[auto-sec] Consolidate aspire.dev frontend dependency security remediations by IEvangelist · Pull Request #1392 · microsoft/aspire.dev

IEvangelist · 2026-07-22T11:06:26Z

Auto-sec refresh

Cluster: $(System.Collections.Hashtable.cluster)
Last refresh: 2026-07-23 06:04:33 -05:00
Canonical branch: $(@{body=## Summary
Canonical low-risk frontend security dependency consolidation for src/frontend, rebased from latest main.

Alerts targeted

GHSA-8mv7-9c27-98vc (astro)
GHSA-f48w-9m4c-m7f5 (astro)
GHSA-8j5q-mfj2-5q9q (@astrojs/rss)
GHSA-7pw4-f3q4-r2p2 (astro)
GHSA-4g3v-8h47-v7g6 (astro)
GHSA-3jxr-9vmj-r5cp (brace-expansion)

Verification status

CI failure is currently code-related:
- frontend-build / Frontend Build fails with astro-expressive-code config error: Cannot read properties of undefined (reading 'Cjs').
Local package install/build could not be completed in this environment because of transient TLS handshake failures to npm registry.

Consolidation

Intended canonical replacement for overlapping frontend dependency PRs deps: consolidated frontend security updates (tracked by #1392) #1385, build(deps): bump astro from 7.0.3 to 7.1.0 in /src/frontend #1384, and build(deps): bump @astrojs/rss from 4.0.18 to 4.0.19 in /src/frontend #1383.
These overlapping PRs are intentionally left open until this canonical PR is green.
; headRefName=dapire/security-deps/aspire-dev-lowrisk-batch; statusCheckRollup=System.Object[]; title=[auto-sec] Consolidate aspire.dev frontend dependency security remediations; url=https://github.com/microsoft/aspire.dev/pull/1392}.headRefName)
Alerts addressed scope: open dependency/security concern cluster for this repo (active batch)

Open alerts snapshot (repo)

high: 1
low: 1
medium: 4

Package families in this cluster snapshot

npm:astro x4
npm:@astrojs/rss x1
npm:brace-expansion x1

Versions changed

Consolidated patch/minor dependency updates in this PR branch (see PR diff/lockfile deltas for exact resolved versions).

Verification status

CI: green/pending

Superseded / tracked overlaps

deps: consolidated frontend security updates (tracked by #1392) #1385 (tracked-open)
build(deps): bump astro from 7.0.3 to 7.1.0 in /src/frontend #1384 (tracked-open)
build(deps): bump @astrojs/rss from 4.0.18 to 4.0.19 in /src/frontend #1383 (tracked-open)

Closure gate

Overlap PRs remain open until canonical is mergeable + conflict-free + CI green.

Summary

Canonical low-risk frontend security dependency consolidation for src/frontend, rebased from latest main.

Alerts targeted

GHSA-8mv7-9c27-98vc (astro)
GHSA-f48w-9m4c-m7f5 (astro)
GHSA-8j5q-mfj2-5q9q (@astrojs/rss)
GHSA-7pw4-f3q4-r2p2 (astro)
GHSA-4g3v-8h47-v7g6 (astro)
GHSA-3jxr-9vmj-r5cp (brace-expansion)

Verification status

CI failure is currently code-related:
- frontend-build / Frontend Build fails with astro-expressive-code config error: Cannot read properties of undefined (reading 'Cjs').
Local package install/build could not be completed in this environment because of transient TLS handshake failures to npm registry.

Consolidation

Intended canonical replacement for overlapping frontend dependency PRs deps: consolidated frontend security updates (tracked by #1392) #1385, build(deps): bump astro from 7.0.3 to 7.1.0 in /src/frontend #1384, and build(deps): bump @astrojs/rss from 4.0.18 to 4.0.19 in /src/frontend #1383.
These overlapping PRs are intentionally left open until this canonical PR is green.

Copilot

Pull request overview

Consolidates frontend dependency security remediations for the src/frontend Astro site by updating a batch of direct dependencies/devDependencies to newer patched versions.

Changes:

Bumps multiple Astro/Starlight-related runtime dependencies (e.g., astro, @astrojs/rss, @astrojs/starlight, sharp).
Updates several frontend tooling/dev dependencies (e.g., eslint, prettier, tsx, typescript, typescript-eslint, unocss).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    "tsx": "^4.23.1",
+    "typescript": "^7.0.2",
+    "typescript-eslint": "^8.65.0",


Bumps the npm-all group with 32 updates in the /src/frontend directory: | Package | From | To | | --- | --- | --- | | [@astrojs/markdown-remark](https://github.com/withastro/astro/tree/HEAD/packages/markdown/remark) | `7.2.0` | `7.2.1` | | [@astrojs/mdx](https://github.com/withastro/astro/tree/HEAD/packages/integrations/mdx) | `7.0.0` | `7.0.3` | | [@astrojs/rss](https://github.com/withastro/astro/tree/HEAD/packages/astro-rss) | `4.0.18` | `4.0.19` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.1` | `0.41.3` | | [@catppuccin/starlight](https://github.com/catppuccin/starlight/tree/HEAD/packages/catppuccin-starlight) | `2.0.1` | `2.1.0` | | [@expressive-code/plugin-collapsible-sections](https://github.com/expressive-code/expressive-code/tree/HEAD/packages/@expressive-code/plugin-collapsible-sections) | `0.44.0` | `0.44.1` | | [@expressive-code/plugin-line-numbers](https://github.com/expressive-code/expressive-code/tree/HEAD/packages/@expressive-code/plugin-line-numbers) | `0.44.0` | `0.44.1` | | [@fontsource-variable/fira-code](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/fira-code) | `5.2.7` | `5.3.0` | | [@fontsource-variable/outfit](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/outfit) | `5.2.8` | `5.3.0` | | [@fontsource-variable/rubik](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/rubik) | `5.2.8` | `5.3.0` | | [@fontsource/poppins](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/poppins) | `5.2.7` | `5.3.0` | | [asciinema-player](https://github.com/asciinema/asciinema-player) | `3.16.0` | `3.17.0` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.0.3` | `7.1.3` | | [astro-expressive-code](https://github.com/expressive-code/expressive-code/tree/HEAD/packages/astro-expressive-code) | `0.44.0` | `0.44.1` | | [satori](https://github.com/vercel/satori) | `0.26.0` | `0.28.1` | | [satteri](https://github.com/bruits/satteri) | `0.9.4` | `0.9.5` | | [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.3` | | [starlight-github-alerts](https://github.com/HiDeoo/starlight-github-alerts/tree/HEAD/packages/starlight-github-alerts) | `0.3.0` | `0.4.0` | | [starlight-links-validator](https://github.com/HiDeoo/starlight-links-validator/tree/HEAD/packages/starlight-links-validator) | `0.25.1` | `0.25.2` | | [starlight-llms-txt](https://github.com/delucis/starlight-llms-txt/tree/HEAD/packages/starlight-llms-txt) | `0.10.0` | `0.11.0` | | [starlight-page-actions](https://github.com/dlcastillop/starlight-page-actions/tree/HEAD/packages/starlight-page-actions) | `0.6.2` | `0.7.0` | | [@iconify-json/material-icon-theme](https://github.com/iconify/icon-sets) | `1.2.68` | `1.2.69` | | [@types/hast](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/hast) | `3.0.4` | `3.0.5` | | [@unocss/astro](https://github.com/unocss/unocss/tree/HEAD/packages-integrations/astro) | `66.6.8` | `66.7.5` | | [astro-embed](https://github.com/delucis/astro-embed/tree/HEAD/packages/astro-embed) | `0.13.0` | `0.13.1` | | [eslint](https://github.com/eslint/eslint) | `10.6.0` | `10.7.0` | | [prettier](https://github.com/prettier/prettier) | `3.9.1` | `3.9.5` | | [tsx](https://github.com/privatenumber/tsx) | `4.22.4` | `4.23.1` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.62.0` | `8.65.0` | | [unocss](https://github.com/unocss/unocss/tree/HEAD/packages-presets/unocss) | `66.6.8` | `66.7.5` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.9` | `4.1.10` | Updates `@astrojs/markdown-remark` from 7.2.0 to 7.2.