🤓 Content for release: 13.5 - #1233
Draft
David Pine (IEvangelist) wants to merge 140 commits into
Draft
Conversation
…1181) * docs: document timestamp search qualifier for telemetry filtering Documents the new 'timestamp' search qualifier added in microsoft/aspire#17816. Users can now filter traces and structured logs by date/time using ISO 8601 strings with comparison operators (>, >=, <, <=) in the dashboard filter bar. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Move timestamp qualifier docs to shared CLI references Co-authored-by: JamesNK <303201+JamesNK@users.noreply.github.com> * Fix severity casing in timestamp search example Co-authored-by: JamesNK <303201+JamesNK@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: James Newton-King <james@newtonking.com> * Apply suggestion from @JamesNK * Apply suggestion from @JamesNK * docs: clarify date-only timestamp search values Co-authored-by: JamesNK <303201+JamesNK@users.noreply.github.com> * Apply suggestion from @JamesNK * Apply suggestion from @JamesNK * Update timestamp example dates to use 2026 --------- Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: JamesNK <303201+JamesNK@users.noreply.github.com> Co-authored-by: James Newton-King <james@newtonking.com>
* Fix persistent container endpoint proxy default docs Persistent containers use proxied endpoints by default (same as session containers), while persistent executables and projects default to proxyless endpoints. Also document that proxyless container endpoints with only a targetPort immediately allocate the targetPort as the host port. Corrects docs that previously stated all persistent resources default to proxyless endpoints. Documents changes from microsoft/aspire#17960. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: David Negstad <50252651+danegsta@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…re#17889) (#1210) * docs: update Foundry Local section to reflect CLI-based lifecycle The Foundry Local integration now uses the installed 'foundry' CLI (foundry service start/stop/list and foundry model download/load) instead of the FoundryLocalManager in-proc APIs. Aspire manages the entire service lifecycle automatically. Update docs to: - Clarify users do not need to pre-start Foundry Local - State that the 'foundry' CLI must be on PATH - Describe the automatic start/stop lifecycle management Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Sébastien Ros <sebastienros@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
David Pine (IEvangelist)
requested review from
Eric Erhardt (eerhardt) and
Mitch Denny (mitchdenny)
as code owners
June 9, 2026 02:27
David Pine (IEvangelist)
changed the title
13.5
Contributor
There was a problem hiding this comment.
Pull request overview
Adds Aspire 13.5 “What’s new” placeholder content and updates several docs to reflect recent networking/persistence behavior changes and new CLI telemetry search capabilities (timestamp filtering).
Changes:
- Add placeholder release notes page for Aspire 13.5 and wire it into the docs sidebar.
- Update persistent lifetime/proxyless endpoint guidance across “What’s new”, networking fundamentals, and resource lifetime docs.
- Extend CLI
--searchdocumentation to include timestamp comparisons for logs/traces/spans (plus command reference updates).
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/frontend/src/content/docs/whats-new/aspire-13-5.mdx | Adds placeholder Aspire 13.5 release notes + upgrade/install guidance scaffolding. |
| src/frontend/src/content/docs/whats-new/aspire-13-4.mdx | Clarifies persistent proxy behavior differences between containers vs executables/projects. |
| src/frontend/src/content/docs/reference/cli/search-filter.mdx | Documents timestamp qualifier and comparison behavior for --search. |
| src/frontend/src/content/docs/reference/cli/commands/aspire-otel-traces.mdx | Updates supported search fields + adds timestamp filtering example. |
| src/frontend/src/content/docs/reference/cli/commands/aspire-otel-spans.mdx | Updates supported search fields + adds timestamp filtering example. |
| src/frontend/src/content/docs/reference/cli/commands/aspire-otel-logs.mdx | Updates supported search fields + adds timestamp filtering example. |
| src/frontend/src/content/docs/integrations/cloud/azure/azure-ai-foundry/azure-ai-foundry-host.mdx | Updates Foundry Local lifecycle explanation and prerequisites around foundry CLI. |
| src/frontend/src/content/docs/fundamentals/networking-overview.mdx | Refines proxyless endpoint defaults/behavior for persistent resources and containers. |
| src/frontend/src/content/docs/app-host/resource-lifetimes.mdx | Updates persistent lifetime endpoint proxy defaults and proxyless container endpoint note. |
| src/frontend/config/sidebar/docs.topics.ts | Adds “Aspire 13.5” entry to the “What’s new” sidebar section. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
Frontend HTML artifact readyThe latest frontend build uploaded the This comment updates automatically when a new frontend build artifact is uploaded. |
Add a new row to the CLI telemetry data points table for Aspire CLI 13.5 documenting the new coding agent detection telemetry. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
David Fowler (davidfowl)
marked this pull request as draft
June 10, 2026 05:27
…8065-a0f9d35c8766b2f3 [docs] Document coding agent telemetry detection in CLI telemetry page
* docs: add WithTerminal() interactive terminal sessions page Documents the WithTerminal() experimental API introduced in Aspire 13.5: - Basic usage (C# and TypeScript) - Custom terminal dimensions - Multi-replica support - Dashboard terminal view - aspire terminal attach / aspire terminal ps CLI commands Closes microsoft/aspire#17866 (docs obligation) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: address PR review feedback for withterminal docs - remove redundant sidebar translations block - clean up unused import and wording updates - fix CLI reference link target - remove duplicate build/run call in dimensions sample Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Mitch Denny <midenn@orangecake.local> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Update all banners (18 files across English and 16 locale variants) from 13.4 to 13.5 with engaging messaging - Replace 13.5 placeholder release notes with comprehensive content from the official changelog - Include detailed release highlights covering AppHost, CLI, Dashboard, and Extensions improvements - Document breaking changes (ServiceProvider renamed, PublishAsConnectionString obsolete, aspire ps --resources flag removed) - Maintain consistent tone and voice with prior What's new articles Changes cover: - Interactive terminal sessions with WithTerminal() - Polyglot IInteractionService across TypeScript, Python, Go, Java, Rust - User-defined resource command arguments - TypeScript AppHost stability fixes and optimizations - Custom health checks for TypeScript AppHosts - CLI enhancements (npm package, embedded skills bundle) - Dashboard telemetry improvements (timestamp filtering, better error messages) - VS Code extension enhancements (Dashboard side panel, Bun debugging, resource commands) - Foundry Local integration CLI updates - And more bug fixes and improvements Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add documentation for the new operating system check introduced in microsoft/aspire#18252. The check appears in the Environment section of `aspire doctor` output and includes structured metadata in JSON format. Changes: - Update Environment checks description to mention OS reporting - Add OS check to sample table output - Add operating-system entry to JSON output example - Document the osType/displayName/version/description metadata fields Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Revise interaction service API documentation (#1408)
Updated section headings and clarified usage instructions for the interaction service API.
