Bump JS deps to resolve all 29 open Dependabot alerts

[IEvangelist]

Bump JS deps to resolve all 29 open Dependabot alerts

Summary

Closes the remaining 29 open Dependabot alerts on this repo by bumping the four JavaScript lockfile-based manifests. The Dependabot grouped PR #17377 covers 25 of these alerts but leaves four behind — @nevware21/ts-utils in extension/ (alerts #1160 / #1161) and webpack-dev-server in the Angular and React playgrounds (alerts #1152 / #1153). This PR is a single, manually authored replacement that covers the full set in one place.

Companion to the OpenTelemetry alert fix (#17171, already merged) which patched the lockfile-less package.json-only manifests that Dependabot can't bump on its own.

Alerts addressed (29 total)

File	Package	Vuln range	Bumped to	Severity	GHSA	Alert
extension/{package-lock.json,yarn.lock}	ws	< 8.20.1	8.20.1	medium	GHSA-58qx-3vcg-4xpx	#1154, #1155
extension/{package-lock.json,yarn.lock}	fast-uri	<= 3.1.0	3.1.2	high	GHSA-q3j6-qgpj-74h6	#1019, #1020
extension/{package-lock.json,yarn.lock}	fast-uri	<= 3.1.1	3.1.2	high	GHSA-v39h-62p7-jpjc	#1021, #1022
extension/{package-lock.json,yarn.lock}	@nevware21/ts-utils	<= 0.13.0	0.14.0	high	GHSA-x7j8-49r8-mr43	#1160, #1161
playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json	fast-uri	<= 3.1.0	3.1.2	high	GHSA-q3j6-qgpj-74h6	#1018
playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json	fast-uri	<= 3.1.1	3.1.2	high	GHSA-v39h-62p7-jpjc	#1023
playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json	@babel/plugin-transform-modules-systemjs	<= 7.29.3	7.29.4	high	GHSA-fv7c-fp4j-7gwp	#1024
playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json	webpack-dev-server	<= 5.2.3	5.2.4	medium	GHSA-79cf-xcqc-c78w	#1152
playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json	fast-uri	<= 3.1.0	3.1.2	high	GHSA-q3j6-qgpj-74h6	#1017
playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json	fast-uri	<= 3.1.1	3.1.2	high	GHSA-v39h-62p7-jpjc	#1025
playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json	@babel/plugin-transform-modules-systemjs	<= 7.29.3	7.29.4	high	GHSA-fv7c-fp4j-7gwp	#1026
playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json	webpack-dev-server	<= 5.2.3	5.2.4	medium	GHSA-79cf-xcqc-c78w	#1153
tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json	next	< 15.5.16 (×12) and < 15.5.18 (×1)	15.5.18	high / medium / low	GHSA-8h8q-6873-q5fj, GHSA-36qx-fr4f-26g5, GHSA-267c-6grr-h53f, GHSA-492v-c6pp-mqqv, GHSA-c4j6-fc7j-m34r, GHSA-mg66-mrh9-m8jx, GHSA-26hh-7cqf-hhc6, GHSA-wfc6-r584-vfw7, GHSA-h64f-5h5j-jqjh, GHSA-gx5p-jg67-6x7h, GHSA-ffhc-5mcf-pf4q, GHSA-vfv6-92ff-j949, GHSA-3g8h-86w9-wvmq	#1043–#1055