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/markdown/remark/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/markdown-remark@7.2.1/packages/markdown/remark) Updates `@astrojs/mdx` from 7.0.0 to 7.0.3 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/mdx/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/mdx@7.0.3/packages/integrations/mdx) Updates `@astrojs/rss` from 4.0.18 to 4.0.19 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro-rss/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/rss@4.0.19/packages/astro-rss) Updates `@astrojs/starlight` from 0.41.1 to 0.41.3 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.3/packages/starlight) Updates `@catppuccin/starlight` from 2.0.1 to 2.1.0 - [Release notes](https://github.com/catppuccin/starlight/releases) - [Changelog](https://github.com/catppuccin/starlight/blob/main/packages/catppuccin-starlight/CHANGELOG.md) - [Commits](https://github.com/catppuccin/starlight/commits/v2.1.0/packages/catppuccin-starlight) Updates `@expressive-code/plugin-collapsible-sections` from 0.44.0 to 0.44.1 - [Release notes](https://github.com/expressive-code/expressive-code/releases) - [Changelog](https://github.com/expressive-code/expressive-code/blob/main/packages/@expressive-code/plugin-collapsible-sections/CHANGELOG.md) - [Commits](https://github.com/expressive-code/expressive-code/commits/@expressive-code/plugin-collapsible-sections@0.44.1/packages/@expressive-code/plugin-collapsible-sections) Updates `@expressive-code/plugin-line-numbers` from 0.44.0 to 0.44.1 - [Release notes](https://github.com/expressive-code/expressive-code/releases) - [Changelog](https://github.com/expressive-code/expressive-code/blob/main/packages/@expressive-code/plugin-line-numbers/CHANGELOG.md) - [Commits](https://github.com/expressive-code/expressive-code/commits/@expressive-code/plugin-line-numbers@0.44.1/packages/@expressive-code/plugin-line-numbers) Updates `@fontsource-variable/fira-code` from 5.2.7 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/fira-code) Updates `@fontsource-variable/outfit` from 5.2.8 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/outfit) Updates `@fontsource-variable/rubik` from 5.2.8 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/rubik) Updates `@fontsource/poppins` from 5.2.7 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/poppins) Updates `asciinema-player` from 3.16.0 to 3.17.0 - [Release notes](https://github.com/asciinema/asciinema-player/releases) - [Commits](asciinema/asciinema-player@v3.16.0...v3.17.0) Updates `astro` from 7.0.3 to 7.1.3 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.1.3/packages/astro) Updates `astro-expressive-code` from 0.44.0 to 0.44.1 - [Release notes](https://github.com/expressive-code/expressive-code/releases) - [Changelog](https://github.com/expressive-code/expressive-code/blob/main/packages/astro-expressive-code/CHANGELOG.md) - [Commits](https://github.com/expressive-code/expressive-code/commits/astro-expressive-code@0.44.1/packages/astro-expressive-code) Updates `satori` from 0.26.0 to 0.28.1 - [Release notes](https://github.com/vercel/satori/releases) - [Commits](vercel/satori@0.26.0...0.28.1) Updates `satteri` from 0.9.4 to 0.9.5 - [Release notes](https://github.com/bruits/satteri/releases) - [Commits](bruits/satteri@satteri-v0.9.4...satteri-v0.9.5) Updates `sharp` from 0.34.5 to 0.35.3 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.5...v0.35.3) Updates `starlight-github-alerts` from 0.3.0 to 0.4.0 - [Release notes](https://github.com/HiDeoo/starlight-github-alerts/releases) - [Changelog](https://github.com/HiDeoo/starlight-github-alerts/blob/main/packages/starlight-github-alerts/CHANGELOG.md) - [Commits](https://github.com/HiDeoo/starlight-github-alerts/commits/starlight-github-alerts@0.4.0/packages/starlight-github-alerts) Updates `starlight-links-validator` from 0.25.1 to 0.25.2 - [Release notes](https://github.com/HiDeoo/starlight-links-validator/releases) - [Changelog](https://github.com/HiDeoo/starlight-links-validator/blob/main/packages/starlight-links-validator/CHANGELOG.md) - [Commits](https://github.com/HiDeoo/starlight-links-validator/commits/starlight-links-validator@0.25.2/packages/starlight-links-validator) Updates `starlight-llms-txt` from 0.10.0 to 0.11.0 - [Release notes](https://github.com/delucis/starlight-llms-txt/releases) - [Changelog](https://github.com/delucis/starlight-llms-txt/blob/main/packages/starlight-llms-txt/CHANGELOG.md) - [Commits](https://github.com/delucis/starlight-llms-txt/commits/starlight-llms-txt@0.11.0/packages/starlight-llms-txt) Updates `starlight-page-actions` from 0.6.2 to 0.7.0 - [Release notes](https://github.com/dlcastillop/starlight-page-actions/releases) - [Commits](https://github.com/dlcastillop/starlight-page-actions/commits/v0.7.0/packages/starlight-page-actions) Updates `@iconify-json/material-icon-theme` from 1.2.68 to 1.2.69 - [Commits](https://github.com/iconify/icon-sets/commits) Updates `@types/hast` from 3.0.4 to 3.0.