Skip to content

[auto-sec] Consolidate aspire dependency security remediations (75 alerts) - #20032

Open
David Pine (IEvangelist) wants to merge 1 commit into
mainfrom
dapire/security-deps/aspire-npm-lockfiles
Open

[auto-sec] Consolidate aspire dependency security remediations (75 alerts)#20032
David Pine (IEvangelist) wants to merge 1 commit into
mainfrom
dapire/security-deps/aspire-npm-lockfiles

Conversation

@IEvangelist

@IEvangelist David Pine (IEvangelist) commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

[auto-sec] aspire dependency security consolidation

Canonical automated-security remediation PR for microsoft/aspire. Converges the repo's open Dependabot alerts into a single change set. No application source changes — only lockfiles plus minimal, same-major overrides / resolutions.

Alerts addressed

Clears 74 of 75 open Dependabot alerts (all npm ecosystem): 2 critical, 28 high, 44 moderate, 1 low. 1 deferred (see below).

Mechanism by manifest kind

Kind Count How
npm package-lock.json 25 targeted overrides + npm install --package-lock-only
pnpm-lock.yaml (AspireWithNode/NodeFrontend) 1 pnpm.overrides + pnpm install
yarn.lock (extension) 1 resolutions + yarn install (dnceng public feed)

Key version bumps

  • next 16.2.11 → 16.3.3 (critical)
  • qs → 6.16.0, fast-uri → 3.1.6, @humanfs/node → 0.16.8, browserslist → 4.28.7, js-yaml → 4.3.2, nanoid → 3.3.18, hono → 4.13.5, postcss-selector-parser → 7.1.3, decode-uri-component → 0.5.0 (npm dirs), @opentelemetry/core → 2.8.0, @opentelemetry/propagator-jaeger → 2.9.0, sharp → 0.35.4, vitest / @vitest/mocker → 4.1.11

extension/yarn.lock feed handling

The VS Code extension resolves yarn deps from the dnceng public Azure Artifacts feed, and CI runs yarn install --frozen-lockfile against it anonymously. Only versions already cached on that feed are anonymously downloadable. To keep the frozen install green, browserslist's transitive data-deps are pinned to the feed's cached versions (all satisfy browserslist@4.28.7's caret ranges):

  • baseline-browser-mapping → 2.11.20, electron-to-chromium → 1.5.420, node-releases → 2.0.54

Deferred alert (1)

decode-uri-component ≥ 0.5.0 in extension/yarn.lock (moderate). The 0.5.0 tarball is not cached on the dnceng public feed (anonymous request returns 401); since CI accesses the feed anonymously, pinning it would break the extension build. Left at the current cached 0.2.2. Unblock: a maintainer with authenticated access to the internal feed regenerates extension/yarn.lock (which primes the cache), after which 0.5.0 becomes anonymously available and this alert clears. Every other extension alert (qs, fast-uri, js-yaml, @humanfs/node, browserslist) is remediated.

Verification

Static check of every alert's installed version in the regenerated lockfiles vs first-patched: 74/75 cleared, 1 deferred as above. No private-feed URLs leaked; local yarn install --frozen-lockfile against dnceng passes.

Superseded / tracked Dependabot PRs

Closed once this canonical PR is green and merged (closure gate): #19513, #19844, #19845, #19863.
Out of scope (non-npm): #19852 (GitHub Actions), #19075 (Maven).

Idempotency

Branch dapire/security-deps/aspire-npm-lockfiles from latest upstream/main. Label automated-security. Prefix [auto-sec].

@IEvangelist David Pine (IEvangelist) added the automated-security Automated security fix label Sep 10, 2026
@IEvangelist David Pine (IEvangelist) mentioned this pull request Sep 10, 2026
Open
@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20032

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20032"

This was referenced Sep 10, 2026
Open
Closed
@github-actions github-actions Bot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Sep 10, 2026
@IEvangelist David Pine (IEvangelist) mentioned this pull request Sep 10, 2026
Open
@aspire-repo-bot
aspire-repo-bot Bot requested a balanced review from Copilot September 10, 2026 14:34
@github-actions

This comment has been minimized.

