[auto-sec] aspire.dev: remediate 12 frontend npm security alerts - #1645
Merged
David Pine (IEvangelist) merged 1 commit intoSep 15, 2026
Merged
Conversation
David Pine (IEvangelist)
added
the
automated-security
This was referenced Sep 10, 2026
Copilot started reviewing on behalf of
David Pine (IEvangelist)
September 10, 2026 13:54
View session
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Dependency/security remediations with a regenerated lockfile require CI confirmation to ensure the updated resolution graph doesn’t introduce build/runtime regressions.
Pull request overview
This PR remediates a cluster of frontend npm Dependabot security alerts for aspire.dev by updating a few direct dependencies and pinning vulnerable transitives via pnpm overrides, with a regenerated lockfile to reflect the resolved versions.
Changes:
- Bump direct frontend deps:
astro,sharp, andvitest. - Add/refresh
pnpm-workspace.yamloverridesto force patched transitive versions (@vitest/mocker,fflate,js-yaml,nanoid,smol-toml,svgo). - Regenerate
pnpm-lock.yamlto capture the new resolution graph.
File summaries
| File | Description |
|---|---|
| src/frontend/pnpm-workspace.yaml | Adds/updates pnpm overrides to pin vulnerable transitives to patched versions. |
| src/frontend/package.json | Bumps direct dependencies (astro, sharp, vitest) involved in the security remediation. |
| src/frontend/pnpm-lock.yaml | Updated dependency resolution output consistent with the new direct deps + overrides. |
Review details
- Files reviewed: 2/3 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| "@mdx-js/mdx": "^3.1.1", | ||
| "asciinema-player": "^3.17.0", | ||
| "astro": "^7.1.3", | ||
| "astro": "^7.2.8", |
Clears all open Dependabot alerts for src/frontend (1 critical, 6 high, 5 medium): - astro 7.1.3 -> 7.2.10 (critical GHSA + medium) - sharp 0.35.3 -> 0.35.4 (high) - vitest 4.1.10 -> 4.1.11; @vitest/mocker -> 4.1.11 (medium) - pnpm overrides: js-yaml 4.3.2, nanoid 3.3.18, svgo 4.1.0, fflate 0.7.5, smol-toml 1.7.1 Verified: pnpm install OK; pnpm audit -> no known vulnerabilities; astro sync OK. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
David Pine (IEvangelist)
force-pushed
the
dapire/security-deps/aspire.dev-frontend-npm
branch
from
September 10, 2026 14:20
76b7dda to
16f96b2
Compare
Contributor
Frontend HTML artifact readyThe latest frontend build uploaded the This comment updates automatically when a new frontend build artifact is uploaded. |
Alistair Matthews (alistairmatthews)
approved these changes
Sep 10, 2026
Alistair Matthews (alistairmatthews)
left a comment
Alistair Matthews (alistairmatthews)
left a comment
Contributor
There was a problem hiding this comment.
This all works on my machine. Approved.
