Update npm dependencies across playground, tests, templates, and extension#15939
Open
Update npm dependencies across playground, tests, templates, and extension#15939
Conversation
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 15939Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 15939" |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates JavaScript/TypeScript npm dependencies (and regenerated lockfiles) across playground apps, test fixtures, CLI templates, and the VS Code extension to pick up newer compatible package versions and security fixes.
Changes:
- Bumped common transitive dependencies (notably
picomatchandbrace-expansion) across many test/playgroundpackage-lock.jsonfiles. - Updated framework/tooling versions in fixtures/templates (e.g., Next.js test fixture; Vite/tooling in templates).
- Added extension
overrides/resolutionsto force newer transitivepostcss/diffversions and regenerated the extension lockfiles.
Reviewed changes
Copilot reviewed 3 out of 73 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/PolyglotAppHosts/Aspire.Hosting/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Yarp/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Valkey/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.SqlServer/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Seq/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Redis/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.RabbitMQ/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Qdrant/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Python/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.PostgreSQL/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Orleans/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Oracle/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.OpenAI/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Nats/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.MySql/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.MongoDB/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Milvus/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Maui/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Kubernetes/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Keycloak/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Kafka/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.JavaScript/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.GitHub.Models/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Garnet/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Foundry/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Docker/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.DevTunnels/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.WebPubSub/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.Storage/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.Sql/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.SignalR/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.ServiceBus/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.Search/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.Redis/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.PostgreSQL/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.OperationalInsights/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.Kusto/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.KeyVault/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.Functions/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.EventHubs/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.CosmosDB/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.ContainerRegistry/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.CognitiveServices/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.AppService/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.ApplicationInsights/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.AppContainers/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/PolyglotAppHosts/Aspire.Hosting.Azure.AppConfiguration/TypeScript/package-lock.json | Bumps brace-expansion and picomatch versions in test lockfile. |
| tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package-lock.json | Updates vite and picomatch in the TypeScript JS test lockfile. |
| tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package.json | Bumps next fixture dependency version. |
| tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json | Regenerates lockfile for Next.js fixture with updated Next/SWC artifacts. |
| src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json | Updates template lockfile dependencies (incl. Vite toolchain). |
| playground/TypeScriptApps/RpsArena/package-lock.json | Bumps brace-expansion and picomatch versions in playground lockfile. |
| playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json | Updates vite and picomatch in arena frontend lockfile. |
| playground/TypeScriptApps/AzureFunctionsSample/AppHost/package-lock.json | Bumps brace-expansion and picomatch versions in playground lockfile. |
| playground/PythonAppHost/frontend/package-lock.json | Updates frontend lockfile transitive toolchain packages. |
| playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json | Regenerates lockfile and records root engines.node metadata. |
| playground/PostgresEndToEnd/PostgresEndToEnd.JavaService/src/package-lock.json | Normalizes minimal lockfile packages entry. |
| playground/PostgresEndToEnd/PostgresEndToEnd.JavaService/package-lock.json | Normalizes minimal lockfile packages entry. |
| playground/JavaAppHost/frontend/package-lock.json | Updates frontend lockfile transitive toolchain packages. |
| playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json | Updates Vite toolchain-related lockfile dependencies. |
| playground/AspireWithJavaScript/AspireJavaScript.Angular/package.json | Adds npm overrides for Vite. |
| playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json | Regenerates Angular lockfile reflecting updated transitive deps. |
| extension/package.json | Adds postcss/diff to overrides + resolutions for the extension. |
| extension/package-lock.json | Regenerates extension lockfile reflecting overrides/resolutions and dependency updates. |
Files not reviewed (69)
- extension/package-lock.json: Language not supported
- playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json: Language not supported
- playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json: Language not supported
- playground/AspireWithJavaScript/AspireJavaScript.Vue/package-lock.json: Language not supported
- playground/AspireWithNode/NodeFrontend/package-lock.json: Language not supported
- playground/FoundryAgentEnterprise/frontend/package-lock.json: Language not supported
- playground/JavaAppHost/frontend/package-lock.json: Language not supported
- playground/PostgresEndToEnd/PostgresEndToEnd.JavaService/package-lock.json: Language not supported
- playground/PostgresEndToEnd/PostgresEndToEnd.JavaService/src/package-lock.json: Language not supported
- playground/PostgresEndToEnd/PostgresEndToEnd.NodeService/package-lock.json: Language not supported
- playground/PythonAppHost/frontend/package-lock.json: Language not supported
- playground/TypeScriptAppHost/vite-frontend/package-lock.json: Language not supported
- playground/TypeScriptApps/AzureFunctionsSample/AppHost/package-lock.json: Language not supported
- playground/TypeScriptApps/RpsArena/arena-frontend/package-lock.json: Language not supported
- playground/TypeScriptApps/RpsArena/package-lock.json: Language not supported
- src/Aspire.Cli/Templating/Templates/java-starter/frontend/package-lock.json: Language not supported
- src/Aspire.Cli/Templating/Templates/py-starter/frontend/package-lock.json: Language not supported
- src/Aspire.Cli/Templating/Templates/ts-starter/frontend/package-lock.json: Language not supported
- src/Aspire.ProjectTemplates/templates/aspire-ts-cs-starter/frontend/package-lock.json: Language not supported
- tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json: Language not supported
- tests/Aspire.Hosting.CodeGeneration.TypeScript.JsTests/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.AppConfiguration/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.AppContainers/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.AppService/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.ApplicationInsights/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.CognitiveServices/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.ContainerRegistry/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.CosmosDB/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.EventHubs/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.Functions/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.KeyVault/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.Kusto/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.OperationalInsights/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.PostgreSQL/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.Redis/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.Search/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.ServiceBus/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.SignalR/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.Sql/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.Storage/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure.WebPubSub/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Azure/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.DevTunnels/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Docker/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Foundry/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Garnet/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.GitHub.Models/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.JavaScript/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Kafka/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Keycloak/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Kubernetes/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Maui/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Milvus/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.MongoDB/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.MySql/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Nats/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.OpenAI/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Oracle/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Orleans/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.PostgreSQL/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Python/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Qdrant/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.RabbitMQ/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Redis/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Seq/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.SqlServer/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Valkey/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting.Yarp/TypeScript/package-lock.json: Language not supported
- tests/PolyglotAppHosts/Aspire.Hosting/TypeScript/package-lock.json: Language not supported
extension/package-lock.json
Outdated
| "version": "2.0.1", | ||
| "resolved": "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/@gulp-sourcemaps/identity-map/-/identity-map-2.0.1.tgz", | ||
| "integrity": "sha1-puixq+yPeQ7GviuMUA5uaAN8ABk=", | ||
| "resolved": "https://registry.npmjs.org/@gulp-sourcemaps/identity-map/-/identity-map-2.0.1.tgz", |
There was a problem hiding this comment.
Several entries in this lockfile now resolve to https://registry.npmjs.org/ (e.g., @gulp-sourcemaps/identity-map here) even though extension/.npmrc pins the registry to the dotnet-public-npm Azure Artifacts feed. Since npm uses the lockfile's "resolved" URLs during npm ci, this can bypass the intended feed (and may fail in CI if outbound npmjs.org is restricted). Please regenerate extension/package-lock.json using the configured registry so resolved URLs consistently point at the Azure Artifacts feed (or update the repo config if switching registries intentionally).
Suggested change
| "resolved": "https://registry.npmjs.org/@gulp-sourcemaps/identity-map/-/identity-map-2.0.1.tgz", | |
| "resolved": "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/@gulp-sourcemaps/identity-map/-/identity-map-2.0.1.tgz", |
extension/package.json
Outdated
Comment on lines
+886
to
+891
| "path-to-regexp": "8.4.2", | ||
| "@sinonjs/fake-timers": "13.0.5", | ||
| "picomatch": "2.3.2", | ||
| "underscore": "1.13.8" | ||
| "underscore": "1.13.8", | ||
| "postcss": "8.5.8", | ||
| "diff": "8.0.3" |
There was a problem hiding this comment.
