Skip to content

Conversation

@joperezr
Copy link
Member

@joperezr joperezr commented Dec 4, 2025

Updating React dependencies on our templates project in due to CVE-2025-55182

Copilot AI review requested due to automatic review settings December 4, 2025 03:31
@github-actions
Copy link
Contributor

github-actions bot commented Dec 4, 2025

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 13325

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 13325"

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates React and ReactDOM dependencies to version 19.2.1 across all projects in the repository to address security vulnerability CVE-2025-55182.

Key changes:

  • Updated React from versions 19.0.0 and 19.1.1 to 19.2.1
  • Updated ReactDOM from versions 19.0.0 and 19.1.1 to 19.2.1
  • Updated scheduler dependency to ^0.27.0 where applicable

Reviewed changes

Copilot reviewed 3 out of 6 changed files in this pull request and generated no comments.

Show a summary per file
File Description
src/Aspire.ProjectTemplates/templates/aspire-py-starter/13.0/frontend/package.json Updated React and ReactDOM dependencies to ^19.2.1 in template project
src/Aspire.ProjectTemplates/templates/aspire-py-starter/13.0/frontend/package-lock.json Updated lock file with new React 19.2.1 versions, integrity hashes, and scheduler dependency to ^0.27.0
playground/AspireWithJavaScript/AspireJavaScript.Vite/package.json Updated React and ReactDOM dependencies from ^19.0.0 to ^19.2.1 in Vite playground
playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json Updated lock file with new React 19.2.1 versions, scheduler upgraded from ^0.25.0 to ^0.27.0
playground/AspireWithJavaScript/AspireJavaScript.React/package.json Updated React and ReactDOM dependencies to ^19.2.1 in React playground
playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json Updated lock file with new React 19.2.1 versions, scheduler upgraded from ^0.26.0 to ^0.27.0
Files not reviewed (3)
  • playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json: Language not supported
  • playground/AspireWithJavaScript/AspireJavaScript.Vite/package-lock.json: Language not supported
  • src/Aspire.ProjectTemplates/templates/aspire-py-starter/13.0/frontend/package-lock.json: Language not supported

@joperezr joperezr merged commit 8924dc6 into dotnet:release/13.0 Dec 4, 2025
300 of 301 checks passed
This was referenced Dec 4, 2025
This was referenced Dec 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant