[auto-sec] aspire.dev: remediate 12 frontend npm security alerts

[David Pine (IEvangelist)]

[auto-sec] Canonical — aspire.dev frontend npm security cluster

Canonical remediation PR for the aspire.dev dependency/security cluster.
Branch dapire/security-deps/aspire.dev-frontend-npm, based on the latest
origin/main, labeled automated-security.

Alerts addressed — all 12 open Dependabot alerts (1 critical, 6 high, 5 moderate)

Package	Change	Severity	Advisory / alert
astro	7.1.3 → 7.2.10	🔴 CRITICAL + 🟡 moderate	alerts #122, #123
sharp	0.35.3 → 0.35.4	🟠 HIGH	alerts #125, #128
js-yaml	override → 4.3.2	🟠 HIGH	alert #127
nanoid	override → 3.3.18	🟠 HIGH	alert #118
smol-toml	override → 1.7.1	🟠 HIGH	alert #129
svgo	override → 4.1.0	🟠 HIGH + 🟡 moderate	alerts #120, #121
fflate	override → 0.7.5	🟡 moderate	alert #119
vitest	4.1.10 → 4.1.11	🟡 moderate	alert #126
@vitest/mocker	override → 4.1.11	🟡 moderate	alert #124

How

• Direct deps bumped in src/frontend/package.json: astro, sharp, vitest.
• Transitive deps pinned via src/frontend/pnpm-workspace.yaml overrides — the
  repo's existing security-remediation mechanism. Stale overrides refreshed
  (js-yaml 4.3.1→4.3.2, nanoid 3.3.17→3.3.18, svgo =4.0.0→<4.1.0:4.1.0)
  and new surgical range overrides added (fflate, smol-toml, @vitest/mocker).
• src/frontend/pnpm-lock.yaml regenerated with pnpm install (astro minor bump
  accounts for the large lockfile delta).

Verification

• ✅ pnpm install — succeeds; lockfile npm ci-consistent.
• ✅ pnpm audit — No known vulnerabilities found.
• ✅ pnpm exec astro sync — config + all integrations + content types load under astro 7.2.10.

Supersedes (Dependabot PRs folded into this canonical cluster)

• build(deps): bump astro from 7.1.3 to 7.2.8 in /src/frontend #1641 — bump astro to 7.2.8
• build(deps-dev): bump vitest from 4.1.10 to 4.1.11 in /src/frontend #1642 — bump vitest to 4.1.11
• build(deps): bump sharp from 0.35.3 to 0.35.4 in /src/frontend #1643 — bump sharp to 0.35.4
• build(deps): bump the npm-all group across 1 directory with 29 updates #1644 — npm-all group across 1 directory (29 updates)

These remain open and tracked until this canonical PR is confirmed green, per the
closure gate; they will then be closed as superseded.

---

canonical_count_frontend-npm = 1

[Copilot]

🔵 Needs a closer look

Dependency/security remediations with a regenerated lockfile require CI confirmation to ensure the updated resolution graph doesn’t introduce build/runtime regressions.

Pull request overview

This PR remediates a cluster of frontend npm Dependabot security alerts for aspire.dev by updating a few direct dependencies and pinning vulnerable transitives via pnpm overrides, with a regenerated lockfile to reflect the resolved versions.

Changes:

• Bump direct frontend deps: astro, sharp, and vitest.
• Add/refresh pnpm-workspace.yaml overrides to force patched transitive versions (@vitest/mocker, fflate, js-yaml, nanoid, smol-toml, svgo).
• Regenerate pnpm-lock.yaml to capture the new resolution graph.

File summaries

File	Description
src/frontend/pnpm-workspace.yaml	Adds/updates pnpm overrides to pin vulnerable transitives to patched versions.
src/frontend/package.json	Bumps direct dependencies (astro, sharp, vitest) involved in the security remediation.
src/frontend/pnpm-lock.yaml	Updated dependency resolution output consistent with the new direct deps + overrides.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[aspire-repo-bot]

Frontend HTML artifact ready

The latest frontend build uploaded the frontend-dist artifact for PR #1645. Use the VS Code button below to open this PR with GitHub Artifacts Explorer and browse the built HTML locally.

This comment updates automatically when a new frontend build artifact is uploaded.

[Alistair Matthews (alistairmatthews)]

This all works on my machine. Approved.