Bump undici to 7.27.0 to fix three open Dependabot alerts in extension/

[IEvangelist]

Summary

Resolves the three open undici Dependabot alerts filed against extension/yarn.lock:

Alert	Severity	Advisory
#1182	medium	GHSA-cxjh-pqwp-8mfp - CRLF Injection in undici via upgrade option
#1180	high	GHSA-f269-vfmq-vjvj - Malicious WebSocket 64-bit length overflows parser and crashes the client
#1179	medium	GHSA-9f74-3xc5-r7g4 - HTTP Request/Response Smuggling

All three are first patched in undici@7.24.0.

What changed

extension/package.json pins undici via the resolutions block (currently at 7.21.0, which is in the vulnerable range). This PR bumps the pin to 7.27.0 - the latest 7.x release mirrored to the internal dotnet-public-npm feed - and regenerates extension/yarn.lock through that feed.

• extension/package.json: "undici": "7.21.0" -> "undici": "7.27.0"
• extension/yarn.lock: corresponding undici@7.27.0 entry, resolved URL stays on the internal pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm registry.

cheerio's undici "^7.19.0" constraint is still satisfied, so nothing else moves and the lockfile diff is minimal (3 lines per file). The pre-restore lockfile guard introduced in #17474 (no public registry URLs in extension/yarn.lock) still passes - I ran the same node one-liner the CI uses.

Note on versions available in the internal feed

I checked the internal mirror before picking a target:

• 7.24.0 - 303 (available)
• 7.25.0 - 303 (available)
• 7.26.0 - 303 (available)
• 7.27.0 - 303 (available, latest 7.x)
• 8.x - mostly 401 (not mirrored), so kept on the 7.x line that cheerio already wants.

Other open alerts

The other six open Dependabot alerts (ws, @nevware21/ts-utils, fast-uri x2, qs, vitest) are already addressed by Dependabot's group PR #17854.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 17868

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 17868"

[Copilot]

Pull request overview

Updates the VS Code extension’s Yarn resolution pin for undici to a patched 7.x version to address the three open Dependabot security alerts affecting extension/yarn.lock.

Changes:

• Bump undici resolution from 7.21.0 to 7.27.0 in extension/package.json.
• Regenerate the corresponding undici entry in extension/yarn.lock while keeping the internal dotnet-public-npm registry URL.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
extension/package.json	Updates the resolutions pin for undici to 7.27.0.
extension/yarn.lock	Updates the lock entry for undici to 7.27.0 using the internal feed URL.

[IEvangelist]

The only remaining red check is VS Code extension E2E (Windows, zero-to-running) (AggregateError: Zero-to-running E2E teardown failed. in out\test-e2e\test-e2e\helpers\fixtures.js:132). I re-triggered the failing job once and it failed the same way.

This is pre-existing on main and not caused by the undici bump - the last 10 CI runs on main (workflow CI) all came back with conclusion: failure for the same Windows shard:

run 26876233843 (06/03/2026 09:33:29): failure
run 26859534282 (06/03/2026 02:11:54): failure
run 26858200614 (06/03/2026 01:29:53): failure
run 26855094131 (06/02/2026 23:55:26): failure
run 26850635203 (06/02/2026 22:01:35): failure
run 26847997167 (06/02/2026 21:05:22): failure
run 26841517834 (06/02/2026 18:59:30): failure
run 26841189723 (06/02/2026 18:53:19): failure
run 26832685171 (06/02/2026 16:13:45): failure
run 26829088244 (06/02/2026 15:11:44): failure

The Linux counterpart VS Code extension E2E (Linux, zero-to-running) passes on this PR. The only extension/ touchpoints in this change are the undici resolution bump (7.21.0 -> 7.27.0) in extension/package.json + the matching lockfile + test assertion update, none of which interact with the VS Code extension launch path.

All 327 other checks are green. Happy to dig further if anyone has reason to think the bump is implicated.