The new postcss/diff overrides/resolutions force versions that don’t satisfy some dependent package ranges (e.g., @gulp-sourcemaps/identity-map depends on postcss ^7.0.16 and ts-node depends on diff ^4.0.1 in the generated lockfile). Even if this addresses CVEs, it increases the risk of runtime/build breakage because it bypasses semver constraints. Consider scoping these overrides to the specific vulnerable dependency paths or upgrading the dependent packages to versions that accept the newer majors, instead of forcing a global major bump.
Comment on lines
2299
to
2303
| "node_modules/vite": { | ||
| "version": "8.0.0", | ||
| "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.0.tgz", | ||
| "integrity": "sha512-fPGaRNj9Zytaf8LEiBhY7Z6ijnFKdzU/+mL8EFBaKr7Vw1/FWcTBAMW0wLPJAGMPX38ZPVCVgLceWiEqeoqL2Q==", | ||
| "version": "8.0.7", | ||
| "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.7.tgz", | ||
| "integrity": "sha512-P1PbweD+2/udplnThz3btF4cf6AgPky7kk23RtHUkJIU5BIxwPprhRGmOAHs6FTI7UiGbTNrgNP6jSYD6JaRnw==", | ||
| "dev": true, |
There was a problem hiding this comment.
PR description says Vite was updated to 7.3.2 across CLI templates/project templates, but this template’s lockfile is updating Vite to 8.0.7 (and its package.json declares vite ^8.0.0). Please either adjust the PR description to reflect the mixed Vite major versions, or align this template to the intended Vite major version if 7.3.2 was the target.
| "run-script-os": "^1.1.6" | ||
| }, | ||
| "overrides": { | ||
| "vite": "^7.3.2" |
There was a problem hiding this comment.
The new npm override uses a caret range ("vite": "^7.3.2"). If the goal is to unblock Angular’s transitive pin while keeping the repo on a specific validated Vite version, consider pinning this override to an exact version (e.g., 7.3.2) to avoid future lockfile drift when the dependency graph is regenerated.
Suggested change
| "vite": "^7.3.2" | |
| "vite": "7.3.2" |
The postcss and diff overrides cause npm to install versions that are inconsistent with yarn.lock, which makes vsce's yarn list --prod fail. These are dev-only dependencies (gulp-sourcemaps, mocha) that don't affect the shipped extension.
Contributor
|
Re-running the failed jobs in the CI workflow for this pull request because 1 job was identified as retry-safe transient failures in the CI run attempt.
|
Contributor
|
🎬 CLI E2E Test Recordings — 56 recordings uploaded (commit View recordings
📹 Recordings uploaded automatically from CI run #24106588046 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Updates npm package dependencies across playground, test, template, and extension directories to their latest compatible versions.
Changes include:
viteacross playground apps, CLI templates, and project templates — most updated to 7.3.2, while templates withvite ^8.0.0(e.g.,java-starter) updated to 8.0.7 within their existing range. The Angular playground required anoverridesentry since its transitive dependency through@angular-devkit/build-angularwas pinned to a vulnerable version.nextfrom 15.3.9 to 15.5.14 intests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjspicomatchacross alltests/PolyglotAppHosts/*/TypeScriptdirectories and other test/playground projectspostcss(8.5.8) anddiff(8.0.3) overrides/resolutions in the VS Code extension to pull in latest versions for transitive dependenciespackage-lock.jsonfiles (andyarn.lockfor extension) in all affected directoriesValidation:
npm auditreports 0 vulnerabilities across all 80 npm directories in the repotsc --noEmit), webpack build, and eslintChecklist