* [auto-sec] Consolidate aspire.dev frontend dependency security remediations (#1392)
* build(deps): bump the npm-all group across 1 directory with 32 updates
Bumps the npm-all group with 32 updates in the /src/frontend directory:
| Package | From | To |
| --- | --- | --- |
| [@astrojs/markdown-remark](https://github.com/withastro/astro/tree/HEAD/packages/markdown/remark) | `7.2.0` | `7.2.1` |
| [@astrojs/mdx](https://github.com/withastro/astro/tree/HEAD/packages/integrations/mdx) | `7.0.0` | `7.0.3` |
| [@astrojs/rss](https://github.com/withastro/astro/tree/HEAD/packages/astro-rss) | `4.0.18` | `4.0.19` |
| [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.1` | `0.41.3` |
| [@catppuccin/starlight](https://github.com/catppuccin/starlight/tree/HEAD/packages/catppuccin-starlight) | `2.0.1` | `2.1.0` |
| [@expressive-code/plugin-collapsible-sections](https://github.com/expressive-code/expressive-code/tree/HEAD/packages/@expressive-code/plugin-collapsible-sections) | `0.44.0` | `0.44.1` |
| [@expressive-code/plugin-line-numbers](https://github.com/expressive-code/expressive-code/tree/HEAD/packages/@expressive-code/plugin-line-numbers) | `0.44.0` | `0.44.1` |
| [@fontsource-variable/fira-code](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/fira-code) | `5.2.7` | `5.3.0` |
| [@fontsource-variable/outfit](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/outfit) | `5.2.8` | `5.3.0` |
| [@fontsource-variable/rubik](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/rubik) | `5.2.8` | `5.3.0` |
| [@fontsource/poppins](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/poppins) | `5.2.7` | `5.3.0` |
| [asciinema-player](https://github.com/asciinema/asciinema-player) | `3.16.0` | `3.17.0` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.0.3` | `7.1.3` |
| [astro-expressive-code](https://github.com/expressive-code/expressive-code/tree/HEAD/packages/astro-expressive-code) | `0.44.0` | `0.44.1` |
| [satori](https://github.com/vercel/satori) | `0.26.0` | `0.28.1` |
| [satteri](https://github.com/bruits/satteri) | `0.9.4` | `0.9.5` |
| [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.3` |
| [starlight-github-alerts](https://github.com/HiDeoo/starlight-github-alerts/tree/HEAD/packages/starlight-github-alerts) | `0.3.0` | `0.4.0` |
| [starlight-links-validator](https://github.com/HiDeoo/starlight-links-validator/tree/HEAD/packages/starlight-links-validator) | `0.25.1` | `0.25.2` |
| [starlight-llms-txt](https://github.com/delucis/starlight-llms-txt/tree/HEAD/packages/starlight-llms-txt) | `0.10.0` | `0.11.0` |
| [starlight-page-actions](https://github.com/dlcastillop/starlight-page-actions/tree/HEAD/packages/starlight-page-actions) | `0.6.2` | `0.7.0` |
| [@iconify-json/material-icon-theme](https://github.com/iconify/icon-sets) | `1.2.68` | `1.2.69` |
| [@types/hast](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/hast) | `3.0.4` | `3.0.5` |
| [@unocss/astro](https://github.com/unocss/unocss/tree/HEAD/packages-integrations/astro) | `66.6.8` | `66.7.5` |
| [astro-embed](https://github.com/delucis/astro-embed/tree/HEAD/packages/astro-embed) | `0.13.0` | `0.13.1` |
| [eslint](https://github.com/eslint/eslint) | `10.6.0` | `10.7.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.1` | `3.9.5` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.4` | `4.23.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.62.0` | `8.65.0` |
| [unocss](https://github.com/unocss/unocss/tree/HEAD/packages-presets/unocss) | `66.6.8` | `66.7.5` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.9` | `4.1.10` |
Updates `@astrojs/markdown-remark` from 7.2.0 to 7.2.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/markdown/remark/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/markdown-remark@7.2.1/packages/markdown/remark)
Updates `@astrojs/mdx` from 7.0.0 to 7.0.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/mdx/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/mdx@7.0.3/packages/integrations/mdx)
Updates `@astrojs/rss` from 4.0.18 to 4.0.19
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro-rss/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/rss@4.0.19/packages/astro-rss)
Updates `@astrojs/starlight` from 0.41.1 to 0.41.3
- [Release notes](https://github.com/withastro/starlight/releases)
- [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
- [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.3/packages/starlight)
Updates `@catppuccin/starlight` from 2.0.1 to 2.1.0
- [Release notes](https://github.com/catppuccin/starlight/releases)
- [Changelog](https://github.com/catppuccin/starlight/blob/main/packages/catppuccin-starlight/CHANGELOG.md)
- [Commits](https://github.com/catppuccin/starlight/commits/v2.1.0/packages/catppuccin-starlight)
Updates `@expressive-code/plugin-collapsible-sections` from 0.44.0 to 0.44.1
- [Release notes](https://github.com/expressive-code/expressive-code/releases)
- [Changelog](https://github.com/expressive-code/expressive-code/blob/main/packages/@expressive-code/plugin-collapsible-sections/CHANGELOG.md)
- [Commits](https://github.com/expressive-code/expressive-code/commits/@expressive-code/plugin-collapsible-sections@0.44.1/packages/@expressive-code/plugin-collapsible-sections)
Updates `@expressive-code/plugin-line-numbers` from 0.44.0 to 0.44.1
- [Release notes](https://github.com/expressive-code/expressive-code/releases)
- [Changelog](https://github.com/expressive-code/expressive-code/blob/main/packages/@expressive-code/plugin-line-numbers/CHANGELOG.md)
- [Commits](https://github.com/expressive-code/expressive-code/commits/@expressive-code/plugin-line-numbers@0.44.1/packages/@expressive-code/plugin-line-numbers)
Updates `@fontsource-variable/fira-code` from 5.2.7 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/fira-code)
Updates `@fontsource-variable/outfit` from 5.2.8 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/outfit)
Updates `@fontsource-variable/rubik` from 5.2.8 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/rubik)
Updates `@fontsource/poppins` from 5.2.7 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/poppins)
Updates `asciinema-player` from 3.16.0 to 3.17.0
- [Release notes](https://github.com/asciinema/asciinema-player/releases)
- [Commits](https://github.com/asciinema/asciinema-player/compare/v3.16.0...v3.17.0)
Updates `astro` from 7.0.3 to 7.1.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.3/packages/astro)
Updates `astro-expressive-code` from 0.44.0 to 0.44.1
- [Release notes](https://github.com/expressive-code/expressive-code/releases)
- [Changelog](https://github.com/expressive-code/expressive-code/blob/main/packages/astro-expressive-code/CHANGELOG.md)
- [Commits](https://github.com/expressive-code/expressive-code/commits/astro-expressive-code@0.44.1/packages/astro-expressive-code)
Updates `satori` from 0.26.0 to 0.28.1
- [Release notes](https://github.com/vercel/satori/releases)
- [Commits](https://github.com/vercel/satori/compare/0.26.0...0.28.1)
Updates `satteri` from 0.9.4 to 0.9.5
- [Release notes](https://github.com/bruits/satteri/releases)
- [Commits](https://github.com/bruits/satteri/compare/satteri-v0.9.4...satteri-v0.9.5)
Updates `sharp` from 0.34.5 to 0.35.3
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](https://github.com/lovell/sharp/compare/v0.34.5...v0.35.3)
Updates `starlight-github-alerts` from 0.3.0 to 0.4.0
- [Release notes](https://github.com/HiDeoo/starlight-github-alerts/releases)
- [Changelog](https://github.com/HiDeoo/starlight-github-alerts/blob/main/packages/starlight-github-alerts/CHANGELOG.md)
- [Commits](https://github.com/HiDeoo/starlight-github-alerts/commits/starlight-github-alerts@0.4.0/packages/starlight-github-alerts)
Updates `starlight-links-validator` from 0.25.1 to 0.25.2
- [Release notes](https://github.com/HiDeoo/starlight-links-validator/releases)
- [Changelog](https://github.com/HiDeoo/starlight-links-validator/blob/main/packages/starlight-links-validator/CHANGELOG.md)
- [Commits](https://github.com/HiDeoo/starlight-links-validator/commits/starlight-links-validator@0.25.2/packages/starlight-links-validator)
Updates `starlight-llms-txt` from 0.10.0 to 0.11.0
- [Release notes](https://github.com/delucis/starlight-llms-txt/releases)
- [Changelog](https://github.com/delucis/starlight-llms-txt/blob/main/packages/starlight-llms-txt/CHANGELOG.md)
- [Commits](https://github.com/delucis/starlight-llms-txt/commits/starlight-llms-txt@0.11.0/packages/starlight-llms-txt)
Updates `starlight-page-actions` from 0.6.2 to 0.7.0
- [Release notes](https://github.com/dlcastillop/starlight-page-actions/releases)
- [Commits](https://github.com/dlcastillop/starlight-page-actions/commits/v0.7.0/packages/starlight-page-actions)
Updates `@iconify-json/material-icon-theme` from 1.2.68 to 1.2.69
- [Commits](https://github.com/iconify/icon-sets/commits)
Updates `@types/hast` from 3.0.4 to 3.0.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/hast)
Updates `@unocss/astro` from 66.6.8 to 66.7.5
- [Release notes](https://github.com/unocss/unocss/releases)
- [Commits](https://github.com/unocss/unocss/commits/v66.7.5/packages-integrations/astro)
Updates `astro-embed` from 0.13.0 to 0.13.1
- [Release notes](https://github.com/delucis/astro-embed/releases)
- [Changelog](https://github.com/delucis/astro-embed/blob/main/packages/astro-embed/CHANGELOG.md)
- [Commits](https://github.com/delucis/astro-embed/commits/astro-embed@0.13.1/packages/astro-embed)
Updates `eslint` from 10.6.0 to 10.7.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.6.0...v10.7.0)
Updates `prettier` from 3.9.1 to 3.9.5
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.1...3.9.5)
Updates `tsx` from 4.22.4 to 4.23.1
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.22.4...v4.23.1)
Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)
Updates `typescript-eslint` from 8.62.0 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint)
Updates `unocss` from 66.6.8 to 66.7.5
- [Release notes](https://github.com/unocss/unocss/releases)
- [Commits](https://github.com/unocss/unocss/commits/v66.7.5/packages-presets/unocss)
Updates `vitest` from 4.1.9 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)
---
updated-dependencies:
- dependency-name: "@astrojs/markdown-remark"
dependency-version: 7.2.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@astrojs/mdx"
dependency-version: 7.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@astrojs/rss"
dependency-version: 4.0.19
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@astrojs/starlight"
dependency-version: 0.41.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@catppuccin/starlight"
dependency-version: 2.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: "@expressive-code/plugin-collapsible-sections"
dependency-version: 0.44.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@expressive-code/plugin-line-numbers"
dependency-version: 0.44.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@fontsource-variable/fira-code"
dependency-version: 5.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: "@fontsource-variable/outfit"
dependency-version: 5.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: "@fontsource-variable/rubik"
dependency-version: 5.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: "@fontsource/poppins"
dependency-version: 5.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: asciinema-player
dependency-version: 3.17.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: astro
dependency-version: 7.1.3
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: astro-expressive-code
dependency-version: 0.44.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: satori
dependency-version: 0.28.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: satteri
dependency-version: 0.9.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: sharp
dependency-version: 0.35.3
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: starlight-github-alerts
dependency-version: 0.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: starlight-links-validator
dependency-version: 0.25.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: starlight-llms-txt
dependency-version: 0.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: starlight-page-actions
dependency-version: 0.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: "@iconify-json/material-icon-theme"
dependency-version: 1.2.69
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@types/hast"
dependency-version: 3.0.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@unocss/astro"
dependency-version: 66.7.5
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: astro-embed
dependency-version: 0.13.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: eslint
dependency-version: 10.7.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: prettier
dependency-version: 3.9.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: tsx
dependency-version: 4.23.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: typescript
dependency-version: 7.0.2
dependency-type: direct:development
update-type: version-update:semver-major
dependency-group: npm-all
- dependency-name: typescript-eslint
dependency-version: 8.65.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: unocss
dependency-version: 66.7.5
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: vitest
dependency-version: 4.1.10
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: npm-all
...