[github-actions]

❓ CLI E2E Tests unknown — 112 passed, 0 failed, 2 unknown (commit fa42579)

View all recordings

-	Test	Detail
✅	AddPackageInteractiveWhileAppHostRunningDetached	Recording · Job · CLI logs
✅	AddPackageWhileAppHostRunningDetached	Recording · Job · CLI logs
✅	AgentCommands_AllHelpOutputs_AreCorrect	Recording · Job · CLI logs
✅	AgentInitCommand_DefaultSelection_InstallsDefaultSkills	Recording · Job · CLI logs
✅	AgentInitCommand_MigratesDeprecatedConfig	Recording · Job · CLI logs
✅	AgentInit_NonInteractive_BundleOnlySkillsNotInCatalog	Recording · Job · CLI logs
✅	AgentMcpListStructuredLogsReturnsLogsFromStarterApp	Recording · Job · CLI logs
✅	AgentMcpListStructuredLogsReturnsLogsFromStarterApp_DevLocalhost	Recording · Job · CLI logs
✅	AgentMcpListStructuredLogsReturnsLogsFromStarterApp_Isolated	Recording · Job · CLI logs
✅	AllPublishMethodsBuildDockerImages	Recording · Job · CLI logs
✅	AspireAddAndStartWorkAgainstLegacyAppHostTs	Recording · Job · CLI logs
✅	AspireAddPackageVersionToDirectoryPackagesProps	Recording · Job · CLI logs
✅	AspireInitSingleFileAppHostRunsViaDotnetRunAppHost	Recording · Job · CLI logs
✅	AspireInit_ExistingAppHostDir_RecreatesNuGetConfigKeepsFiles	Recording · Job · CLI logs
❔	AspireInit_SolutionFile_BuildsAgainstChannelHive	Recording · Job · CLI logs
✅	AspireStartUpdatesStaleTypeScriptAppHostPath	Recording · Job · CLI logs
✅	AspireUpdateRemovesAppHostPackageVersionFromDirectoryPackagesProps	Recording · Job · CLI logs
✅	AspireUpdateRemovesOrphanAppHostPackageVersionWhenSdkAlreadyCurrent	Recording · Job · CLI logs
✅	Banner_DisplayedOnFirstRun	Recording · Job · CLI logs
✅	Banner_DisplayedWithExplicitFlag	Recording · Job · CLI logs
✅	Banner_NotDisplayedWithNoLogoFlag	Recording · Job · CLI logs
✅	CertificatesClean_RemovesCertificates	Recording · Job · CLI logs
✅	CertificatesTrust_WithNoCert_CreatesAndTrustsCertificate	Recording · Job · CLI logs
✅	CertificatesTrust_WithUntrustedCert_TrustsCertificate	Recording · Job · CLI logs
✅	ConfigSetGet_CreatesNestedJsonFormat	Recording · Job · CLI logs
✅	CreateAndRunAspireStarterProject	Recording · Job · CLI logs
✅	CreateAndRunAspireStarterProjectWithBundle	Recording · Job · CLI logs
✅	CreateAndRunEmptyAppHostProject	Recording · Job · CLI logs
✅	CreateAndRunJavaEmptyAppHostProject	Recording · Job · CLI logs
✅	CreateAndRunJsReactProject	Recording · Job · CLI logs
✅	CreateAndRunPolyglotAppHostWithDevLocalhostUrls	Recording · Job · CLI logs
✅	CreateAndRunPythonReactProject	Recording · Job · CLI logs
✅	CreateAndRunTypeScriptEmptyAppHostProject	Recording · Job · CLI logs
✅	CreateAndRunTypeScriptStarterProject	Recording · Job · CLI logs
✅	CreateJavaAppHostWithViteApp	Recording · Job · CLI logs
✅	CreateTypeScriptAppHostWithViteApp_UsesConfiguredToolchain	Recording · Job · CLI logs
✅	DashboardRunWithAgentMcpListTracesReturnsNoTraces	Recording · Job · CLI logs
✅	DashboardRunWithAgentMcpListTracesReturnsNoTraces_DevLocalhost	Recording · Job · CLI logs
✅	DashboardRunWithOtelTracesReturnsNoTraces	Recording · Job · CLI logs
✅	DashboardRunWithOtelTracesReturnsNoTraces_DevLocalhost	Recording · Job · CLI logs
✅	DeployK8sBasicApiService	Recording · Job · CLI logs
✅	DeployK8sWithExternalHelmChart	Recording · Job · CLI logs
✅	DeployK8sWithGarnet	Recording · Job · CLI logs
✅	DeployK8sWithMongoDB	Recording · Job · CLI logs
✅	DeployK8sWithMySql	Recording · Job · CLI logs
✅	DeployK8sWithPostgres	Recording · Job · CLI logs
✅	DeployK8sWithRabbitMQ	Recording · Job · CLI logs
✅	DeployK8sWithRedis	Recording · Job · CLI logs
✅	DeployK8sWithSqlServer	Recording · Job · CLI logs
✅	DeployK8sWithValkey	Recording · Job · CLI logs
✅	DeployTypeScriptAppToKubernetes	Recording · Job · CLI logs
✅	DescribeCommandResolvesReplicaNames	Recording · Job · CLI logs
✅	DescribeCommandShowsRunningResources	Recording · Job · CLI logs
✅	DetachFormatJsonProducesValidJson	Recording · Job · CLI logs
✅	DetachFormatJsonProducesValidJsonWhenRestartingExistingInstance	Recording · Job · CLI logs
✅	DoPublishAndDeployListStepsWork	Recording · Job · CLI logs
✅	DocsCommand_RendersInteractiveMarkdownFromLocalSource	Recording · Job · CLI logs
✅	DoctorCommand_DetectsDeprecatedAgentConfig	Recording · Job · CLI logs
✅	DoctorCommand_TypeScriptAppHostReportsMissingConfiguredToolchain	Recording · Job · CLI logs