Sign in to view
Copilot AI reviewed Sep 10, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Extension restore fails on an unavailable mirrored tarball, and the ESM override breaks a CommonJS dependency.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Consolidates npm security remediations across extension, templates, tests, and playgrounds without application source changes.

Changes:

  • Pins patched transitive dependencies through overrides/resolutions.
  • Regenerates npm, pnpm, and Yarn lockfiles.
  • Updates Next.js and Vitest to patched releases.
File summaries
File Description
extension/package.json Adds security resolutions.
extension/yarn.lock Refreshes resolved extension dependencies.
playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json Locks patched Angular dependencies.
playground/AspireWithJavaScript/AspireJavaScript.Angular/package.json Adds Angular dependency overrides.
playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package-lock.json Locks patched Node dependencies.
playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package.json Overrides qs.
playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json Locks patched React dependencies.
playground/AspireWithJavaScript/AspireJavaScript.React/package.json Adds React dependency overrides.
playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json Locks patched Vite dependencies.
playground/AspireWithJavaScript/AspireJavaScript.Vite/package.json Adds Vite dependency overrides.
tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package.json Overrides qs.
tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package-lock.json Locks patched Vitest dependencies.
tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package.json Pins Vitest packages.
playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json Locks patched Vue dependencies.
playground/AspireWithJavaScript/AspireJavaScript.Vue/package.json Adds Vue dependency overrides.
playground/AspireWithNode/NodeFrontend/package-lock.json Locks patched npm graph.
playground/AspireWithNode/NodeFrontend/package.json Aligns npm and pnpm overrides.
playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml Locks patched pnpm graph.
playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json Locks patched browser dependencies.
playground/BrowserTelemetry/BrowserTelemetry.Web/package.json Adds browser dependency overrides.
playground/FoundryAgentEnterprise/frontend/package-lock.json Locks patched frontend dependencies.
playground/FoundryAgentEnterprise/frontend/package.json Overrides @humanfs/node.
playground/JavaAppHost/api/package-lock.json Locks patched API dependencies.
playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package.json Overrides qs.
playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json Locks patched browser dependencies.
playground/TypeScriptApps/RpsArena/arena-frontend/package.json Adds browser overrides.
playground/TypeScriptApps/RpsArena/node-player/package-lock.json Locks patched qs graph.
playground/TypeScriptApps/RpsArena/node-player/package.json Overrides qs.
src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json Updates Java starter lockfile.
src/Aspire.Cli/Templating/Templates/java-starter/frontend/package.json Overrides @humanfs/node.
src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json Updates Python frontend lockfile.
src/Aspire.Cli/Templating/Templates/py-starter/frontend/package.json Overrides @humanfs/node.
src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json Updates Python starter lockfile.
playground/JavaAppHost/api/package.json Adds telemetry and qs overrides.
playground/JavaAppHost/frontend/package-lock.json Updates Java frontend lockfile.
playground/JavaAppHost/frontend/package.json Overrides @humanfs/node.
playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json Locks patched qs graph.
playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package.json Overrides qs.
playground/PythonAppHost/frontend/package-lock.json Updates Python playground lockfile.
playground/PythonAppHost/frontend/package.json Overrides @humanfs/node.
playground/TypeScriptAppHost/express-api/package-lock.json Locks patched qs graph.
playground/TypeScriptAppHost/express-api/package.json Overrides qs.
playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json Locks patched qs graph.
src/Aspire.Cli/Templating/Templates/py-starter/package.json Overrides @humanfs/node.
src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json Updates TypeScript frontend lockfile.
src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package.json Overrides @humanfs/node.
src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json Updates TypeScript starter lockfile.
src/Aspire.Cli/Templating/Templates/ts-starter/package.json Overrides @humanfs/node.
src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package-lock.json Updates project-template lockfile.
src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package.json Overrides @humanfs/node.
tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json Locks patched Next.js graph.
tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package.json Updates Next.js and overrides.
tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package-lock.json Locks patched qs graph.
Review details