Signed-off-by: dependabot[bot] <support@github.com>
* fix: revert typescript 7.x to 6.x to restore twoslash/expressive-code compatibility
TypeScript 7.0 ('Corsa') is a native Go rewrite that removes the programmatic
JS API entirely. twoslash accesses ts.ModuleKind.Cjs which is undefined in TS7,
causing ec.config.mjs -> expressive-code-twoslash -> twoslash to crash at build
time with: 'The requested module expressive-code-twoslash does not provide an
export named default' and related CJS/ESM resolution failures.
Fix:
- Revert typescript ^7.0.2 -> ^6.0.3 in package.json
- Update pnpm-lock.yaml: swap integrity hash, version specifier, remove the
@typescript/typescript-* platform-native binaries (TS7-only), and fix all
peer-dep snapshot keys to reference typescript@6.0.3
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* fix(frontend): skip canonicalizing redirects while prerendering
Astro 7.1 runs middleware while prerendering the .md/.json API and schema endpoints, so the trailing-slash redirects were baked into dist/ as redirect stubs that shadowed the real prerendered markdown/JSON and broke the api-markdown-routes and schema-routes E2E checks. Guard the redirects behind context.isPrerendered so they only apply to on-demand (SSR/dev) requests.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 572347d9-75da-4b54-9a3d-f9589ef4e39b
* fix(security): bump dompurify to 3.4.12 (GHSA-c2j3-45gr-mqc4) and tighten brace-expansion override
- dompurify@<3.4.12: '>=3.4.12' — GHSA-c2j3-45gr-mqc4 (low): bypass in
CUSTOM_ELEMENT_HANDLING, fixed in 3.4.12
- brace-expansion@<5.0.7: '>=5.0.7' — GHSA-3jxr-9vmj-r5cp (high): DoS via
exponential-time expansion, 5.0.7 is the patched version
- postcss@8.5.20 already satisfies GHSA-r28c-9q8g-f849 (<=8.5.17) via existing
override; no change needed
- GHSA-mh99-v99m-4gvg (brace-expansion <=5.0.7): no upstream fix available,
documented as unfixable in canonical PR body
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 572347d9-75da-4b54-9a3d-f9589ef4e39b
* Redact connection-string passwords in generated package docs (#1410)
* Redact connection-string passwords in generated package docs
PackageJsonGenerator copies package XML doc comments verbatim into the frontend
data JSON. Several packages document example connection strings containing a
literal placeholder password (e.g. SqlServer's GetConnectionString returns
"Server=host,port;User ID=sa;Password=password;TrustServerCertificate=true").
These are not real secrets, but the literal Password=<value> token trips 1ES /
CredScan push protection (SEC101/037 SqlLegacyCredentials, VS403654) when the
public repo is mirrored to the internal AzDO remote, blocking the deploy and
deploy-vnext-release branch syncs.
Add DocumentationSanitizer.RedactConnectionStringPasswords, applied to text,
inline-code and code-block doc nodes, which rewrites connection-string
Password=/Pwd= literals to <password>. C# default parameter values
(password = null) are left untouched because the match requires no whitespace
around '='. Regenerate the four affected data files accordingly.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4125af76-bbc2-4532-adee-98add8fdb6b7
* Address PR review: markdown-safe placeholder, cover example nodes, nullable API
- Use "{password}" instead of "<password>". Angle brackets are dropped as raw
HTML when doc nodes render to Markdown (csharp-api-markdown.ts concatenates
text without escaping), which would hide the value in connection-string
examples. "{password}" is also the existing placeholder convention already
used across the generated data (e.g. mysql://{user}:{password}@{host}).
- Sanitize the <example> extraction paths in ExtractDocExample (plain-text
code, description text nodes, and example code) so connection-string
passwords there cannot re-trigger CredScan in future data refreshes.
- Make DocumentationSanitizer.RedactConnectionStringPasswords nullable-aware
(string? in/out) to match its behavior and drop the null-forgiving operator
in tests. Exclude '{'/'}' from the value class to keep redaction idempotent.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4125af76-bbc2-4532-adee-98add8fdb6b7
* Use "Placeholder" redaction token per 1ES recommendation
The connection-string password sanitizer redacted values to `{password}`.
Switch the token to a bare `Placeholder`, which is the value 1ES
recommends for scrubbed credential examples in generated content.
Update the sanitizer unit-test expectations to match, and update the four
affected package data files. The pre-existing `{password}` doc template
tokens in those files (author-written placeholders, not sanitizer output)
are intentionally left unchanged.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8c2fe46b-fcb4-48bf-8c62-5f9d3d7a470e
* fix(PackageJsonGenerator): tighten redaction regex and close doc gaps
Two hardening fixes to the connection-string password redaction added in
this PR.
F1 - the redaction regex over-consumed trailing delimiters. The value
character class only excluded ';', quotes, comma, whitespace, backslash,
and brace/angle markers. A value immediately followed by a markdown or
URI delimiter ('`', ')', ']', '&', '|') swallowed that delimiter into the
match, so an inline-code fence lost its closing backtick and a link label
lost its closing paren, corrupting the rendered doc. The class now also
stops at those delimiters. A trailing sentence period is preserved by
trimming it off the captured value in the replacement callback rather
than excluding '.' from the class, which would truncate legitimate dotted
values.
F4 - two documentation paths reached the generated JSON unsanitized. Enum
member descriptions (Description = ExtractSummary(f)) and <see href="...">
link labels were emitted verbatim, so a connection string in an enum
member's <summary> or a link label bypassed redaction. Both now run
through the sanitizer. This changes no committed data (no such values
exist in the current package set); the fix is preventive.
Also refreshes the sanitizer comment and XML docs to describe the
Placeholder token and the widened exclusion set.
Tests: added markdown/URI delimiter and trailing-period cases to the
sanitizer unit tests, and an end-to-end test asserting an enum member
whose summary contains a connection string is redacted in the generated
JSON. All 31 tests pass.
chore: sanitize placeholder connection strings in generated pkg JSON
**BYPASS_SECRET_SCANNING** — false-positive SEC101/037 placeholder in
generated pkgs/*.json, unblocking the internal mirror for historical
commit 6058fcf. Forward fix regenerates the affected files.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8c2fe46b-fcb4-48bf-8c62-5f9d3d7a470e
---------
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Ankit Jain <radical@gmail.com>
Copilot-Session: 4125af76-bbc2-4532-adee-98add8fdb6b7
Copilot-Session: 8c2fe46b-fcb4-48bf-8c62-5f9d3d7a470e
* fix: Normalize terminology in sample updates (#1397)
* fix: Normalize terminology in sample updates
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: febf329c-97d8-41aa-bd42-43273bc57fe7
* test: Preserve spacing in terminology updates
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: febf329c-97d8-41aa-bd42-43273bc57fe7
* fix: Handle Markdown wrappers and word boundaries in terminology normalizer
Address review feedback on #1397:
- Require .NET to sit at a non-word boundary so tokens like ASP.NET Aspire and Microsoft.NET Aspire are left intact instead of corrupted into ASPAspire / MicrosoftAspire.