Eric Erhardt (eerhardt)
approved these changes
Sep 15, 2026
David Pine (IEvangelist)
deleted the
dapire/security-deps/aspire.dev-frontend-npm
branch
September 15, 2026 18:41
David Pine (IEvangelist)
added a commit
that referenced
this pull request
Sep 16, 2026
* Keep docs versions current and default to TypeScript AppHosts (#1600) * Keep docs versions current and default to TypeScript Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address TypeScript-first review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore: Update integration data and GitHub stats (9/2/26) (#1612) Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore: Update integration data and GitHub stats (9/3/26) (#1615) Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore: Update integration data and GitHub stats (9/4/26) (#1622) Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore: Update integration data and GitHub stats (9/7/26) (#1625) Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore: Update integration data and GitHub stats (9/8/26) (#1629) Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Merge Duplicate C#/.NET Sidebar Sections (#1632) * Fix: merge duplicate C#/.NET sidebar sections under Frameworks & runtimes * Clean:revert unrelated icon safelist regeneration * fix: match sidebar label to page title for .NET get-started item * Claude's accessibility fixes. (#1595) * Claude's accessibility fixes. * Addressed list margins feedback from @Copilot. * chore: Update integration data and GitHub stats (9/9/26) (#1640) * chore: Update integration data and GitHub stats (9/9/26) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: keep integration documentation mappings synchronized Remove the stale Bun mapping, reconcile catalog-managed mappings during updates, and stage documentation-map changes in automated PRs. Validate structured data without Astro-generated asset side effects. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: David Pine <david.pine@microsoft.com> * docs: restore Floci integration documentation (#1590) * docs: restore Floci integration documentation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: address Floci review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore: Update integration data and GitHub stats (9/10/26) (#1647) Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Improve search discoverability and agent-readable content (#1633) * feat: improve search and agent discoverability Restore page-specific descriptions, publish useful homepage Markdown, strengthen observability guidance, and defer inactive AppHost examples. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: keep mobile homepage within layout budget Tighten spacing in the expanded observability section so the production mobile viewport remains within the existing compactness gate. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: align agent docs and search indexing Document authenticated standalone MCP with an explicit API key and keep deferred AppHost examples out of the homepage Pagefind index. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Bump OpenTelemetry.Exporter.OpenTelemetryProtocol and 4 others (#1602) Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.17.0 to 1.18.0 Bumps OpenTelemetry.Extensions.Hosting from 1.17.0 to 1.18.0 Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.17.0 to 1.18.0 Bumps OpenTelemetry.Instrumentation.Http from 1.17.0 to 1.18.0 Bumps OpenTelemetry.Instrumentation.Runtime from 1.17.0 to 1.18.0 --- updated-dependencies: - dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-selected - dependency-name: OpenTelemetry.Extensions.Hosting dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-selected - dependency-name: OpenTelemetry.Instrumentation.AspNetCore dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-selected - dependency-name: OpenTelemetry.Instrumentation.Http dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-selected - dependency-name: OpenTelemetry.Instrumentation.Runtime dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-selected ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump the github-actions group across 1 directory with 2 updates (#1601) Bumps the github-actions group with 2 updates in the / directory: [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) and [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions). Updates `github/gh-aw-actions/setup` from 0.87.1 to 0.88.0 - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](github/gh-aw-actions@423b3dc...afc709f) Updates `github/gh-aw-actions/setup-cli` from 0.87.1 to 0.88.0 - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](github/gh-aw-actions@423b3dc...afc709f) --- updated-dependencies: - dependency-name: github/gh-aw-actions/setup dependency-version: 0.87.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.87.