[auto-sec] Consolidate aspire-samples dependency security remediations - #1782
#1782[auto-sec] Consolidate aspire-samples dependency security remediations#1782IEvangelist wants to merge 6 commits intomainmicrosoft/aspire-samples:mainfrom dapire/security-deps/aspire-samples-lowrisk-batchmicrosoft/aspire-samples:dapire/security-deps/aspire-samples-lowrisk-batchCopy head branch name to clipboard
Conversation
There was a problem hiding this comment.
Pull request overview
This PR consolidates multiple dependency security remediations across the aspire-samples repo by updating pinned/locked dependency versions and introducing npm overrides to enforce patched minima in affected sample apps.
Changes:
- Add
overridesto multiple samplepackage.jsonfiles to force patched versions ofesbuildand@babel/core, plus additional overrides in the Angular sample. - Update multiple
package-lock.jsonfiles to reflect the remediated dependency graph. - Update Python
uv.lockto bumpstarletteto a patched version (transitive via FastAPI).
Reviewed changes
Copilot reviewed 9 out of 19 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
| samples/vite-yarp-static/package.json | Adds overrides to pin esbuild to a patched version. |
| samples/vite-yarp-static/package-lock.json | Updates lockfile to reflect patched esbuild resolution. |
| samples/vite-react-fastapi/package.json | Adds overrides to pin esbuild to a patched version. |
| samples/vite-react-fastapi/package-lock.json | Updates lockfile to reflect patched esbuild resolution. |
| samples/rag-document-qa-svelte/api/uv.lock | Updates locked Python dependency graph (notably starlette). |
| samples/python-openai-agent/package.json | Adds overrides to pin esbuild to a patched version. |
| samples/python-openai-agent/package-lock.json | Updates lockfile to reflect patched esbuild resolution. |
| samples/python-fastapi-postgres/package.json | Adds overrides to pin esbuild to a patched version. |
| samples/python-fastapi-postgres/package-lock.json | Updates lockfile to reflect patched esbuild resolution. |
| samples/polyglot-task-queue/package.json | Adds overrides to pin esbuild to a patched version. |
| samples/polyglot-task-queue/package-lock.json | Updates lockfile to reflect patched esbuild resolution. |
| samples/node-express-redis/package.json | Adds overrides to pin esbuild to a patched version. |
| samples/node-express-redis/package-lock.json | Updates lockfile to reflect patched esbuild resolution. |
| samples/aspire-with-python/frontend/package.json | Adds overrides to pin @babel/core to a patched version. |
| samples/aspire-with-python/frontend/package-lock.json | Updates lockfile to reflect patched @babel/* resolution. |
| samples/aspire-with-javascript/AspireJavaScript.Vite/package.json | Adds overrides to pin @babel/core to a patched version. |
| samples/aspire-with-javascript/AspireJavaScript.Vite/package-lock.json | Updates lockfile to reflect patched @babel/* resolution. |
| samples/aspire-with-javascript/AspireJavaScript.Angular/package.json | Bumps @angular/core and adds multiple security-related overrides. |
| samples/aspire-with-javascript/AspireJavaScript.Angular/package-lock.json | Updates Angular lockfile to reflect remediations and dependency graph changes. |
Files not reviewed (9)
- samples/aspire-with-javascript/AspireJavaScript.Angular/package-lock.json: Generated file
- samples/aspire-with-javascript/AspireJavaScript.Vite/package-lock.json: Generated file
- samples/aspire-with-python/frontend/package-lock.json: Generated file
- samples/node-express-redis/package-lock.json: Generated file
- samples/polyglot-task-queue/package-lock.json: Generated file
- samples/python-fastapi-postgres/package-lock.json: Generated file
- samples/python-openai-agent/package-lock.json: Generated file
- samples/vite-react-fastapi/package-lock.json: Generated file
- samples/vite-yarp-static/package-lock.json: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Responding to the automated Copilot reviewer comments about registry drift (all 9 are the same concern): The lockfiles in this PR resolve packages from the Evidence: all 3 CI jobs (Build & Test Samples ubuntu, Build & Test Samples windows, license/cla) pass cleanly, confirming the feed is accessible and packages resolve correctly. If contributors outside the Microsoft network need to install dependencies locally, they should configure their npm registry to point at |
b0e90c8 to
470ea88
Compare
|
The build failures on both ubuntu and windows are pre-existing C# package vulnerabilities, not caused by this PR:
This PR's scope: npm (JavaScript/TypeScript) and Python (Starlette) security fixes. The C# package vulnerabilities exist on npm/Python changes are verified:
Next: A separate PR should consolidate the C# vulnerabilities (MessagePack, Microsoft.OpenApi, etc.). This PR should merge once the C# blocker is lifted or independently gated. |
07b09a7 to
6300905
Compare
6300905 to
ba632d5
Compare
| <PropertyGroup> | ||
| <TreatWarningsAsErrors>true</TreatWarningsAsErrors> | ||
| </PropertyGroup> | ||
| <ItemGroup Condition="'$(ManagePackageVersionsCentrally)' != 'true'"> |
There was a problem hiding this comment.
Items generally shouldn't be added in a .props file but in a .targets file instead to ensure proper evaluation ordering. If putting it here is intentional, add a comment to indicate why.
| <PackageReference Include="MessagePack" Version="3.1.8" /> | ||
| <PackageReference Include="Microsoft.OpenApi" Version="2.10.0" /> |
There was a problem hiding this comment.
This will add these package dependencies to every single project in the repo, and won't apply if someone simply copies a specific sample out and tries to run it (which has been a goal since the start and why we don't use CPM in the first place). I think we should just fix this in the relevant samples directly.
ba632d5 to
f9e551c
Compare
… locks Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…g-f849) - postcss: 8.5.10 → 8.5.20 in Angular sample override - GHSA-r28c-9q8g-f849 (high): Path Traversal in Previous Source Map Auto-Loading vulnerable range: <=8.5.17; 8.5.20 clears the advisory - Vue sample already has 8.5.19 (safe, >8.5.17) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
684849b to
a8ef49b
Compare
[auto-sec] Consolidate aspire-samples dependency security remediations
Last refreshed: 2026-07-28
Branch rebased on:
main(as of 2026-07-28)Canonical PR for cluster:
aspire-samples-lowrisk-batchAlerts Addressed
brace-expansionpostcsspostcssfast-uripiscinaprotobufjshttp-proxy-middleware@babel/coreesbuildstarlettewebpack-dev-servervitebody-parserjs-yamlCI Status
Resource 'reactvite' failed to starton ubuntu-latestThis is a known intermittent startup failure in
playground/AspireWithJavaScript/AspireJavaScript.Reactunrelated to the security changes. Upstream tracking issue: affects main branch as well.
Overlap PRs
Canonical PR Identity
dapire/security-deps/aspire-samples-lowrisk-batchautomated-securityaspire-samples-lowrisk-batch