- Consume Markdown emphasis/link openers (**, [) between the article and the term so 'a **.NET Aspire**' and 'a [.NET Aspire](url)' correct the article to 'an'.
- Add regression tests for bold/link article correction and word-boundary cases.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 020561bf-2df6-4f8b-a730-1c72d0f6cc5e
* refactor: Make terminology normalizer data-driven
Replace the hardcoded replace-chain with a small TerminologyRule table so a new deprecated term is a single entry (pattern/replacement/optional article). Article correction, Markdown-wrapper tolerance, and word-boundary guarding are now applied generically per rule.
Also add the 'dotnet aspire' -> 'Aspire' rule that was present in .github/forbidden-words.json but missing from the normalizer, and cover it with tests.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 020561bf-2df6-4f8b-a730-1c72d0f6cc5e
* fix: Bound terminology terms by alphanumeric edges and cover Markdown wrappers
Replaces the per-rule mix of \\b\/\(?<!\w)\ boundaries with uniform alphanumeric edge guards applied centrally, so a rule core can never fuse into a longer token (e.g. \.NET AspireX\) and authors cannot forget a boundary. Underscore and inline-code wrappers now normalize correctly (\_.NET Aspire_\, \\.NET Aspire\\), and the generated-data invariant now covers the \dotnet aspire\ spelling.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 020561bf-2df6-4f8b-a730-1c72d0f6cc5e
* fix: Skip code regions and leave C# untouched in terminology normalizer
The normalizer ran a plain pass over raw Markdown and appHostCode, which could rewrite runnable sample commands (e.g. 'dotnet aspire run' -> 'Aspire run') inside fenced/inline code and corrupt compilable C#. Now fenced blocks and inline code are copied through verbatim, appHostCode is left untouched (it renders as C#, not prose), and the entry point is null-safe. Adds code-skip, mixed prose+code, idempotence, and null tests, and replaces the deprecated-term scan with an idempotence-based invariant.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 020561bf-2df6-4f8b-a730-1c72d0f6cc5e
---------
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: febf329c-97d8-41aa-bd42-43273bc57fe7
Copilot-Session: 020561bf-2df6-4f8b-a730-1c72d0f6cc5e
* Switch cookie consent runtime to WCP API (#1403)
* Switch cookie consent runtime to WCP API
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Theme WCP consent UI, add scroll-lock, prune obsolete cookie tests
Fully restyle the WCP cookie banner and preferences dialog to match the
Aspire theme via the team-owned wcp-consent.css (our colors, spacing,
WCAG AA contrast, and the brand icon). The dialog now re-themes live when
the user toggles light/dark, and the underlying page is scroll-locked
while the preferences dialog is open.
Remove the last remnants of the old vanilla-cookieconsent integration:
- delete config/cookie.config.ts and the old cookieconsent-custom.css
- drop @jop-software/astro-cookieconsent + vanilla-cookieconsent deps
- remove the 2 obsolete behavioral cookie e2e tests and their dead
helpers; the WCP banner is geo-gated/CDN-loaded and can't be exercised
in CI, so compliance is verified by the WCP scan instead
- rework the integrations-gallery banner suppression to hide the WCP
banner element instead of pre-seeding the removed cc_cookie shape
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Hide "Manage cookies" buttons where consent isn't required
WCP reports whether consent is required for the visitor's region. Where it
is not (e.g. the US) there is nothing to manage, so hide the four "Manage
cookies" buttons instead of leaving inert controls on the page.
The WCP runtime sets a data-consent-not-required flag on <html> once it
knows the region; a CSS rule hides .cookie-consent-btn when the flag is
present. The flag is primed from localStorage before paint so returning
visitors in non-required regions don't see the buttons flash in. Defaulting
to visible keeps this failsafe: if WCP is slow or blocked we never hide a
control a required region needs. display:none also makes the site tour
auto-skip its cookie-preferences step, so no tour changes are needed.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Keep header-order e2e test deterministic when consent isn't required
The compact-header-order regression asserts the full set of header
controls, including the "Manage cookies" button. That button is now
region-gated: WCP hides it where consent isn't required, which is how most
CI runner IPs resolve, so the test could see a shorter header and fail.
Block the WCP CDN for this test so it always exercises the failsafe default
(every control present), keeping the expected order stable regardless of
the runner's geo. The site-tour e2e test needs no change; it advances until
"Finish" without counting steps, so it tolerates the cookie step being
skipped.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Address PR review: drop dead consent global, harden WCP init
Two fixes for the Copilot review comments on #1403, both in the WCP
initializer in Head.astro:
- Remove the toLegacyCategories / syncConsentState path that only ever
wrote window.__aspireConsentCategories, a global nothing in the frontend
(or anywhere in the repo) reads. This also drops the astro:page-load
handler and getConsent() calls that existed solely to feed that dead
global, removing a runtime side effect with no consumer.
- Resolve the WCP init theme through toWcpThemeName instead of
dereferencing wcp.themes.dark/light directly. If a future WCP payload
omits or renames themes, the direct access threw, the throw was swallowed
by the surrounding try/catch, and initialization stopped permanently with
no retry. toWcpThemeName already falls back to a plain string, and init
now reschedules itself on exceptions within the existing bounded window.
Validated locally against the WCP CDN: consent still initializes (US ->
consent not required, manage-cookies buttons hidden), the removed global is
now undefined, and there are no console errors.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Address review 4790741647: wire analytics, fix banner overlap + a11y
Implements every point from adamint's review on #1403.
Critical:
- Analytics never loaded under WCP. The three analytics scripts still ship
inert (type="text/plain" data-category="analytics") from the previous
cookie library, but WCP is a consent-collection API and does not manage
script tags, so nothing re-activated them. Head.astro now bridges the gap:
on init it reads siteConsent.getConsent().Analytics and, when granted
(default where consent isn't required, e.g. the US), promotes each inert
script to an executable clone. onConsentChanged reloads, so a later grant
re-applies via the same path. Verified locally: all three scripts flip
from text/plain to active on the US default-grant page.
Accessibility:
- The geo-gated banner is a fixed top strip that painted over the fixed
Starlight header (z-index 10), hiding nav/search (WCAG 2.4.11). A new
ResizeObserver (trackBannerHeight) publishes the banner's live height as
--wcp-banner-height, and CSS translates .page (the body-level wrapper that
contains every fixed control) down by that amount only while the banner is
in the DOM. It is a no-op with no banner (0px), so the US is unaffected.
Verified: injecting a 60px banner shifts the header to top:60 uncovered.
- Reject / Manage-cookies ghost buttons used a 30% border that failed WCAG
1.4.11 non-text contrast (1.90:1 light / 2.70:1 dark). Bumped to 55%
(3.73:1 / 5.82:1) on the banner and the dialog reset button.
Cleanups:
- Guard openManageConsent so preventDefault only fires when WCP's dialog
actually opened, not on every click.
- Replace the dead `theme-changed` CustomEvent (WCP has no such listener)
with the real re-theme hook, siteConsent.applyTheme(themeObject), driven
by the existing data-theme observer.
- Register onConsentChanged once via init's callback argument; drop the
redundant siteConsent.onConsentChanged(...) call that double-registered it
(WCP stores callbacks in a list, so it fired two reloads per change).
- Refresh the Cookie Consent + screenshot sections of astro.instructions.md
to describe WCP (geo-gated top strip, Accept/Reject/More info, MSCC
cookie) instead of the removed jop-software library.
- Drop the dead E2E_TESTS env (read nowhere) from frontend-build.yml and the
two playwright configs, plus the stale cookie.config.ts comment.
Tests:
- Restore the consent regression coverage adamint flagged as deleted. New
tests/e2e/cookie-consent.spec.ts stubs window.WcpConsent (blocking the real
CDN) so it can assert the behavior that only exists at runtime: analytics
scripts are promoted from inert to executable when Analytics consent is
granted, stay inert when it is withheld, and every server-rendered
manage-cookies control routes a click to siteConsent.manageConsent(). Green
across the desktop, tablet, and mobile projects.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Fix WCP analytics ordering and applyTheme arg (review 4797687282)
adamint's CHANGES_REQUESTED (with JamesNK's two inline notes) caught two real
bugs the e2e stub had masked. Both verified against the live library and fixed.
1. Analytics was dead on the default (US) path. activateAnalyticsScripts()
rebuilds each inert script with document.createElement('script') but never
reset `async`. Dynamically-created scripts default to async=true and the
copied `defer` is a no-op for them, so the two tiny same-origin scripts
(1ds.js, track.js) won the race against the ~140 KB 1DS SDK and each bailed
silently (1ds.js returns without `oneDS`; track.js returns without
`window.analytics.__initialized`). Set `next.async = false` so they execute
in insertion (document) order. Since consent isn't required in the US,
Analytics is auto-granted there, so this was most traffic, not an edge case.
