From 101928eac0847d3ef9d83aaa8b043f89645d6136 Mon Sep 17 00:00:00 2001 From: Giles Odigwe Date: Tue, 28 Jul 2026 15:17:02 -0700 Subject: [PATCH 1/3] Bump form-data from 4.0.5 to 4.0.6 in ProcessFrameworkWithSignalR React frontend Resolves the form-data CRLF injection advisory (CWE-93) by upgrading the transitively-resolved form-data dependency to the patched 4.0.6 release. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fdaae27a-1dfe-4ed4-9704-c4b8f6c7ecd7 --- .../package-lock.json | 6 +++--- .../ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/package-lock.json b/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/package-lock.json index 690cca20a722..c23eb2397079 100644 --- a/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/package-lock.json +++ b/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/package-lock.json @@ -3602,14 +3602,14 @@ } }, "node_modules/form-data": { - "version": "4.0.5", + "version": "4.0.6", "license": "MIT", "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", "es-set-tostringtag": "^2.1.0", - "hasown": "^2.0.2", - "mime-types": "^2.1.12" + "hasown": "^2.0.4", + "mime-types": "^2.1.35" }, "engines": { "node": ">= 6" diff --git a/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock b/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock index c7c5ccdb14b4..aa13c736610d 100644 --- a/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock +++ b/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock @@ -1954,13 +1954,13 @@ follow-redirects@^1.16.0: integrity sha1-KEdKFZ07nRHvYgUKFO1g5N9tYbw= form-data@^4.0.5: - version "4.0.5" + version "4.0.6" dependencies: asynckit "^0.4.0" combined-stream "^1.0.8" es-set-tostringtag "^2.1.0" - hasown "^2.0.2" - mime-types "^2.1.12" + hasown "^2.0.4" + mime-types "^2.1.35" fsevents@~2.3.3: version "2.3.3" From 524bf90b669be96ae28ee78f50b09fdbaf3596d3 Mon Sep 17 00:00:00 2001 From: Giles Odigwe Date: Tue, 28 Jul 2026 15:22:39 -0700 Subject: [PATCH 2/3] Add resolved and integrity fields to form-data 4.0.6 lockfile entries Addresses PR review feedback: restore resolved/integrity metadata so the form-data@4.0.6 entry matches the determinism guarantees of the other lockfile entries. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fdaae27a-1dfe-4ed4-9704-c4b8f6c7ecd7 --- .../package-lock.json | 2 ++ .../src/ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock | 2 ++ 2 files changed, 4 insertions(+) diff --git a/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/package-lock.json b/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/package-lock.json index c23eb2397079..a4c7fd1943b0 100644 --- a/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/package-lock.json +++ b/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/package-lock.json @@ -3603,6 +3603,8 @@ }, "node_modules/form-data": { "version": "4.0.6", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz", + "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==", "license": "MIT", "dependencies": { "asynckit": "^0.4.0", diff --git a/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock b/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock index aa13c736610d..69b13d73262f 100644 --- a/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock +++ b/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock @@ -1955,6 +1955,8 @@ follow-redirects@^1.16.0: form-data@^4.0.5: version "4.0.6" + resolved "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz" + integrity sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ== dependencies: asynckit "^0.4.0" combined-stream "^1.0.8" From b89d48144ec58b91997f0137942a60ee9bed1c5f Mon Sep 17 00:00:00 2001 From: Giles Odigwe Date: Tue, 28 Jul 2026 15:38:53 -0700 Subject: [PATCH 3/3] Bump transitive hasown to 2.0.4 to satisfy form-data 4.0.6 form-data@4.0.6 requires hasown ^2.0.4, but both lockfiles still resolved hasown 2.0.2, making the tree self-inconsistent. Bump the deduped hasown entry to 2.0.4 (authentic npm metadata) in package-lock.json and yarn.lock; 2.0.4 satisfies all existing ^2.0.2 consumers and hasown's own deps are unchanged (function-bind ^1.1.2). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fdaae27a-1dfe-4ed4-9704-c4b8f6c7ecd7 --- .../package-lock.json | 6 +++--- .../yarn.lock | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/package-lock.json b/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/package-lock.json index a4c7fd1943b0..bafbb85344e5 100644 --- a/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/package-lock.json +++ b/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/package-lock.json @@ -3760,9 +3760,9 @@ } }, "node_modules/hasown": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz", - "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==", + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz", + "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==", "license": "MIT", "dependencies": { "function-bind": "^1.1.2" diff --git a/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock b/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock index 69b13d73262f..05c0b1089b37 100644 --- a/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock +++ b/dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend/yarn.lock @@ -2049,10 +2049,10 @@ has-tostringtag@^1.0.2: dependencies: has-symbols "^1.0.3" -hasown@^2.0.2: - version "2.0.2" - resolved "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz" - integrity sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ== +hasown@^2.0.2, hasown@^2.0.4: + version "2.0.4" + resolved "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz" + integrity sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A== dependencies: function-bind "^1.1.2"