Files not reviewed (26)

  • playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml: Generated file
  • playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json: Generated file
  • playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
  • playground/JavaAppHost/api/package-lock.json: Generated file
  • playground/JavaAppHost/frontend/package-lock.json: Generated file
  • playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json: Generated file
  • playground/PythonAppHost/frontend/package-lock.json: Generated file
  • playground/TypeScriptAppHost/express-api/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/node-player/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json: Generated file
  • src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package-lock.json: Generated file
  • tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json: Generated file
  • tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package-lock.json: Generated file
  • tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package-lock.json: Generated file
  • Files reviewed: 26/53 changed files
  • Comments generated: 1
  • Review effort level: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Comment thread extension/package.json Outdated
@IEvangelist
[auto-sec] Consolidate aspire npm/pnpm/yarn dependency security remed…
1f91553 
…iations

Clears 74 of 75 open Dependabot alerts (all npm ecosystem) across 27 manifests
via targeted overrides/resolutions + lockfile regeneration. No application source
changes.

Ecosystem mechanism:
- 25 package-lock.json: npm overrides + npm install --package-lock-only
- 1 pnpm-lock.yaml (AspireWithNode/NodeFrontend): pnpm.overrides
- 1 yarn.lock (extension): resolutions (dnceng public feed preserved)

Key bumps: next 16.2.11->16.3.3 (critical), qs 6.16.0, fast-uri 3.1.6,
@humanfs/node 0.16.8, browserslist 4.28.7, js-yaml 4.3.2, nanoid 3.3.18,
hono 4.13.5, postcss-selector-parser 7.1.3, @opentelemetry/core 2.8.0, sharp
0.35.4, vitest 4.1.11.

extension/yarn.lock: pinned browserslist's transitive data-deps to versions
cached on the dnceng public feed (baseline-browser-mapping 2.11.20,
electron-to-chromium 1.5.420, node-releases 2.0.54) so the anonymous
--frozen-lockfile CI install resolves.

Deferred (1 alert): decode-uri-component >=0.5.0 in extension/yarn.lock. The
0.5.0 tarball is not cached on the dnceng public feed (anonymous 401) and the CI
feed access is anonymous, so pinning it would break the extension build. Kept at
the current cached 0.2.2 pending a maintainer regenerating the lock through the
authenticated internal feed to prime the cache.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@IEvangelist
David Pine (IEvangelist) force-pushed the dapire/security-deps/aspire-npm-lockfiles branch from 3f2ecfd to 1f91553 Compare September 10, 2026 14:56
@aspire-repo-bot
aspire-repo-bot Bot requested a balanced review from Copilot September 10, 2026 14:57
@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Tests selector

4 / 99 PR test projects · 6 PR jobs · 1 advisory-only target, from 53 changed files.

Selected PR test projects (4 / 99)

Aspire.Cli.EndToEnd.Tests, Aspire.Cli.Tests, Aspire.Playground.Tests, Aspire.Templates.Tests

Selected PR jobs (6)

cli-starter-validation, extension-e2e, extension-unit, polyglot, typescript-api-compat, typescript-sdk

Advisory workflow impact (1)

  • deployment-e2e (schedule/dispatch-only)
How these were chosen — grouped by what changed

🔧 src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package-lock.json (changed source)
→ 2 directly: Aspire.Cli.Tests, Aspire.Templates.Tests