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Hide the right TOC when the mobile TOC is visible (#1655) * Fix right TOC width at browser zoom levels Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Hide right TOC when mobile TOC is visible Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Docs: capture 13.2 Foundry rename breaking changes and remove legacy AIFoundry references (#1163) * docs: clarify Foundry migration guidance Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: update Foundry package versions Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b8ebe88c-337e-4d4a-aa80-e14c2c76289b --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Maddy Montaquila <maddy@MadBook-Pro-20.local> Copilot-Session: b8ebe88c-337e-4d4a-aa80-e14c2c76289b * Update deployment docs to pipeline-step APIs and remove legacy callback annotation references (#1158) * Update deployment docs to pipeline-step API Refresh custom deployment examples for pipeline steps and clarify legacy callback references in deployment, diagnostics, and release notes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5b0c81a3-d822-462e-8cf5-8eb6debfe968 * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Restore historical What's new content Keep release-version articles unchanged while retaining the current pipeline API updates elsewhere. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address deployment docs review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b156fe61-0b1c-460c-9735-1eaeaa356b0a * Align Aspire 9.4 deployment example with pipelines Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b156fe61-0b1c-460c-9735-1eaeaa356b0a --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: David Pine <david.pine@microsoft.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Maddy Montaquila <maddy@MadBook-Pro-20.local> Copilot-Session: 5b0c81a3-d822-462e-8cf5-8eb6debfe968 Copilot-Session: b156fe61-0b1c-460c-9735-1eaeaa356b0a * Live status header icon + redesigned videos page (#758) * Add live-status header icon, SSE backend, redesigned videos page - Adds a strobing live-status indicator in the site header (left of the cookie-preferences button) wired to a new /api/live SSE endpoint. - Adds a custom floating PiP player that follows visitors across the site while live and returns them to the videos page on close. - Replaces the legacy curated /community/videos/ page with a focused YouTube + Twitch tabbed page whose embed lights up when live. - Adds an in-StaticHost background-worker stack: * Twitch EventSub stream.online/offline subscription + reconcile, * YouTube WebSub subscribe/renew + confirming poll fallback, * a debounced LiveStatusBroadcaster with sticky primary-source mesh logic and Channel<T> SSE fan-out. - Surfaces the new endpoints + Scalar API reference (with a custom Aspire-brand theme) on the Aspire dashboard for local dev. - Includes a worktree cleanup helper script and PR_BODY.md. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add tests for live-status feature - StaticHost.Tests xUnit project: TwitchWebhookHandler (HMAC-SHA256 round-trip + tamper detection), YouTubeWebhookHandler (HMAC-SHA1 + Atom video-id extraction), LiveStatusBroadcaster (sticky-primary mesh, coalesce window via FakeTimeProvider, subscribe/unsubscribe). - vitest spec for live-status.ts public API. - Playwright spec mocking /api/live + a controllable SSE stream to drive the header icon strobe and the floating PiP open/close UX. 22 backend xUnit tests + 3 vitest assertions all green locally. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Unwrap draft PR body Remove hard-wrapped prose from the draft PR description so GitHub renders paragraphs and list items without arbitrary line breaks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Remove draft PR body file Do not keep the temporary GitHub PR description file in source control. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Remove worktree cleanup scripts The cleanup helpers were workflow-only artifacts and should not be source controlled. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add local live-status dev controls - Enable an explicit AppHost local dev mode for live-status testing. - Add dashboard HTTP commands on the StaticHost resource to fake Twitch and YouTube live events, including signed calls to the real webhook endpoints. - Keep provider workers idle when API credentials are absent so local state only changes when commanded. - Fix the live-status JSON contract to emit youtube, matching the frontend client, and add coverage for that shape. - Document dashboard-command and manual HTTP testing paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Secure live dev commands and native PiP Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Keep live PiP open across navigation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Build frontend directly into StaticHost Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Keep live PiP alive across site navigation Enable Astro client routing so same-origin site links swap content without unloading the opener document that owns the native Document Picture-in-Picture window. Update the live-status e2e coverage to click a real internal Docs link and assert the PiP iframe remains intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Let users choose live PiP source When both Twitch and YouTube are live, show an explicit live-source menu from the header action before opening native Picture-in-Picture. Keep the selected source sticky while it remains live and allow switching an existing PiP window without recreating it. Also replace noisy iframe title attributes on the live embeds with aria-labels so the videos tabs keep an accessible frame name without hover title noise. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Polish live stream chooser Add YouTube and Twitch icons to the live-source chooser and remove the redundant aspiredotdev helper text. Rename the Community sidebar entry and related live destination copy from videos to Live Streams. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix live UX navigation regressions Preserve the cookie consent root across Astro client-side body swaps so preferences continue to open after navigation. Restyle the live source chooser to align with the existing install modal treatment and cover the cookie regression with Playwright. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add live stream action dialog Always show the live chooser while live so users can pick native PiP, the aspire.dev embeds, or the provider platform directly. Add a session-scoped dismiss action that silences the strobing live notification for the current live event without hiding the live entry point. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix live dialog mobile layout Keep the live action dialog within narrow viewports and add mobile E2E coverage using mocked live status APIs. Also keep generated StaticHost output out of Debug build item discovery so local AppHost starts remain fast. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Polish live dialog responsive behavior Make repeated live icon clicks toggle the live dialog, render the mobile dialog as a stable full-width sheet, restore a wider desktop menu with one-line labels, and harden mocked live-status E2E coverage for both layouts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Move mobile live dialog below header Anchor the mobile live action dialog below the top navigation instead of using a bottom sheet, add a top-right dismiss button matching the Install CLI modal affordance, and update E2E coverage for placement and dismiss behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Polish live actions and notification sessions Use regular Fluent icon names for local live command actions, reorganize the live action dialog into PiP, embedded-player, and platform groups, add external-link affordances, and introduce a stable liveSessionId so dismissing a live notification covers near-simultaneous provider joins. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix compact header regression expectation Account for the live status header action in the compact header reachability test and map it by tour target so the assertion remains stable when live-state labels change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add StaticHost live unit coverage Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address live status PR feedback Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * * PR feedback * fixup * Fix API reference search controllers under view transitions The six API reference page templates initialized their search controllers inside a `DOMContentLoaded` listener. After this branch adds the `<ClientRouter />` to `Head.astro` (so the live PiP can persist across navigation), the site swaps bodies via view transitions and `DOMContentLoaded` does not refire on subsequent navigations. As a result, clicking the C#/TypeScript API buttons from the global search dialog landed on the API page with the URL `?q=` parameter in place but the controller was never instantiated, so `#ts-api-search-input` (and its C# counterpart) was never populated and search results were never rendered. Switch all six API reference page initializers to `astro:page-load`, which fires on the initial load and after every view-transition swap. This matches the convention already used by `Sidebar.astro`, `PageTitle.astro`, `InstallCliModal.astro`, and the rest of the post-ClientRouter components in this branch. Resolves: tests/e2e/site-search.spec.ts:200 'typed query is forwarded to the C# and TypeScript API buttons' (desktop / tablet / mobile chromium). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address PR review feedback for live-status Backend (StaticHost): - Broadcaster: seed+register subscribers atomically under the lock so a flush landing mid-subscribe can't strand a client on the stale seed; resolve sticky primary against the pending basis so the first source stays primary when a second joins within the coalesce window; ignore UpdatedAt when deciding whether anything substantive changed so an ever-advancing timestamp can't force a redundant broadcast. - Twitch webhook: reject stale/unparseable Message-Timestamp (10-min window, 1-min future skew) to bound replay of genuinely-signed callbacks; skip message-id dedup for verification handshakes so retried challenges always echo; inject TimeProvider. - YouTube webhook: replace the untracked per-notification Task.Run with a bounded, coalescing YouTubeLiveConfirmationQueue BackgroundService (capacity-1 DropWrite) tied to the host stopping token. - Reconcile loops: only swallow OperationCanceledException when the stopping token actually fired, so genuine cancellations elsewhere still surface. - Cache-Control: no-store now applied centrally to the whole /api/live group via an endpoint filter instead of per-handler. Frontend: - Seed fetch no longer clobbers fresher SSE state (apply only when not older). - Tabs: only trusted (real user) clicks make a tab sticky, so auto-switch keeps working; synthetic activateTab() clicks are ignored. - build-static-host: restore scalar/.gitignore in finally before the temp dir is removed, so a failed astro build can't lose the only preserved copies. - Dev proxy: AppHost injects StaticHost's origin (ASPIRE_STATICHOST_URL) and Vite proxies /api/live[/stream] to it under `aspire run`; omitted in CI/prod. - Playwright: fulfil the SSE route with a complete string body via a shared helper instead of a ReadableStream that serialised to garbage. Tests: - Broadcaster: coalesce-window primary stickiness and no-op suppression regressions. - TwitchWebhookHandler.IsFresh: fresh/stale/skew/unparseable. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix botched merge in Header.astro cookie consent The merge left Header.astro importing the removed `vanilla-cookieconsent` package, breaking the frontend build. upstream/main replaced that package with a global `[data-cookie-manage-consent]` handler in Head.astro (`siteConsent.manageConsent()`), so drop the stale import and script and keep only the live-status wiring. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Add seoTitle to videos page to satisfy SEO length guard The redesigned videos page composed an og:title of only 23 characters ("Aspire Live 📺 · Aspire"), below the 30-65 guard range enforced by tests/unit/seo-lengths.vitest.test.ts. Add a verbatim `seoTitle` override (55 chars, in the 50-60 optimal range) so the social-card title stays keyword-rich without lengthening the visible page title. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Remove obsolete cookie-preferences SPA-nav e2e test This PR-only test leaked into the merge without its `openCookiePreferences` helper, causing a ReferenceError across all e2e shards. The helper asserted the `#pm__title` vanilla-cookieconsent modal, but upstream/main removed that library in favor of a global `[data-cookie-manage-consent]` delegated listener (Head.astro) that survives client-side navigation by design. The new mechanism is already covered by cookie-consent.spec.ts, so drop the stale test. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden live status production readiness Back production stream settings with Azure Key Vault, make YouTube polling and WebSub quota-safe, and repair local proxy, client-navigation lifecycle, static asset, and autoplay behavior. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Ignore generated Aspire publish output Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Prefer provider handoff for mobile live streams Keep Document Picture-in-Picture on desktop while touch-first devices use provider apps or the existing iframe page. Improve chooser focus, failure feedback, touch targets, and iframe permissions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update live command tests for Aspire 13.5 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Use read-only site secrets and reduce live-status overhead Provision a shared siteconfig vault without secret values, preserve read-only references, reuse SSE frames and timers, and avoid redundant player and navigation work. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Use parameters for live configuration Keep non-sensitive live-status settings as deployment parameters while retaining provider credentials and webhook signing keys as read-only Key Vault references. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update ASP.NET Core OpenAPI package Use Microsoft.AspNetCore.OpenApi 10.0.12 so StaticHost resolves a current, non-vulnerable Microsoft.OpenApi dependency. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Isolate live status scaling Keep the public StaticHost on Aspire's normal per-site worker ceiling and proxy live-status traffic to a dedicated single-worker coordinator. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Use Redis for distributed live status Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Rename live cache variable Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Load live secrets from Key Vault configuration Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address live status review feedback Use direct Redis optimistic concurrency for shared records, require distributed production services, clarify resource names and startup behavior, and share frontend brand tokens with Scalar. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Remove Redis key versions Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address live status review feedback and coverage gaps Preserve consent and API search ownership across navigation, fence YouTube observations, make WebSub retries idempotent, and refresh rejected Twitch tokens. Add mapped HTTP, Redis, and accessibility coverage and run backend suites in CI. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Use Aspire to manage Redis integration test infrastructure Create the Redis-only application with DistributedApplicationTestingBuilder and the same Azure Managed Redis hosting integration as the AppHost. Remove the separate CI image pin, external connection-string contract, and shared-instance ownership guards. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix live embeds on staging and show YouTube uploads offline Resolve Twitch parent from the browser hostname before loading, correct the shared Aspire YouTube channel, and switch between the non-autoplaying uploads playlist and exact live video. Cover source transitions, hidden tabs, and client navigation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Eric Erhardt <eric.erhardt@microsoft.com> Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> * Make Dev Container guides language-neutral (#1667) * docs: recreate language-neutral dev container guides Recreates #1627, including the certificate trust clarification and refreshed template screenshots. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: remove unnecessary SDK aside from container guides Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * [auto-sec] aspire.dev: remediate 12 frontend npm security alerts (#1645) Clears all open Dependabot alerts for src/frontend (1 critical, 6 high, 5 medium): - astro 7.1.3 -> 7.2.10 (critical GHSA + medium) - sharp 0.35.3 -> 0.35.4 (high) - vitest 4.1.10 -> 4.1.11; @vitest/mocker -> 4.1.11 (medium) - pnpm overrides: js-yaml 4.3.2, nanoid 3.3.18, svgo 4.1.0, fflate 0.7.5, smol-toml 1.7.1 Verified: pnpm install OK; pnpm audit -> no known vulnerabilities; astro sync OK. Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: restore site search after client-side navigation (#1675) * fix: restore site search after client-side navigation Initialize Pagefind per connected search element and dispose stale listeners and UI instances when navigating. Add navigation, history, API-page, and delayed-import regressions. Fixes #1673 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: preserve Mermaid layout across client navigation Keep Mermaid centering and responsive SVG sizing in the bundled stylesheet rather than relying on the plugin's one-time injected head style. Cover repeated navigation in light and dark themes on desktop and mobile. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: keep two-slash hover popups paired across navigation Replace competing plugin and inline hover initializers with one site-owned runtime that pairs each token with its generated popup and initializes each new page idempotently. Preserve rendered hover styles and Expressive Code tools. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: restore filters and history across client navigation Reinitialize API version, integration, and sample filters for each page and dispose outgoing listeners and debounce timers. Preserve Astro history state when filtering and avoid adding history entries during gallery initialization. Cover repeated navigation and Back on desktop and mobile. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * test: use the touch navigation fallback for site search Match the existing client-navigation suites by exercising native view transitions on desktop and ClientRouter's supported swap fallback on mobile and tablet. This prevents Chromium touch-emulation transition-abort exceptions from failing the strict search error assertions. Preserve all input, results, focus, history, and page-error checks. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix YouTube WebSub topic and back off subscription failures (#1674) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix registry-specific tarball URLs in frontend lockfile Remove Microsoft mirror URL overrides while preserving pinned versions and integrity hashes so CI passes pnpm supply-chain checks. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Restore npm SHA-512 integrity hashes in frontend lockfile Refresh integrity metadata from the public npm registry while preserving all pinned dependency versions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Remove duplicate Floci integration catalog entry Keep the Floci entry with 100 downloads and remove the earlier duplicate that caused resource catalog prerendering to fail. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: David Pine <david.pine@microsoft.com> Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: David Aniebo <aniebovictor001@gmail.com> Co-authored-by: Alistair Matthews <alistairwebdojo@live.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Maddy Montaquila <maddy@MadBook-Pro-20.local> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Copilot-Session: b8ebe88c-337e-4d4a-aa80-e14c2c76289b Copilot-Session: 5b0c81a3-d822-462e-8cf5-8eb6debfe968 Copilot-Session: b156fe61-0b1c-460c-9735-1eaeaa356b0a
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[auto-sec]Canonical — aspire.dev frontend npm security clusterCanonical remediation PR for the aspire.dev dependency/security cluster.
Branch
dapire/security-deps/aspire.dev-frontend-npm, based on the latestorigin/main, labeledautomated-security.Alerts addressed — all 12 open Dependabot alerts (1 critical, 6 high, 5 moderate)
7.1.3 → 7.2.100.35.3 → 0.35.44.3.23.3.181.7.14.1.00.7.54.1.10 → 4.1.114.1.11How
src/frontend/package.json:astro,sharp,vitest.src/frontend/pnpm-workspace.yamloverrides— therepo's existing security-remediation mechanism. Stale overrides refreshed
(
js-yaml4.3.1→4.3.2,nanoid3.3.17→3.3.18,svgo=4.0.0→<4.1.0:4.1.0)and new surgical range overrides added (
fflate,smol-toml,@vitest/mocker).src/frontend/pnpm-lock.yamlregenerated withpnpm install(astro minor bumpaccounts for the large lockfile delta).
Verification
pnpm install— succeeds; lockfilenpm ci-consistent.pnpm audit— No known vulnerabilities found.pnpm exec astro sync— config + all integrations + content types load under astro7.2.10.Supersedes (Dependabot PRs folded into this canonical cluster)
These remain open and tracked until this canonical PR is confirmed green, per the
closure gate; they will then be closed as superseded.
canonical_count_frontend-npm = 1