Skip to content

rag-svelte api: starlette 1.0.1->1.3.1 (GHSA-82w8-qh3p-5jfq +3) [superseded by #1782] - #1873

Closed
David Pine (IEvangelist) wants to merge 1 commit into
mainfrom
dapire/security-deps/aspire-samples-python-starlette
Closed

rag-svelte api: starlette 1.0.1->1.3.1 (GHSA-82w8-qh3p-5jfq +3) [superseded by #1782]#1873
David Pine (IEvangelist) wants to merge 1 commit into
mainfrom
dapire/security-deps/aspire-samples-python-starlette

Conversation

@IEvangelist

@IEvangelist David Pine (IEvangelist) commented Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

[auto-sec] Canonical — aspire-samples Python starlette remediation

Cluster: Python/pip starlette advisories in samples/rag-document-qa-svelte/api/uv.lock
(breaking major bump, kept separate from the npm batch #1782).
Branch: dapire/security-deps/aspire-samples-python-starlette (rebased on latest origin/main).
Label: automated-security.

Alerts addressed (4)

GHSA Severity Vulnerable Fixed
GHSA-82w8-qh3p-5jfq high >= 0.4.1, < 1.3.1 1.3.1
GHSA-jp82-jpqv-5vv3 low < 1.3.0 1.3.0
GHSA-wqp7-x3pw-xc5r high < 1.1.0 1.1.0
GHSA-x746-7m8f-x49c medium < 1.1.0 1.1.0

Remediation

  • starlette bumped 1.0.1 → 1.3.1 in rag-document-qa-svelte/api/uv.lock. 1.3.1 is the highest
    first-patched version across the four advisories, so it clears all of them.
  • Verified: uv.lock now pins starlette == 1.3.1. Diff is scoped to this single lock file (rebased so the
    only delta vs main is the starlette entry).

Verification / CI status

  • windows-latest: pass. license/cla: pass.
  • ubuntu-latest: fail — NOT caused by this change. The failure is Aspire.Hosting.DistributedApplicationException: Resource 'angular' failed to start while the full-sample build runs npm ci for the unrelated
    AspireJavaScript.Angular sample. This is the pre-existing, repo-wide Angular dependency-resolution
    problem     that is remediated in [auto-sec] Consolidate aspire-samples dependency security remediations #1782 (Angular typescript/@angular-devkit peer alignment + npm
    overrides). It is orthogonal to the Python starlette change here (windows, which runs the same samples,
    passes; the Python service builds fine).

Blocker & sequencing

Re-verified 2026-08-11

Copilot AI lite review requested due to automatic review settings August 7, 2026 11:46
@IEvangelist David Pine (IEvangelist) added the automated-security Automated security consolidation PR label Aug 7, 2026
Copilot AI reviewed Aug 7, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@IEvangelist David Pine (IEvangelist) mentioned this pull request Aug 7, 2026
Open
ghassxxx6-wq
ghassxxx6-wq suggested changes Aug 8, 2026
View reviewed changes

@ghassxxx6-wq ghassxxx6-wq left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes #1873 #1782

@IEvangelist
David Pine (IEvangelist) force-pushed the dapire/security-deps/aspire-samples-python-starlette branch from 58ce055 to 16e29b3 Compare August 8, 2026 11:22
@IEvangelist

David Pine (IEvangelist) commented Aug 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

CI note — the red check is a pre-existing base-branch failure, now fixed in #1782 (not caused by this PR).

This PR changes only rag-svelte's Python uv.lock (starlette 1.0.1 → 1.3.1, GHSA-82w8-qh3p-5jfq +3). The single failing check — Build & Test Samples (ubuntu-latest) — is unrelated:

  • Root cause (pre-existing on main): samples/aspire-with-javascript/AspireJavaScript.Angular/package.json declared typescript@~7.0.2, but @angular-devkit/build-angular@^22.0.8 peer-requires typescript@">=6.0 <6.1". Aspire's runtime angular-installer runs npm ci (peer-validated) and aborts with ERESOLVE … Conflicting peer dependency: typescript@6.0.3, so the angular resource never starts (AppHostRunsCleanly + TestEndpointsReturnOk fail). The prior 6 Aspire Samples CI runs on main are all red with this same error.
  • Fix: [auto-sec] Consolidate aspire-samples dependency security remediations #1782 aligns Angular typescript to ~6.0.3 and regenerates the lockfile (npm ci verified green locally).
  • This PR: no Angular changes here — keeping it scoped to the starlette cluster. Once [auto-sec] Consolidate aspire-samples dependency security remediations #1782 merges to main, a rebase of this branch clears the red automatically. No action needed on the starlette remediation itself, which is correct and verified.

Tracked-by: #1782 (Angular typescript peer fix).

@IEvangelist @SkynetBot-001
[auto-sec] rag-svelte api: starlette 1.0.1->1.3.1 (GHSA-82w8-qh3p-5jfq …
0435075 
…+3)

Bump the transitive starlette pin in samples/rag-document-qa-svelte/api
from 1.0.1 to 1.3.1 (lowest version clearing all four advisories) via a
lockfile-only edit using public PyPI metadata (pypi.org / pythonhosted).
Only starlette's version/sdist/wheel triple changes; no dependency
cascade and no internal/mirror URLs.

