Skip to content

[docs] Note tmp security update (GHSA-ph9p-34f9-6g65) in Aspire 13.4 release notes #1123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
David Pine (IEvangelist) merged 2 commits into from
Jun 1, 2026
Merged

[docs] Note tmp security update (GHSA-ph9p-34f9-6g65) in Aspire 13.4 release notes #1123

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
52fc924
docs: note tmp security update (GHSA-ph9p-34f9-6g65) in 13.4 release …
aspire-repo-bot[bot] May 29, 2026
9750ccf
Address review feedback (2 threads)
IEvangelist May 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions src/frontend/src/content/docs/whats-new/aspire-13-4.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -372,6 +372,10 @@ Azure Front Door CDN resources now use Azure.Provisioning's built-in name-genera

Azure AI Foundry hosted agents also include deployment fixes: project endpoints now use the correct `customSubDomainName` format, the Foundry-created agent identity receives the Cognitive Services User role automatically, and the app identity is no longer incorrectly injected into the hosted-agent environment.

## 🔒 Security updates

Comment thread
IEvangelist marked this conversation as resolved.
Outdated
The `tmp` npm package (a dev-only transitive dependency used by the Visual Studio Code extension and the Angular playground sample) was updated to address [GHSA-ph9p-34f9-6g65](https://github.com/advisories/GHSA-ph9p-34f9-6g65), a high-severity path traversal vulnerability affecting versions prior to `0.2.6`. This dependency is not included in any published Aspire NuGet packages or runtime artifacts; only the VS Code extension tooling and playground sample were affected.
Comment thread
IEvangelist marked this conversation as resolved.
Outdated

## 🐛 Bug fixes and full changelog

For the complete list of bug fixes and smaller changes in this release, see the [Aspire 13.4 release notes on GitHub](https://github.com/microsoft/aspire/releases/tag/v13.4.0).
Expand Down
Loading