2. applyTheme always threw. WCP v2's public `siteConsent.applyTheme(name)`
takes a string theme KEY and looks it up in its internal map; we were
passing `wcp.themes.dark/.light` (an object), so `this.themes[object]` was
undefined -> "Theme not found error", swallowed by withSiteConsent's
try/catch. resolveWcpTheme now returns the 'dark'|'light' string for both
applyTheme and init, so the WCP-internal re-theme actually runs on toggle.
(init's 5th theme arg is ignored by the current CDN build; our CSS overrides
theme the visible surfaces regardless.)
Tests: strengthen the stub so it can no longer hide either bug and add the
missing coverage adamint flagged.
- applyTheme now validates its argument (string key in the themes map) and
throws otherwise, exactly like the live library; a permissive stub could not
catch a wrong-argument regression.
- New assertion: every promoted analytics script has async===false.
- New test: toggling data-theme drives applyTheme with the string key.
- New test: WCP's onConsentChanged (init's 4th arg, now captured by the stub)
reloads the page — restores the accept/reject-persistence coverage lost with
the old ui-regressions tests.
Verified the strengthened guards fail when either fix is reverted, and pass with
both applied: cookie-consent.spec.ts is 15/15 across desktop/tablet/mobile.
Also:
- Revert an unintended pnpm-lock transitive drift (satteri 0.9.3 -> 0.9.4) so
the lockfile diff is only the removed cookie-consent packages.
- Fix a stale CSS comment: the banner's third action is "More info", not
"Manage cookies".
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
---------
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Clarify third-party link guidelines (#1399)
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f983d401-1730-48ef-a79a-8d398376fcd3
* fix: pin brace-expansion 5.0.8 to address GHSA-mh99-v99m-4gvg (#1412)
Dependabot alert #106: brace-expansion DoS (GHSA-mh99-v99m-4gvg, HIGH).
- Widen the conditional override to brace-expansion@<5.0.8: '>=5.0.8' in
pnpm-workspace.yaml.
- Pin brace-expansion to 5.0.8 in pnpm-lock.yaml (now published to the feed;
integrity sha512-JZyDyq3D4A...), fully clearing the alert. balanced-match
dependency unchanged (4.0.4).
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* fix: normalize Aspire terminology in generated API reference data (#1413)
* fix: normalize Aspire terminology in generated API reference data
The Forbidden Words check fails on the bot's integration-data PRs
(e.g. microsoft/aspire.dev#1411) because the deprecated terms live in
ingestion paths that #1397's normalizer never covered:
- src/data/pkgs/*.json (C# API docs; kind:"text" prose nodes)
- src/data/ts-modules/*.json (TS API docs; description/returns/remarks)
- sample appHostCode (code comments; previously excluded)
#1397 only normalized sample title/description/readme[Raw] and the
integration package description, so regenerated API reference prose and
sample AppHost comments kept reintroducing the deprecated terms verbatim
from upstream XML/JSDoc docs.
This extends normalization to those paths, reusing the single source of
truth in aspire-terminology.ts (kept in sync with
.github/forbidden-words.json):
- aspire-terminology.ts: add normalizeAspireTerminologyInCode(), which
rewrites deprecated terms in code comments only, preserving strings,
char/template literals, and executable code so samples still compile.
- normalize-generated-api-data.ts: format-preserving raw-text pass over
the generated API JSON. Normalizes prose only (kind:"text" nodes and
description/returns/remarks), leaving code/cref/langword nodes and all
.NET-escaped bytes (CRLF, astral \u escapes) byte-for-byte identical.
- update-ts-api.ts: normalize ts-modules before the twoslash bundle is
derived, so aspire.d.ts hover tooltips are normalized too.
- update-integration-data.ps1: normalize pkgs after the C# API generator.
- update-samples.ts: normalize appHostCode comments.
The committed data is already clean (a plain grep over-counts the plural
"app hosts", which the boundary-anchored rule never matches), so this is
a scripts+tests change with no data churn. Adds unit tests for both new
normalizers.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d775be1b-bee3-432e-bbfc-7a4861f3bc05
* fix: preserve commands in code comments
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* fix: preserve nested interpolation strings
Replace the regex comment tokenizer with a stateful scanner so nested C# interpolation strings and raw strings remain byte-for-byte unchanged while adjacent comments are normalized.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a9940fd9-999f-4e50-9192-96c023b14792
* fix: normalize comments inside interpolation expressions
Comments nested inside C# interpolation ({ }) and TypeScript template
${ } expressions previously bypassed terminology normalization: the
scanner advanced past them while skipping the surrounding literal.
Thread a comment-span accumulator through interpolation traversal so
those executable-code comments are normalized while nested string,
char, and raw literals stay byte-for-byte identical. Adds C# and TS
regression cases, including a comment paired with a preserved nested
string literal.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d775be1b-bee3-432e-bbfc-7a4861f3bc05
Copilot-Session: a9940fd9-999f-4e50-9192-96c023b14792
* chore: Update integration data and GitHub stats (8/4/26) (#1424)
* chore: Update integration data and GitHub stats (8/4/26)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* fix: restore AppHost casing in generated API data
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
---------
Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
* Pin compromised Keyv ecosystem releases (#1425)
Add exact pnpm overrides for the 11 malicious releases identified by Snyk without changing the current dependency graph.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4a7187e8-18d4-4432-9c78-4ebb8c25d78e
* Add pr-review skill and .agents/skills README index (#1422)
Adds a code-quality pr-review skill (C#/TypeScript/Astro/HTML/CSS) focused on critical issues and test coverage, plus a README indexing all skills.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Redesign the Aspire landing page experience (#1420)
* Redesign the landing page experience
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
* Landing page UX polish: carousel autoplay, AI sparkle, caret + footer
- DashboardCarousel: replace interval autoplay with a rAF progress engine;
add a bottom-left play/pause button + progress bar (stage presentation),
manual nav drops into paused manual mode, Play resumes from the current
slide. Homepage carousel now autoplays (autoplay={true}).
- HomeAgentBadge: swap the star for the AI sparkle (material-symbols
auto-awesome) with glow/twinkle; enlarge popover text.
- AppHostBuilder: left-align caret on blank lines; move typing-animation
checkbox to the bottom-left under the code box.
- Footer: map disclosure animate open/close with scroll adjustment.
- Update homepage e2e tests for the new autoplay + manual-pause behavior.
NOTE: DashboardCarousel play/pause button + progress bar CSS is not yet
added (renders unstyled). Remaining follow-ups tracked separately.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* Style dashboard carousel playback controls + freeze progress on pause
- Add CSS for the bottom-left play/pause button (matching the model-story
toggle, dark/purple stage palette) and the under-image progress bar,
gated to the stage presentation via [data-playback='on'].
- Raise the in-stage button above the active slide (z-index 120) so a real
pointer click hits the button instead of the image/zoom target.
- Freeze the progress fill at its current fraction while paused instead of
resetting to 0, so Play resumes visually from where it stopped.
- Add en i18n keys landing.dashboardCarousel.play/.pause (other locales
fall back to English via tt()).
Verified live: autoplay advances, progress fills, play/pause toggles and
swaps icons, manual nav drops into paused manual mode, Play resumes; no
console errors; controls hidden on the coverflow (docs) presentation.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* Polish mobile radar, footer bottom row, and slow carousel
- HomeEnvironment: on mobile, lift the bottom-left database resource clear
of the pause control and tuck the floating nodes closer to the radar's
extending lines (verified across Local/Test/Production at 390px and 360px).
- Footer: stack the bottom row (copyright / "Made with love" / SHA) into a
single left-aligned column at <=52rem so the items align cleanly on
mobile/tablet and the SHA no longer collides with the scroll-to-top button.
- DashboardCarousel: slow autoplay cadence from 5.5s to 7s per slide.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* Emulate dashboard, realistic terminal, and lightbox nav
Polish the landing page "one application model" (glue-work) section and the
dashboard carousel:
- Replace the static dashboard screenshot in the glue-work section with an
animated, emulated resources table that mirrors the real Aspire dashboard:
rows come online staggered (Starting -> Running), URLs fade in, and a live
"N of 4 resources running" counter tracks progress. Snaps to the final
running state on manual tab selection or reduced motion.
- Rewrite the model-story terminal to faithful `aspire run` output: build and
start status lines plus the AppHost / Dashboard / Logs summary grid with a
login-token dashboard URL. Long lines now wrap on narrow viewports instead of
clipping.
- Add prev/next navigation to the dashboard carousel's zoom lightbox. Arrow
buttons (and Left/Right keys) flip through every view without unzooming; the
carousel rests on the last-viewed slide when the lightbox closes. Buttons are
theme-aware and respect reduced motion.