✅	DoctorCommand_WithSslCertDir_ShowsTrusted	Recording · Job · CLI logs
✅	DoctorCommand_WithoutSslCertDir_ShowsPartiallyTrusted	Recording · Job · CLI logs
✅	DotNetRunFileBasedAppHostUsesAspireCliBundle	Recording · Job · CLI logs
✅	DotNetRunProjectAppHostUsesAspireCliBundle	Recording · Job · CLI logs
✅	GatewayWithoutExternalEndpoint_FailsPublishWithGuidance	Recording · Job · CLI logs
✅	GeneratedAspireDevScript_StartsWatchMode_WithConfiguredToolchain	Recording · Job · CLI logs
✅	GlobalMigration_HandlesCommentsAndTrailingCommas	Recording · Job · CLI logs
✅	GlobalMigration_HandlesMalformedLegacyJson	Recording · Job · CLI logs
✅	GlobalMigration_PreservesAllValueTypes	Recording · Job · CLI logs
✅	GlobalMigration_SkipsWhenNewConfigExists	Recording · Job · CLI logs
✅	GlobalSettings_MigratedFromLegacyFormat	Recording · Job · CLI logs
✅	IngressWithoutExternalEndpoint_FailsPublishWithGuidance	Recording · Job · CLI logs
✅	InitTypeScriptAppHost_AugmentsExistingViteRepoInWorkspaceSubdirectory	Recording · Job · CLI logs
✅	InteractiveCSharpInitCreatesExpectedFiles	Recording · Job · CLI logs
✅	InvalidAppHostPathWithComments_IsHealedOnRun	Recording · Job · CLI logs
✅	JavaScriptHostingApisRunFromTypeScriptAppHost	Recording · Job · CLI logs
✅	LatestCliCanStartStableChannelAppHost	Recording · Job · CLI logs
✅	LatestCliCanStartStableChannelTypeScriptAppHost	Recording · Job · CLI logs
✅	LegacySettingsMigration_AdjustsRelativeAppHostPath	Recording · Job · CLI logs
✅	LogsCommandShowsResourceLogs	Recording · Job · CLI logs
✅	OtelLogsReturnsStructuredLogsFromStarterApp	Recording · Job · CLI logs
✅	OtelLogsReturnsStructuredLogsFromStarterAppIsolated	Recording · Job · CLI logs
✅	PsCommandListsRunningAppHost	Recording · Job · CLI logs
✅	PsFormatJsonOutputsOnlyJsonToStdout	Recording · Job · CLI logs
✅	PublishJavaScriptPatternsGeneratesExpectedDockerComposeArtifacts	Recording · Job · CLI logs
✅	PublishWithConfigureEnvFileUpdatesEnvOutput	Recording · Job · CLI logs
✅	PublishWithDockerComposeServiceCallbackSucceeds	Recording · Job · CLI logs
✅	PublishWithoutOutputPathUsesAppHostDirectoryDefault	Recording · Job · CLI logs
✅	ResourceCommand_FailedExec_ShowsLogPathAndLogHasEntries	Recording · Job · CLI logs
✅	ResourceCommand_SetAndDeleteParameterUpdatesDescribeOutput	Recording · Job · CLI logs
✅	RestoreGeneratesSdkFiles	Recording · Job · CLI logs
✅	RestoreGeneratesSdkFiles_WithConfiguredToolchain	Recording · Job · CLI logs
✅	RestoreRefreshesGeneratedSdkAfterAddingIntegration	Recording · Job · CLI logs
✅	RestoreSupportsConfigOnlyHelperPackageAndCrossPackageTypes	Recording · Job · CLI logs
✅	RunFromParentDirectory_UsesExistingConfigNearAppHost	Recording · Job · CLI logs
✅	RunReportsSyntaxErrorsForDotNetAppHost	Recording · Job · CLI logs
✅	RunReportsSyntaxErrorsForTypeScriptAppHost	Recording · Job · CLI logs
✅	SecretCrudOnDotNetAppHost	Recording · Job · CLI logs
✅	SecretCrudOnTypeScriptAppHost	Recording · Job · CLI logs
✅	StagingChannel_ConfigureAndVerifySettings_ThenSwitchChannels	Recording · Job · CLI logs
✅	StartAndWaitForTypeScriptSqlServerAppHostWithNativeAssets	Recording · Job · CLI logs
✅	StartReportsSyntaxErrorsForDotNetAppHost	Recording · Job · CLI logs
✅	StartReportsSyntaxErrorsForTypeScriptAppHost	Recording · Job · CLI logs
✅	StopAllAppHostsFromAppHostDirectory	Recording · Job · CLI logs
✅	StopJavaPolyglotAppHostUsingApphostDirectory	Recording · Job · CLI logs
✅	StopNonInteractiveSingleAppHost	Recording · Job · CLI logs
✅	StopTypeScriptPolyglotAppHostUsingApphostDirectory	Recording · Job · CLI logs
✅	StopWithNoRunningAppHostExitsSuccessfully	Recording · Job · CLI logs
✅	TypeScriptAppHostRunDoesNotDeadlockWhenLazyOptionsInvokeAsyncCallback	Recording · Job · CLI logs
✅	TypeScriptAppHostWithVite_AllowsDifferentGuestPkgManager	Recording · Job · CLI logs
✅	UnAwaitedChainsCompileWithAutoResolvePromises	Recording · Job · CLI logs
❔	UpdateToStable_CSharpEmptyAppHost_KeepsConfigChannel	Recording · Job · CLI logs
✅	UpdateToStable_CSharpSingleFileInit_KeepsConfigChannel	Recording · Job · CLI logs
✅	UpdateToStable_TypeScriptSingleFileInit_KeepsConfigChannel	Recording · Job · CLI logs
✅	UpdateToStable_TypeScript_PreviewsStablePkgsAndKeepsChannel	Recording · Job · CLI logs