📦 affected project Aspire.Cli
→ 1 test: Aspire.Cli.EndToEnd.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.Angular/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.React/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.Vite/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithJavaScript/AspireJavaScript.Vue/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithNode/NodeFrontend/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithNode/NodeFrontend/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/BrowserTelemetry/BrowserTelemetry.Web/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/FoundryAgentEnterprise/frontend/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/FoundryAgentEnterprise/frontend/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/JavaAppHost/api/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/JavaAppHost/api/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/JavaAppHost/frontend/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/JavaAppHost/frontend/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/PythonAppHost/frontend/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/PythonAppHost/frontend/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptAppHost/express-api/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptAppHost/express-api/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/RpsArena/arena-frontend/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/RpsArena/node-player/package-lock.json (changed)
→ 1 directly: Aspire.Playground.Tests

📄 playground/TypeScriptApps/RpsArena/node-player/package.json (changed)
→ 1 directly: Aspire.Playground.Tests

🔧 src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json (changed source)
→ 1 via the project graph: Aspire.Cli.Tests

🔧 src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package.json (changed source)
→ 1 directly: Aspire.Templates.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package.json (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package-lock.json (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package.json (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

Job reasons

Job Triggered by
cli-starter-validation affected project Aspire.Cli
deployment-e2e • src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package-lock.json, src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package.json
• affected project Aspire.Cli
extension-e2e • extension/package.json, extension/yarn.lock, src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json, src/Aspire.Cli/Templating/Templates/java-starter/frontend/package.json, src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json, src/Aspire.Cli/Templating/Templates/py-starter/frontend/package.json, src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json, src/Aspire.Cli/Templating/Templates/py-starter/package.json, src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json, src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package.json, src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json, src/Aspire.Cli/Templating/Templates/ts-starter/package.json, tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json, tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package.json, tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package-lock.json, tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package.json
• affected project Aspire.Cli
extension-unit extension/package.json, extension/yarn.lock
polyglot affected project Aspire.Cli
typescript-api-compat affected project Aspire.Cli
typescript-sdk src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json, src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package.json, src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json, src/Aspire.Cli/Templating/Templates/ts-starter/package.json, tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package-lock.json, tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package.json

Selection computed for commit 1f91553.

Copilot AI reviewed Sep 10, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The broad multi-manager lockfile refresh and feed-sensitive extension restore require final CI and human validation.

Review details

Files not reviewed (26)

  • playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.NodeApp/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json: Generated file
  • playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/package-lock.json: Generated file
  • playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml: Generated file
  • playground/BrowserTelemetry/BrowserTelemetry.Web/package-lock.json: Generated file
  • playground/FoundryAgentEnterprise/frontend/package-lock.json: Generated file
  • playground/JavaAppHost/api/package-lock.json: Generated file
  • playground/JavaAppHost/frontend/package-lock.json: Generated file
  • playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json: Generated file
  • playground/PythonAppHost/frontend/package-lock.json: Generated file
  • playground/TypeScriptAppHost/express-api/package-lock.json: Generated file
  • playground/TypeScriptApps/AzureFunctionsSample/TypeScriptApiService/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json: Generated file
  • playground/TypeScriptApps/RpsArena/node-player/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/py-starter/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json: Generated file
  • src/Aspire.Cli/Templating/Templates/ts-starter/package-lock.json: Generated file
  • src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package-lock.json: Generated file
  • tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json: Generated file
  • tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/npmscript/package-lock.json: Generated file
  • tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package-lock.json: Generated file
  • Files reviewed: 26/53 changed files
  • Comments generated: 0 new
  • Review effort level: Balanced

@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Balanced
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@adamint Adam Ratzman (adamint) Awaiting requested review from adamint adamint is a code owner
@ellahathaway Ella Hathaway (ellahathaway) Awaiting requested review from ellahathaway ellahathaway is a code owner
@mitchdenny Mitch Denny (mitchdenny) Awaiting requested review from mitchdenny mitchdenny is a code owner
@JamesNK James Newton-King (JamesNK) Awaiting requested review from JamesNK JamesNK is a code owner
@davidfowl David Fowler (davidfowl) Awaiting requested review from davidfowl davidfowl is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

automated-security Automated security fix needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@IEvangelist