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/hast) Updates `@unocss/astro` from 66.6.8 to 66.7.5 - [Release notes](https://github.com/unocss/unocss/releases) - [Commits](https://github.com/unocss/unocss/commits/v66.7.5/packages-integrations/astro) Updates `astro-embed` from 0.13.0 to 0.13.1 - [Release notes](https://github.com/delucis/astro-embed/releases) - [Changelog](https://github.com/delucis/astro-embed/blob/main/packages/astro-embed/CHANGELOG.md) - [Commits](https://github.com/delucis/astro-embed/commits/astro-embed@0.13.1/packages/astro-embed) Updates `eslint` from 10.6.0 to 10.7.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.6.0...v10.7.0) Updates `prettier` from 3.9.1 to 3.9.5 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.1...3.9.5) Updates `tsx` from 4.22.4 to 4.23.1 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.22.4...v4.23.1) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) Updates `typescript-eslint` from 8.62.0 to 8.65.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint) Updates `unocss` from 66.6.8 to 66.7.5 - [Release notes](https://github.com/unocss/unocss/releases) - [Commits](https://github.com/unocss/unocss/commits/v66.7.5/packages-presets/unocss) Updates `vitest` from 4.1.9 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) --- updated-dependencies: - dependency-name: "@astrojs/markdown-remark" dependency-version: 7.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@astrojs/mdx" dependency-version: 7.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@astrojs/rss" dependency-version: 4.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@astrojs/starlight" dependency-version: 0.41.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@catppuccin/starlight" dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: "@expressive-code/plugin-collapsible-sections" dependency-version: 0.44.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@expressive-code/plugin-line-numbers" dependency-version: 0.44.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@fontsource-variable/fira-code" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: "@fontsource-variable/outfit" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: "@fontsource-variable/rubik" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: "@fontsource/poppins" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: asciinema-player dependency-version: 3.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: astro dependency-version: 7.1.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: astro-expressive-code dependency-version: 0.44.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: satori dependency-version: 0.28.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: satteri dependency-version: 0.9.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: sharp dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: starlight-github-alerts dependency-version: 0.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: starlight-links-validator dependency-version: 0.25.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: starlight-llms-txt dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: starlight-page-actions dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: "@iconify-json/material-icon-theme" dependency-version: 1.2.69 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@types/hast" dependency-version: 3.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@unocss/astro" dependency-version: 66.7.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: astro-embed dependency-version: 0.13.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: eslint dependency-version: 10.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: prettier dependency-version: 3.9.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: tsx dependency-version: 4.23.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-all - dependency-name: typescript-eslint dependency-version: 8.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: unocss dependency-version: 66.7.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-all ... Signed-off-by: dependabot[bot] <support@github.com>

