Bump JS deps to address remaining Dependabot alerts (webpack-dev-server + NodeFrontend qs)#17502
Merged
Merged
Conversation
Closes the four Dependabot alerts not covered by the grouped Dependabot PR #17414 by bumping the affected JavaScript lockfile-based manifests: | File | Package | Bumped to | Severity | GHSA | Alert | | --- | --- | --- | --- | --- | --- | | `playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json` | `webpack-dev-server` | `5.2.4` | medium | GHSA-79cf-xcqc-c78w | #1152 | | `playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json` | `webpack-dev-server` | `5.2.4` | medium | GHSA-79cf-xcqc-c78w | #1153 | | `playground/AspireWithNode/NodeFrontend/package-lock.json` | `qs` | `6.15.2` | medium | CVE-2026-8723 | #1167 | | `playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml` | `qs` | `6.15.2` | medium | CVE-2026-8723 | #1168 | Sibling to #17414 (Dependabot grouped) which covers the other 26 open alerts (ws, fast-uri, @nevware21/ts-utils, qs across most directories, @babel/plugin-transform-modules-systemjs, next). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 17502Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 17502" |
This was referenced May 26, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates JavaScript dependency manifests in Aspire playground projects to remediate remaining Dependabot security alerts by bumping webpack-dev-server and qs via direct version changes and/or package-manager overrides.
Changes:
- Bump
webpack-dev-serverto5.2.4in the Angular and React JS playgrounds (direct bump in React; override in Angular). - Force
qsto6.15.2in the NodeFrontend sample via both npm and pnpm overrides and regenerated lockfiles. - Regenerate affected lockfiles (
package-lock.json,pnpm-lock.yaml) to reflect updated dependency graphs.
Reviewed changes
Copilot reviewed 3 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml | Updates pnpm lock to resolve qs at 6.15.2 and record override. |
| playground/AspireWithNode/NodeFrontend/package.json | Adds npm + pnpm overrides to pin qs to ^6.15.2. |
| playground/AspireWithNode/NodeFrontend/package-lock.json | Updates npm lockfile to resolve qs at 6.15.2 and sync dependency metadata. |
| playground/AspireWithJavaScript/AspireJavaScript.React/package.json | Bumps webpack-dev-server devDependency to ^5.2.4. |
| playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json | Regenerates lockfile for the webpack-dev-server 5.2.4 dependency graph. |
| playground/AspireWithJavaScript/AspireJavaScript.Angular/package.json | Adds an override to force webpack-dev-server to ^5.2.4. |
| playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json | Updates lockfile to resolve webpack-dev-server at 5.2.4. |
Files not reviewed (4)
- playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json: Language not supported
- playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json: Language not supported
- playground/AspireWithNode/NodeFrontend/package-lock.json: Language not supported
- playground/AspireWithNode/NodeFrontend/pnpm-lock.yaml: Language not supported
Comment on lines
3172
to
+3175
| "node_modules/qs": { | ||
| "version": "6.15.1", | ||
| "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz", | ||
| "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==", | ||
| "version": "6.15.2", | ||
| "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz", | ||
| "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==", |
Comment on lines
14381
to
+14384
| "node_modules/webpack-dev-server": { | ||
| "version": "5.2.3", | ||
| "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.3.tgz", | ||
| "integrity": "sha512-9Gyu2F7+bg4Vv+pjbovuYDhHX+mqdqITykfzdM9UyKqKHlsE5aAjRhR+oOEfXW5vBeu8tarzlJFIZva4ZjAdrQ==", | ||
| "version": "5.2.4", | ||
| "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.4.tgz", | ||
| "integrity": "sha512-GqDPGZN9bRqKBTkp4aWkobDDHMsrXKoGSdOH56smIri8qR0JG8gfL8/v/f/OZR3/OKXjG8uwJbFVhKm/FNU/UA==", |