- Vary a repetitive AI badge label and drop the redundant environment tab
underline animation.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* Enlarge AppHost code panel font to match other model-story tabs
The AppHost code snippet rendered at a much smaller font than the
Topology and Dashboard panels, making it hard to read. Bump the code
font/line-height to match the dashboard panel (clamp(0.74rem, 1.15vw,
0.86rem)), trim the padding, and grow the model-story stage height
(clamp(24rem, 37vw, 28rem)) so the 17-line TypeScript variant still
fits without clipping. Also enlarge the mobile code font accordingly.
Verified across 384-1440px in both themes: code font now matches the
dashboard exactly with no vertical clipping; Topology and Dashboard
tabs still look good with the extra room.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* Clean up redesigned landing page: remove dead components, localize, a11y
Final cleanup pass on the landing-page redesign:
- Delete 7 unused legacy homepage components (FreeAndOpenSourceAside +
quotes data, IntegrationGrid, LanguagesSupported, LocalVsProdEnvironments,
SimpleCard, TestimonialCarousel) and drop their unit/e2e/prop-contract tests.
- Render the redesigned <HomePage /> from every locale index.mdx and switch the
Starlight hero to isHomepage() so the new hero shows on all locale homepages.
- Add a localized `home` i18n namespace to en.json and translate it into all
14 locales (115 strings each), preserving {{placeholders}} and <strong> markup.
- Add a localizedHref() helper for locale-aware internal links.
- Accessibility: switch the model-story code block to Expressive Code for WCAG AA
contrast in both themes, add Escape-dismiss to the agent-badge tooltip
(WCAG 1.4.13), and keep decorative regions fully out of the tab order.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* Polish announcement banner styles
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Complete landing page redesign refinements
Finish the runtime story, responsive motion gating, dashboard media, accessible custom selects, localized shared controls, and regression coverage across the landing experience.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
* Fix homepage CI rendering
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
* Harden homepage E2E checks
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
* Relocate carousel playback control and glide slides
Move the stage playback button into the footer controls row so it sits bottom-left alongside the prev/next buttons, and remove the redundant visible slide description. Add a directional transform + opacity transition so views glide between slides instead of hard-cutting.
Update the homepage dashboard-tour e2e test to match: assert the playback button shares the controls row (left of prev/next), the slide description is gone, and the active slide animates.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address landing-page review: fix CustomSelect scroll close, freeze dashboard on pause, localize carousel play/pause
- CustomSelect: ignore scroll events originating inside the fixed listbox so scrolling the menu (wheel/touch or keyboard scrollIntoView) no longer dismisses it, keeping below-the-fold locales reachable while preserving close-on-page-scroll/resize.
- HomePage: clearDashTimers() in pause() so the emulated dashboard stops populating while the runtime story is paused.
- i18n: add translated dashboardCarousel.play/.pause to all 14 non-English locales.
- e2e: add regression test that scrolls inside the language listbox and pages to the last option, asserting the menu stays open.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix homepage testing link
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
* Refine landing page feedback
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
---------
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* docs: add trusted repository CLI guidance (#1426)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 937c958a-8043-40ee-8c89-4395dc892a57
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: James Newton-King <james@newtonking.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Ankit Jain <radical@gmail.com>
Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com>
Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Adam Ratzman <adam@adamratzman.com>
Co-authored-by: Jose Perez Rodriguez <joperezr@microsoft.com>
Copilot-Session: 572347d9-75da-4b54-9a3d-f9589ef4e39b
Copilot-Session: 4125af76-bbc2-4532-adee-98add8fdb6b7
Copilot-Session: 8c2fe46b-fcb4-48bf-8c62-5f9d3d7a470e
Copilot-Session: febf329c-97d8-41aa-bd42-43273bc57fe7
Copilot-Session: 020561bf-2df6-4f8b-a730-1c72d0f6cc5e
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
Copilot-Session: f983d401-1730-48ef-a79a-8d398376fcd3
Copilot-Session: d775be1b-bee3-432e-bbfc-7a4861f3bc05
Copilot-Session: a9940fd9-999f-4e50-9192-96c023b14792
Copilot-Session: 4a7187e8-18d4-4432-9c78-4ebb8c25d78e
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
Copilot-Session: 937c958a-8043-40ee-8c89-4395dc892a57
Copilot-Session: 58ba82e5-9eb1-4c4b-8e6f-230ea7cbaef7
…1433) Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Updates the Aspire VS Code extension docs to reflect the renamed 'Aspire: Install Aspire CLI' command (previously 'Aspire: Install Aspire CLI (stable)'), which now shows a package-manager picker plus a daily build option. Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ns (#1435) Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ean (#1436) Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com>
…1439) Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add docs for Aspire.Hosting.Dotnet integration Adds new integration docs for the Aspire.Hosting.Dotnet hosting integration (AddDotnetProject / addDotnetProject), which lets AppHosts add C# projects and file-based C# apps by path, as the C# peer of the Go/Python/JavaScript hosting integrations. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix ExecutableResource documentation link --------- Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: David Pine <david.pine@microsoft.com>
Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com>
…ssistant removal (#1442) * docs: remove stale Dashboard:AI:Disabled config entry and document AI Assistant removal * Remove obsolete dashboard AI environment setting * Remove obsolete dashboard AI setting from Japanese reference * Keep AI Assistant removal docs scoped to configuration * Restore release notes formatting --------- Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: David Pine <david.pine@microsoft.com>
…#1444) Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ronments (#1443) * Document WithUniqueResourceNaming for Azure Container App environments Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix diagnostic link trailing slash Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 32c349b4-907d-42e9-aad8-2f0edc267779 --------- Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: David Pine <david.pine@microsoft.com> Copilot-Session: 32c349b4-907d-42e9-aad8-2f0edc267779
Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* docs: document Linux dev certificate trust improvements Document the aspire doctor OpenSSL development certificate cache checks and the Linux system trust preservation for Append-mode certificate trust, introduced in microsoft/aspire#18851. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Clarify SSL_CERT_DIR source environment Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 32c349b4-907d-42e9-aad8-2f0edc267779 --------- Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: David Pine <david.pine@microsoft.com> Copilot-Session: 32c349b4-907d-42e9-aad8-2f0edc267779
…#1447) Documents microsoft/aspire#18867 Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
#1449) Documents changes from microsoft/aspire#19081 Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…1450) Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com>
…age (#1466) * Fix TypeScript withEndpointsInEnvironment docs (#1464) The TypeScript tab of the "Filter endpoints in environment variables" section incorrectly stated the TypeScript AppHost doesn't expose `WithEndpointsInEnvironment`. It does, via the ATS-friendly array overload `withEndpointsInEnvironment(endpointNames: string[])`. Replace the note with the allow-list form and an example, calling out that the TypeScript overload includes the named endpoints (inverse of the C# predicate, which excludes them). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: David Pine <david.pine@microsoft.com> --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The C# sample referenced a non-existent `TunnelId` member, assigned a `string[]` to the `List<string>?` `Labels` property, and passed `DevTunnelOptions` into the `string? tunnelId` positional parameter, so it did not compile. Fix it to set `tunnelId`/`options` as named arguments on `AddDevTunnel` and use a collection expression for `Labels`. The TypeScript sample passed an options object, but the polyglot `addDevTunnel(name, tunnelId?, allowAnonymous?, description?, labels?)` export takes positional parameters. Update it to match the exported signature. Document the C#-only `Region` (`DevTunnelOptions`) property, which the options table previously omitted. Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…age (#1458) * Document WithLaunchToolArgs in ASPIREEXTENSION001 diagnostic page Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update src/frontend/src/content/docs/diagnostics/aspireextension001.mdx Co-authored-by: Karol Zadora-Przylecki <karolz@microsoft.com> --------- Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: David Pine <david.pine@microsoft.com> Co-authored-by: Karol Zadora-Przylecki <karolz@microsoft.com>
Document the environment-check and installation-discovery timeouts and note that aspire doctor reports a warning when a timeout occurs.
…oggle (#1485) Documents changes from microsoft/aspire#19303: the Aspire Skills bundle full-file integrity checks now use SHA-512 (previously SHA-256), and the aspireSkillsRemoteFetchEnabled preview toggle is hidden from aspire config output and the generated VS Code settings schemas. Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…1467) * docs: correct custom resource command CLI args to named options Custom resource command arguments are exposed by the CLI as named `--<name>` options (with kebab-case aliases), not ordered positional values. Update the "Command arguments" intro, the InteractionInput InputType CLI behavior column, and the "Pass arguments from the CLI" section to match ResourceCommand.cs behavior, including the required-option error message. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: address review feedback on resource command CLI arguments - Boolean CLI behavior: document the optional explicit value (`--<name>` sets `true`, or `--<name> <value>`) instead of a presence-only flag. - Attribute Number/Boolean parsing and built-in validation to the CLI, which forwards string values to the AppHost (not the other way around). - Note that argument option names that collide with an Aspire CLI option (for example `--log-level` or `--apphost`) must be passed after a `--` delimiter to reach the command. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Revise interaction service API documentation (#1408)
Updated section headings and clarified usage instructions for the interaction service API.