JamesNK

Review summary

PR ref: 974bcd939b616114f53321943923b91b72d05435 against main (0df9b83ee31925baf6ab98f8e07579020be8bba7)

This is a dependency-only PR (package.json and pnpm-lock.yaml), so it contains no Aspire documentation claims and affects no documentation routes. The dependency review found one blocking compatibility regression, already captured in the existing inline thread: typescript-eslint@8.65.0 declares TypeScript >=4.8.4 <6.1.0, but this PR upgrades TypeScript to ^7.0.2. The current Frontend Build failure confirms the incompatibility while loading @typescript-eslint/typescript-estree (Cannot read properties of undefined (reading 'Cjs')). Please keep TypeScript within the supported range or update the linting stack to a release that supports TypeScript 7.

Phase A — Claim verification

No documentation claims were found in the two changed files; no microsoft/aspire, CommunityToolkit/Aspire, or Azure/azure-sdk-for-net source checkout was applicable.

Total claims: 0
Verified: 0
Verified with nuance: 0
Unverifiable: 0
Contradicted: 0

Phase B — Documentation test report

Focus Area: None — dependency manifests only
PR ref served: Not served; there are no changed documentation pages or routes to exercise, and no website build was run.

Category	Passed	Failed	Warnings
Content Accuracy	0	0	0
Code Examples	0	0	0
CLI Commands	0	0	0
Links	0	0	0

Critical issues: None in documentation scope.
Warnings: None in documentation scope.
Passed checks: Scope inspection confirmed that no documentation content or routes changed.
Recommendations: None for documentation.

Copilot AI review requested due to automatic review settings July 22, 2026 11:06

IEvangelist added the automated-security Automated security dependency management PRs label Jul 22, 2026

Copilot started reviewing on behalf of IEvangelist July 22, 2026 11:06 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread src/frontend/package.json

Comment on lines +125 to +127

"tsx": "^4.23.1",

"typescript": "^7.0.2",

"typescript-eslint": "^8.65.0",

IEvangelist mentioned this pull request Jul 22, 2026

deps: consolidated frontend security updates (tracked by #1392) #1385

Open

IEvangelist force-pushed the dapire/security-deps/aspire-dev-lowrisk-batch branch from 6a5a71d to 974bcd9 Compare July 23, 2026 11:03

This was referenced Jul 23, 2026

build(deps): bump astro from 7.0.3 to 7.1.0 in /src/frontend #1384

Open

build(deps): bump @astrojs/rss from 4.0.18 to 4.0.19 in /src/frontend #1383

Open

JamesNK requested changes Jul 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[auto-sec] Consolidate aspire.dev frontend dependency security remediations#1392

[auto-sec] Consolidate aspire.dev frontend dependency security remediations#1392
IEvangelist wants to merge 1 commit into
mainfrom
dapire/security-deps/aspire-dev-lowrisk-batch

IEvangelist commented Jul 22, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

JamesNK left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

IEvangelist commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Auto-sec refresh

Alerts targeted

Verification status

Consolidation

Open alerts snapshot (repo)

Package families in this cluster snapshot

Versions changed

Verification status

Superseded / tracked overlaps

Closure gate

Summary

Alerts targeted

Verification status

Consolidation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

JamesNK left a comment

Choose a reason for hiding this comment

Review summary

Phase A — Claim verification

Phase B — Documentation test report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

IEvangelist commented Jul 22, 2026 •

edited

Loading