315482fc8240289ef"
4281+
integrity sha1-BtSNkDXnfVscha2zFUgvyCQCie8=
42754282
dependencies:
42764283
argparse "^2.0.1"
42774284
entities "^4.4.0"
4278-
linkify-it "^5.0.0"
4285+
linkify-it "^5.0.1"
42794286
mdurl "^2.0.0"
42804287
punycode.js "^2.3.1"
42814288
uc.micro "^2.1.0"
@@ -4342,9 +4349,9 @@ mime-db@^1.54.0:
43424349
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/mime-db/-/mime-db-1.54.0.tgz"
43434350
integrity sha1-zds+5PnGRTDf9kAjZmHULLajFPU=
43444351

4345-
mime-types@^2.1.12, mime-types@^2.1.27:
4352+
mime-types@^2.1.27, mime-types@^2.1.35:
43464353
version "2.1.35"
4347-
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/mime-types/-/mime-types-2.1.35.tgz"
4354+
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/mime-types/-/mime-types-2.1.35.tgz#381a871b62a734450660ae3deee44813f70d959a"
43484355
integrity sha1-OBqHG2KnNEUGYK497uRIE/cNlZo=
43494356
dependencies:
43504357
mime-db "1.52.0"
@@ -6091,10 +6098,10 @@ tinyglobby@^0.2.15:
60916098
fdir "^6.5.0"
60926099
picomatch "^4.0.3"
60936100

6094-
tmp@0.2.6, tmp@^0.2.3, tmp@^0.2.5:
6095-
version "0.2.6"
6096-
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/tmp/-/tmp-0.2.6.tgz#0dfac10fd09a9319288eb0e8f0ed524604e183b4"
6097-
integrity sha1-DfrBD9CakxkojrDo8O1SRgThg7Q=
6101+
tmp@0.2.7, tmp@^0.2.3, tmp@^0.2.5:
6102+
version "0.2.7"
6103+
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/tmp/-/tmp-0.2.7.tgz#26f4db11d1601ce8012dcb8a798ece1c06a99059"
6104+
integrity sha1-JvTbEdFgHOgBLcuKeY7OHAapkFk=
60986105

60996106
to-absolute-glob@^2.0.0, to-absolute-glob@^2.0.2:
61006107
version "2.0.2"
@@ -6325,10 +6332,10 @@ undici-types@~6.21.0:
63256332
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/undici-types/-/undici-types-6.21.0.tgz"
63266333
integrity sha1-aR0ArzkJvpOn+qE75hs6W1DvEss=
63276334

6328-
undici@7.27.0, undici@^7.19.0:
6329-
version "7.27.0"
6330-
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/undici/-/undici-7.27.0.tgz#8f1d99dfc28273fe8a5736aa93a507850fda78c9"
6331-
integrity sha1-jx2Z38KCc/6KVzaqk6UHhQ/aeMk=
6335+
undici@7.28.0, undici@^7.19.0:
6336+
version "7.28.0"
6337+
resolved "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/undici/-/undici-7.28.0.tgz#97d64564198b285bc281f0e8e29597e3d11fe7ec"
6338+
integrity sha1-l9ZFZBmLKFvCgfDo4pWX49Ef5+w=
63326339

63336340
unicorn-magic@^0.1.0:
63346341
version "0.1.0"

0 commit comments

Comments
 (0)