* [auto-sec] Consolidate aspire.dev frontend dependency security remediations (#1392)
* build(deps): bump the npm-all group across 1 directory with 32 updates
Bumps the npm-all group with 32 updates in the /src/frontend directory:
| Package | From | To |
| --- | --- | --- |
| [@astrojs/markdown-remark](https://github.com/withastro/astro/tree/HEAD/packages/markdown/remark) | `7.2.0` | `7.2.1` |
| [@astrojs/mdx](https://github.com/withastro/astro/tree/HEAD/packages/integrations/mdx) | `7.0.0` | `7.0.3` |
| [@astrojs/rss](https://github.com/withastro/astro/tree/HEAD/packages/astro-rss) | `4.0.18` | `4.0.19` |
| [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.1` | `0.41.3` |
| [@catppuccin/starlight](https://github.com/catppuccin/starlight/tree/HEAD/packages/catppuccin-starlight) | `2.0.1` | `2.1.0` |
| [@expressive-code/plugin-collapsible-sections](https://github.com/expressive-code/expressive-code/tree/HEAD/packages/@expressive-code/plugin-collapsible-sections) | `0.44.0` | `0.44.1` |
| [@expressive-code/plugin-line-numbers](https://github.com/expressive-code/expressive-code/tree/HEAD/packages/@expressive-code/plugin-line-numbers) | `0.44.0` | `0.44.1` |
| [@fontsource-variable/fira-code](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/fira-code) | `5.2.7` | `5.3.0` |
| [@fontsource-variable/outfit](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/outfit) | `5.2.8` | `5.3.0` |
| [@fontsource-variable/rubik](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/rubik) | `5.2.8` | `5.3.0` |
| [@fontsource/poppins](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/poppins) | `5.2.7` | `5.3.0` |
| [asciinema-player](https://github.com/asciinema/asciinema-player) | `3.16.0` | `3.17.0` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.0.3` | `7.1.3` |
| [astro-expressive-code](https://github.com/expressive-code/expressive-code/tree/HEAD/packages/astro-expressive-code) | `0.44.0` | `0.44.1` |
| [satori](https://github.com/vercel/satori) | `0.26.0` | `0.28.1` |
| [satteri](https://github.com/bruits/satteri) | `0.9.4` | `0.9.5` |
| [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.3` |
| [starlight-github-alerts](https://github.com/HiDeoo/starlight-github-alerts/tree/HEAD/packages/starlight-github-alerts) | `0.3.0` | `0.4.0` |
| [starlight-links-validator](https://github.com/HiDeoo/starlight-links-validator/tree/HEAD/packages/starlight-links-validator) | `0.25.1` | `0.25.2` |
| [starlight-llms-txt](https://github.com/delucis/starlight-llms-txt/tree/HEAD/packages/starlight-llms-txt) | `0.10.0` | `0.11.0` |
| [starlight-page-actions](https://github.com/dlcastillop/starlight-page-actions/tree/HEAD/packages/starlight-page-actions) | `0.6.2` | `0.7.0` |
| [@iconify-json/material-icon-theme](https://github.com/iconify/icon-sets) | `1.2.68` | `1.2.69` |
| [@types/hast](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/hast) | `3.0.4` | `3.0.5` |
| [@unocss/astro](https://github.com/unocss/unocss/tree/HEAD/packages-integrations/astro) | `66.6.8` | `66.7.5` |
| [astro-embed](https://github.com/delucis/astro-embed/tree/HEAD/packages/astro-embed) | `0.13.0` | `0.13.1` |
| [eslint](https://github.com/eslint/eslint) | `10.6.0` | `10.7.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.1` | `3.9.5` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.4` | `4.23.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.62.0` | `8.65.0` |
| [unocss](https://github.com/unocss/unocss/tree/HEAD/packages-presets/unocss) | `66.6.8` | `66.7.5` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.9` | `4.1.10` |
Updates `@astrojs/markdown-remark` from 7.2.0 to 7.2.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/markdown/remark/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/markdown-remark@7.2.1/packages/markdown/remark)
Updates `@astrojs/mdx` from 7.0.0 to 7.0.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/mdx/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/mdx@7.0.3/packages/integrations/mdx)
Updates `@astrojs/rss` from 4.0.18 to 4.0.19
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro-rss/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/rss@4.0.19/packages/astro-rss)
Updates `@astrojs/starlight` from 0.41.1 to 0.41.3
- [Release notes](https://github.com/withastro/starlight/releases)
- [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
- [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.3/packages/starlight)
Updates `@catppuccin/starlight` from 2.0.1 to 2.1.0
- [Release notes](https://github.com/catppuccin/starlight/releases)
- [Changelog](https://github.com/catppuccin/starlight/blob/main/packages/catppuccin-starlight/CHANGELOG.md)
- [Commits](https://github.com/catppuccin/starlight/commits/v2.1.0/packages/catppuccin-starlight)
Updates `@expressive-code/plugin-collapsible-sections` from 0.44.0 to 0.44.1
- [Release notes](https://github.com/expressive-code/expressive-code/releases)
- [Changelog](https://github.com/expressive-code/expressive-code/blob/main/packages/@expressive-code/plugin-collapsible-sections/CHANGELOG.md)
- [Commits](https://github.com/expressive-code/expressive-code/commits/@expressive-code/plugin-collapsible-sections@0.44.1/packages/@expressive-code/plugin-collapsible-sections)
Updates `@expressive-code/plugin-line-numbers` from 0.44.0 to 0.44.1
- [Release notes](https://github.com/expressive-code/expressive-code/releases)
- [Changelog](https://github.com/expressive-code/expressive-code/blob/main/packages/@expressive-code/plugin-line-numbers/CHANGELOG.md)
- [Commits](https://github.com/expressive-code/expressive-code/commits/@expressive-code/plugin-line-numbers@0.44.1/packages/@expressive-code/plugin-line-numbers)
Updates `@fontsource-variable/fira-code` from 5.2.7 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/fira-code)
Updates `@fontsource-variable/outfit` from 5.2.8 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/outfit)
Updates `@fontsource-variable/rubik` from 5.2.8 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/rubik)
Updates `@fontsource/poppins` from 5.2.7 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/poppins)
Updates `asciinema-player` from 3.16.0 to 3.17.0
- [Release notes](https://github.com/asciinema/asciinema-player/releases)
- [Commits](https://github.com/asciinema/asciinema-player/compare/v3.16.0...v3.17.0)
Updates `astro` from 7.0.3 to 7.1.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.3/packages/astro)
Updates `astro-expressive-code` from 0.44.0 to 0.44.1
- [Release notes](https://github.com/expressive-code/expressive-code/releases)
- [Changelog](https://github.com/expressive-code/expressive-code/blob/main/packages/astro-expressive-code/CHANGELOG.md)
- [Commits](https://github.com/expressive-code/expressive-code/commits/astro-expressive-code@0.44.1/packages/astro-expressive-code)
Updates `satori` from 0.26.0 to 0.28.1
- [Release notes](https://github.com/vercel/satori/releases)
- [Commits](https://github.com/vercel/satori/compare/0.26.0...0.28.1)
Updates `satteri` from 0.9.4 to 0.9.5
- [Release notes](https://github.com/bruits/satteri/releases)
- [Commits](https://github.com/bruits/satteri/compare/satteri-v0.9.4...satteri-v0.9.5)
Updates `sharp` from 0.34.5 to 0.35.3
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](https://github.com/lovell/sharp/compare/v0.34.5...v0.35.3)
Updates `starlight-github-alerts` from 0.3.0 to 0.4.0
- [Release notes](https://github.com/HiDeoo/starlight-github-alerts/releases)
- [Changelog](https://github.com/HiDeoo/starlight-github-alerts/blob/main/packages/starlight-github-alerts/CHANGELOG.md)
- [Commits](https://github.com/HiDeoo/starlight-github-alerts/commits/starlight-github-alerts@0.4.0/packages/starlight-github-alerts)
Updates `starlight-links-validator` from 0.25.1 to 0.25.2
- [Release notes](https://github.com/HiDeoo/starlight-links-validator/releases)
- [Changelog](https://github.com/HiDeoo/starlight-links-validator/blob/main/packages/starlight-links-validator/CHANGELOG.md)
- [Commits](https://github.com/HiDeoo/starlight-links-validator/commits/starlight-links-validator@0.25.2/packages/starlight-links-validator)
Updates `starlight-llms-txt` from 0.10.0 to 0.11.0
- [Release notes](https://github.com/delucis/starlight-llms-txt/releases)
- [Changelog](https://github.com/delucis/starlight-llms-txt/blob/main/packages/starlight-llms-txt/CHANGELOG.md)
- [Commits](https://github.com/delucis/starlight-llms-txt/commits/starlight-llms-txt@0.11.0/packages/starlight-llms-txt)
Updates `starlight-page-actions` from 0.6.2 to 0.7.0
- [Release notes](https://github.com/dlcastillop/starlight-page-actions/releases)
- [Commits](https://github.com/dlcastillop/starlight-page-actions/commits/v0.7.0/packages/starlight-page-actions)
Updates `@iconify-json/material-icon-theme` from 1.2.68 to 1.2.69
- [Commits](https://github.com/iconify/icon-sets/commits)
Updates `@types/hast` from 3.0.4 to 3.0.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/hast)
Updates `@unocss/astro` from 66.6.8 to 66.7.5
- [Release notes](https://github.com/unocss/unocss/releases)
- [Commits](https://github.com/unocss/unocss/commits/v66.7.5/packages-integrations/astro)
Updates `astro-embed` from 0.13.0 to 0.13.1
- [Release notes](https://github.com/delucis/astro-embed/releases)