How each manifest was updated

• extension/ — ws is a direct dependency, so its pin moves from 8.20.0 to 8.20.1 in package.json. fast-uri and @nevware21/ts-utils are transitive (telemetry chain via @vscode/extension-telemetry), so they're pinned via the existing overrides (npm) and resolutions (yarn) blocks. Both package-lock.json and yarn.lock are regenerated from the updated package.json so the two lockfiles stay in sync — the repo tracks both.
• playground/.../Angular — all three packages are transitive, so each is added to the existing overrides block. package-lock.json is regenerated with npm install --package-lock-only.
• playground/.../React — webpack-dev-server is a direct devDependency. npm rejects overrides entries that conflict with a direct dependency, so the range itself moves from ^5.2.2 to ^5.2.4. fast-uri and @babel/plugin-transform-modules-systemjs are still transitive, so they remain in overrides. The lockfile diff is large here because webpack-dev-server 5.2.4 swapped its TLS cert generator from node-forge to @peculiar/x509 upstream — the new family of @peculiar/asn1-* and pkijs packages are all dev-only and only loaded when running npm start against the playground.
• tests/.../JsPublish/nextjs — next is a direct dependency. Bumped from 15.5.15 to 15.5.18. 15.5.18 is the first version patched against all 13 alerts (the < 15.5.18 cache-confusion alert was the gating one; the older alerts are fixed at 15.5.16).

Validation

For each updated manifest, npm install --package-lock-only --no-audit --no-fund succeeds against the dnceng mirror, and every vulnerable version is gone from the resolved tree. A scripted scan of all four package-lock.json files plus extension/yarn.lock confirms zero leftover entries in the vulnerable ranges across all 29 alerts:

=== extension/package-lock.json ===
  OK   ws = 8.20.1 (expected 8.20.1)
  OK   fast-uri = 3.1.2 (expected 3.1.2)
  OK   @nevware21/ts-utils = 0.14.0 (expected 0.14.0)
=== playground/AspireWithJavaScript/AspireJavaScript.Angular/package-lock.json ===
  OK   fast-uri = 3.1.2 (expected 3.1.2)
  OK   @babel/plugin-transform-modules-systemjs = 7.29.4 (expected 7.29.4)
  OK   webpack-dev-server = 5.2.4 (expected 5.2.4)
=== playground/AspireWithJavaScript/AspireJavaScript.React/package-lock.json ===
  OK   fast-uri = 3.1.2 (expected 3.1.2)
  OK   @babel/plugin-transform-modules-systemjs = 7.29.4 (expected 7.29.4)
  OK   webpack-dev-server = 5.2.4 (expected 5.2.4)
=== tests/Aspire.Cli.EndToEnd.Tests/Fixtures/JsPublish/nextjs/package-lock.json ===
  OK   next = 15.5.18 (expected 15.5.18)
=== extension/yarn.lock ===
  OK   ws = 8.20.1 (expected 8.20.1)
  OK   fast-uri = 3.1.2 (expected 3.1.2)
  OK   @nevware21/ts-utils = 0.14.0 (expected 0.14.0)
Total: 13 pass, 0 fail

Risk notes for reviewers

• AGENTS.md rule: "Never change package.json or package-lock.json files unless explicitly asked to." This change was explicitly requested as a security-alert sweep, which is the documented exception.
• webpack-dev-server in the React playground brings the largest diff because of the upstream node-forge → @peculiar/x509 swap. The package is dev-only; nothing in the published artifacts or production code path is affected. Reviewers may want to confirm by spot-checking the start:* scripts in playground/AspireWithJavaScript/AspireJavaScript.React/package.json.
• next 15.5.15 → 15.5.18 is a patch bump (no breaking changes in the test fixture). The fixture is consumed by Aspire.Cli.EndToEnd.Tests via the JsPublish scenario; the CLI publishes the project but doesn't build the Next.js app itself in CI.
• extension/yarn.lock and extension/package-lock.json are both tracked; the existing repo convention is to keep them in sync, which this PR preserves.

Related

• Supersedes Bump the npm_and_yarn group across 4 directories with 4 updates #17377 (Dependabot grouped PR) which covered 25 of the 29 alerts. Recommend closing it once this lands.
• Sibling to Bump OpenTelemetry JS deps to address GHSA-q7rr-3cgh-j5r3 #17171 (OpenTelemetry JS alert fix, merged 2026-05-20).

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 17381

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 17381"