---

_{📹 Recordings uploaded automatically from CI run #26881288945}

[radical]

Nit: two GHSA IDs in the table look stale/mismatched. The Dependabot alert API shows:

• Remove stray space from starter template #1182 -> GHSA-4992-7rv2-5pvq
• Add "Back to Traces" Navigation Button in Structured Logs View #1180 -> GHSA-f269-vfmq-vjvj
• Redundancy in Menu Items for Project Replicas #1179 -> GHSA-2mjp-6q6p-2qxm

The alert numbers, severities, summaries, and 7.24.0 patched floor otherwise line up.

[radical]

LGTM. The dependency bump itself is consistent: package.json, yarn.lock, and the guard test all agree on undici@7.27.0, the lockfile stays on the internal feed, and 7.27.0 is above the 7.24.0 patched floor for the three open alerts.

I left one PR-description nit for the advisory IDs, but that does not affect the correctness of the fix.

[aspire-repo-bot]

Pull request created: #1205

Generated by PR Documentation Check · sonnet46 2.6M

[aspire-repo-bot]

📝 Documentation has been drafted in microsoft/aspire.dev#1205 targeting release/13.4.

Added a security patch note to src/frontend/src/content/docs/whats-new/aspire-13-4.mdx under the VS Code extension section, documenting the undici bump from 7.21.0 to 7.27.0 that addresses three security advisories (GHSA-cxjh-pqwp-8mfp, GHSA-f269-vfmq-vjvj, GHSA-9f74-3xc5-r7g4).

Files modified:

• src/frontend/src/content/docs/whats-new/aspire-13-4.mdx

Signal triggered: pr_body_has_security_marker — the PR body explicitly references GHSA advisory IDs for the undici dependency vulnerabilities patched in this bump.

Note

This draft PR needs human review before merging.