Clears:
- #557 (high)   GHSA-82w8-qh3p-5jfq  (>= 0.4.1, < 1.3.1)
- #551 (high)   GHSA-wqp7-x3pw-xc5r  (< 1.1.0)
- #550 (medium) GHSA-x746-7m8f-x49c  (< 1.1.0)
- #556 (low)    GHSA-jp82-jpqv-5vv3  (< 1.3.0)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@IEvangelist
David Pine (IEvangelist) force-pushed the dapire/security-deps/aspire-samples-python-starlette branch from 16e29b3 to 0435075 Compare August 10, 2026 12:04
David Pine (IEvangelist) added a commit that referenced this pull request Aug 13, 2026
@IEvangelist
[auto-sec] samples: refresh dependency security overrides on latest main
d0328d1 
Rebased onto microsoft/aspire-samples main (was 10 commits behind, conflicting).
Updates npm `overrides` to current Dependabot fix versions and regenerates
package-lock.json across sample apps, clearing all 43 open npm Dependabot alerts:
postcss>=8.5.23, brace-expansion (1.1.16 / 5.0.7), fast-uri>=3.1.5, hono>=4.12.34,
@hono/node-server (2.0.5), nanoid>=3.3.17, webpack-dev-server>=5.2.6, esbuild>=0.28.1,
@babel/core>=7.29.6, body-parser>=2.3.0, protobufjs>=7.6.5.

Angular typescript kept at main's ~7.0.2 (regenerated with --legacy-peer-deps,
matching main's existing resolution). Starlette (pip) tracked separately in #1873.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
David Pine (IEvangelist) added a commit that referenced this pull request Aug 13, 2026
@IEvangelist
[auto-sec] samples: refresh dependency security overrides on latest main
34effae 
Rebased onto microsoft/aspire-samples main (was 10 commits behind, conflicting).
Updates npm `overrides` to current Dependabot fix versions and regenerates
package-lock.json across sample apps, clearing all 43 open npm Dependabot alerts:
postcss>=8.5.23, brace-expansion (1.1.16 / 5.0.7), fast-uri>=3.1.5, hono>=4.12.34,
@hono/node-server (2.0.5), nanoid>=3.3.17, webpack-dev-server>=5.2.6, esbuild>=0.28.1,
@babel/core>=7.29.6, body-parser>=2.3.0, protobufjs>=7.6.5.

Also fixes the repo-wide 'Aspire Samples CI' breakage: the angular-core Dependabot
group had bumped Angular's devDep typescript to ~7.0.2, which violates
@angular-devkit/build-angular@22.0.8's peer (typescript >=6.0 <6.1) and made the
'angular' resource's `npm ci` fail with ERESOLVE on every PR and on main. Pins
Angular typescript back to ~6.0.3 (compatible line), so `npm ci` resolves cleanly.

Starlette (pip) tracked separately in #1873.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
David Pine (IEvangelist) added a commit that referenced this pull request Aug 13, 2026
@IEvangelist
[auto-sec] samples: consolidate dependency security remediations on l…
84bf000 
…atest main

npm (43 alerts) + pip starlette (4 alerts) consolidated onto latest upstream/main.
- Angular: pin typescript ~6.0.3 (fixes @angular-devkit/build-angular peer ERESOLVE in npm ci); overrides for @hono/node-server, brace-expansion 1.1.16, fast-uri, hono, postcss, sockjs->uuid, webpack-dev-server
- Vite: overrides @babel/core 7.29.6, postcss 8.5.23
- Vue: overrides nanoid 3.3.17, postcss 8.5.23
- Root/other lockfiles: brace-expansion 5.0.7, transitive bumps
- pip: starlette 1.0.1 -> 1.3.1 (rag-document-qa-svelte/api) — folds in prior #1873

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@IEvangelist David Pine (IEvangelist) changed the title [auto-sec] rag-svelte api: starlette 1.0.1->1.3.1 (GHSA-82w8-qh3p-5jfq +3) rag-svelte api: starlette 1.0.1->1.3.1 (GHSA-82w8-qh3p-5jfq +3) [superseded by #1782] Aug 13, 2026
@IEvangelist

David Pine (IEvangelist) commented Aug 13, 2026

Copy link
Copy Markdown
Member Author

Superseded by #1782, which now consolidates ALL aspire-samples dependency security remediations (npm batch + this pip starlette 1.0.1->1.3.1 bump). The identical uv.lock change has been folded into #1782.

Kept open (non-canonical) as a tracked overlap; will be closed once #1782 is green + mergeable per the closure gate.

@IEvangelist

David Pine (IEvangelist) commented Aug 13, 2026

Copy link
Copy Markdown
Member Author

Closing as superseded by #1782, which is now green (ubuntu + windows Aspire Samples CI pass), MERGEABLE, and conflict-free — closure gate satisfied.

The starlette 1.0.1 → 1.3.1 uv.lock fix (clears GHSA-82w8-qh3p-5jfq +3) has been folded verbatim into #1782, the single canonical consolidated aspire-samples security PR.

@IEvangelist
David Pine (IEvangelist) deleted the dapire/security-deps/aspire-samples-python-starlette branch August 14, 2026 12:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
+1 more reviewer
@ghassxxx6-wq ghassxxx6-wq ghassxxx6-wq approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

automated-security Automated security consolidation PR

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@IEvangelist @ghassxxx6-wq