Comment on lines
6770
to
+6773
| "node_modules/webpack-dev-server": { | ||
| "version": "5.2.2", | ||
| "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.2.tgz", | ||
| "integrity": "sha512-QcQ72gh8a+7JO63TAx/6XZf/CWhgMzu5m0QirvPfGvptOusAxG12w2+aua1Jkjr7hzaWDnJ2n6JFeexMHI+Zjg==", | ||
| "version": "5.2.4", | ||
| "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.4.tgz", | ||
| "integrity": "sha512-GqDPGZN9bRqKBTkp4aWkobDDHMsrXKoGSdOH56smIri8qR0JG8gfL8/v/f/OZR3/OKXjG8uwJbFVhKm/FNU/UA==", |
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
radical
approved these changes
May 27, 2026
Contributor
|
❓ CLI E2E Tests unknown — 107 passed, 0 failed, 2 unknown (commit View all recordings
📹 Recordings uploaded automatically from CI run #26457514764 |
Member
Author
|
Drive-by validation comment - GitHub won't let me approve my own PR:
Ready for a maintainer review/merge. |
Contributor
|
✅ No documentation update needed. docs_required → signals are false positives for a playground-only JS dependency bump; allowlist: Triggered signals (2):
All 7 changed files are under |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bump JS deps to address remaining Dependabot alerts
Summary
Closes the four Dependabot alerts not covered by the grouped Dependabot PR #17414 by bumping the affected JavaScript lockfile-based manifests. Together with #17414 this brings the open Dependabot alert count on the repo to zero.
Alerts addressed
playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.jsonwebpack-dev-server<= 5.2.35.2.4playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.jsonwebpack-dev-server<= 5.2.35.2.4playground/AspireWithNode/NodeFrontend/package-lock.jsonqs< 6.15.26.15.2playground/AspireWithNode/NodeFrontend/pnpm-lock.yamlqs< 6.15.26.15.2How each manifest was updated
playground/AspireWithJavaScript/AspireJavaScript.React-webpack-dev-serveris a directdevDependency. Range bumped from^5.2.2to^5.2.4inpackage.json, thenpackage-lock.jsonregenerated withnpm install --package-lock-only --legacy-peer-deps. The diff is larger here becausewebpack-dev-server 5.2.4swapped its TLS cert generator fromnode-forgeto@peculiar/x509upstream; the new@peculiar/asn1-*andpkijspackages are all dev-only and only loaded when runningnpm startagainst the playground.playground/AspireWithJavaScript/AspireJavaScript.Angular-webpack-dev-serveris a transitive (via@angular-devkit/build-angular). Added an entry to the existingoverridesblock ("webpack-dev-server": "^5.2.4"), then regeneratedpackage-lock.json.playground/AspireWithNode/NodeFrontend-qsis transitive (viaexpress). Added aqs: ^6.15.2entry to both theoverrides(npm) andpnpm.overridesblocks, then regenerated bothpackage-lock.json(npm install --package-lock-only) andpnpm-lock.yaml(pnpm install --lockfile-only). The npm lockfile diff also picks up some pre-existing drift betweenpackage.jsonandpackage-lock.json(a few top-leveldependenciesentries that were missing from the lockfile and a fewpeer: truemarkers that no longer apply) - regenerating from a clean state syncs them.Validation
For each updated manifest, regeneration succeeds against the configured
dotnet-public-npmmirror, and every vulnerable version is gone from the resolved tree:Risk notes for reviewers
AGENTS.mdrule: "Never changepackage.jsonorpackage-lock.jsonfiles unless explicitly asked to." This change is a security-alert sweep, which is the documented exception.webpack-dev-server 5.2.2/5.2.3 -> 5.2.4is a patch bump with no public API changes.qs 6.15.1 -> 6.15.2is a patch bump with no public API changes.Related
ws,fast-uri,@nevware21/ts-utils,qsacross the other directories,@babel/plugin-transform-modules-systemjs, andnext.extension/package-lock.jsonremoval in Use Yarn-only restore for VS Code extension #17474); the alerts that PR was tracking are now split between Bump the npm_and_yarn group across 10 directories with 6 updates #17414 and this PR.