- [Changelog](https://github.com/delucis/astro-embed/blob/main/packages/astro-embed/CHANGELOG.md)
- [Commits](https://github.com/delucis/astro-embed/commits/astro-embed@0.13.1/packages/astro-embed)
Updates `eslint` from 10.6.0 to 10.7.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.6.0...v10.7.0)
Updates `prettier` from 3.9.1 to 3.9.5
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.1...3.9.5)
Updates `tsx` from 4.22.4 to 4.23.1
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.22.4...v4.23.1)
Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)
Updates `typescript-eslint` from 8.62.0 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint)
Updates `unocss` from 66.6.8 to 66.7.5
- [Release notes](https://github.com/unocss/unocss/releases)
- [Commits](https://github.com/unocss/unocss/commits/v66.7.5/packages-presets/unocss)
Updates `vitest` from 4.1.9 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)
---
updated-dependencies:
- dependency-name: "@astrojs/markdown-remark"
dependency-version: 7.2.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@astrojs/mdx"
dependency-version: 7.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@astrojs/rss"
dependency-version: 4.0.19
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@astrojs/starlight"
dependency-version: 0.41.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@catppuccin/starlight"
dependency-version: 2.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: "@expressive-code/plugin-collapsible-sections"
dependency-version: 0.44.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@expressive-code/plugin-line-numbers"
dependency-version: 0.44.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@fontsource-variable/fira-code"
dependency-version: 5.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: "@fontsource-variable/outfit"
dependency-version: 5.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: "@fontsource-variable/rubik"
dependency-version: 5.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: "@fontsource/poppins"
dependency-version: 5.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: asciinema-player
dependency-version: 3.17.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: astro
dependency-version: 7.1.3
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: astro-expressive-code
dependency-version: 0.44.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: satori
dependency-version: 0.28.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: satteri
dependency-version: 0.9.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: sharp
dependency-version: 0.35.3
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: starlight-github-alerts
dependency-version: 0.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: starlight-links-validator
dependency-version: 0.25.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: starlight-llms-txt
dependency-version: 0.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: starlight-page-actions
dependency-version: 0.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: "@iconify-json/material-icon-theme"
dependency-version: 1.2.69
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@types/hast"
dependency-version: 3.0.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: "@unocss/astro"
dependency-version: 66.7.5
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: astro-embed
dependency-version: 0.13.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: eslint
dependency-version: 10.7.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: prettier
dependency-version: 3.9.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: npm-all
- dependency-name: tsx
dependency-version: 4.23.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: typescript
dependency-version: 7.0.2
dependency-type: direct:development
update-type: version-update:semver-major
dependency-group: npm-all
- dependency-name: typescript-eslint
dependency-version: 8.65.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: unocss
dependency-version: 66.7.5
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-all
- dependency-name: vitest
dependency-version: 4.1.10
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: npm-all
...
Signed-off-by: dependabot[bot] <support@github.com>
* fix: revert typescript 7.x to 6.x to restore twoslash/expressive-code compatibility
TypeScript 7.0 ('Corsa') is a native Go rewrite that removes the programmatic
JS API entirely. twoslash accesses ts.ModuleKind.Cjs which is undefined in TS7,
causing ec.config.mjs -> expressive-code-twoslash -> twoslash to crash at build
time with: 'The requested module expressive-code-twoslash does not provide an
export named default' and related CJS/ESM resolution failures.
Fix:
- Revert typescript ^7.0.2 -> ^6.0.3 in package.json
- Update pnpm-lock.yaml: swap integrity hash, version specifier, remove the
@typescript/typescript-* platform-native binaries (TS7-only), and fix all
peer-dep snapshot keys to reference typescript@6.0.3
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* fix(frontend): skip canonicalizing redirects while prerendering
Astro 7.1 runs middleware while prerendering the .md/.json API and schema endpoints, so the trailing-slash redirects were baked into dist/ as redirect stubs that shadowed the real prerendered markdown/JSON and broke the api-markdown-routes and schema-routes E2E checks. Guard the redirects behind context.isPrerendered so they only apply to on-demand (SSR/dev) requests.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 572347d9-75da-4b54-9a3d-f9589ef4e39b
* fix(security): bump dompurify to 3.4.12 (GHSA-c2j3-45gr-mqc4) and tighten brace-expansion override
- dompurify@<3.4.12: '>=3.4.12' — GHSA-c2j3-45gr-mqc4 (low): bypass in
CUSTOM_ELEMENT_HANDLING, fixed in 3.4.12
- brace-expansion@<5.0.7: '>=5.0.7' — GHSA-3jxr-9vmj-r5cp (high): DoS via
exponential-time expansion, 5.0.7 is the patched version
- postcss@8.5.20 already satisfies GHSA-r28c-9q8g-f849 (<=8.5.17) via existing
override; no change needed
- GHSA-mh99-v99m-4gvg (brace-expansion <=5.0.7): no upstream fix available,
documented as unfixable in canonical PR body
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 572347d9-75da-4b54-9a3d-f9589ef4e39b
* Redact connection-string passwords in generated package docs (#1410)
* Redact connection-string passwords in generated package docs
PackageJsonGenerator copies package XML doc comments verbatim into the frontend
data JSON. Several packages document example connection strings containing a
literal placeholder password (e.g. SqlServer's GetConnectionString returns
"Server=host,port;User ID=sa;Password=password;TrustServerCertificate=true").
These are not real secrets, but the literal Password=<value> token trips 1ES /
CredScan push protection (SEC101/037 SqlLegacyCredentials, VS403654) when the
public repo is mirrored to the internal AzDO remote, blocking the deploy and
deploy-vnext-release branch syncs.
Add DocumentationSanitizer.RedactConnectionStringPasswords, applied to text,
inline-code and code-block doc nodes, which rewrites connection-string
Password=/Pwd= literals to <password>. C# default parameter values
(password = null) are left untouched because the match requires no whitespace
around '='. Regenerate the four affected data files accordingly.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4125af76-bbc2-4532-adee-98add8fdb6b7
* Address PR review: markdown-safe placeholder, cover example nodes, nullable API
- Use "{password}" instead of "<password>". Angle brackets are dropped as raw
HTML when doc nodes render to Markdown (csharp-api-markdown.ts concatenates
text without escaping), which would hide the value in connection-string
examples. "{password}" is also the existing placeholder convention already
used across the generated data (e.g. mysql://{user}:{password}@{host}).
- Sanitize the <example> extraction paths in ExtractDocExample (plain-text
code, description text nodes, and example code) so connection-string
passwords there cannot re-trigger CredScan in future data refreshes.
- Make DocumentationSanitizer.RedactConnectionStringPasswords nullable-aware
(string? in/out) to match its behavior and drop the null-forgiving operator
in tests. Exclude '{'/'}' from the value class to keep redaction idempotent.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4125af76-bbc2-4532-adee-98add8fdb6b7
* Use "Placeholder" redaction token per 1ES recommendation
The connection-string password sanitizer redacted values to `{password}`.
Switch the token to a bare `Placeholder`, which is the value 1ES
recommends for scrubbed credential examples in generated content.
Update the sanitizer unit-test expectations to match, and update the four
affected package data files. The pre-existing `{password}` doc template
tokens in those files (author-written placeholders, not sanitizer output)
are intentionally left unchanged.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8c2fe46b-fcb4-48bf-8c62-5f9d3d7a470e
* fix(PackageJsonGenerator): tighten redaction regex and close doc gaps
Two hardening fixes to the connection-string password redaction added in
this PR.
F1 - the redaction regex over-consumed trailing delimiters. The value
character class only excluded ';', quotes, comma, whitespace, backslash,
and brace/angle markers. A value immediately followed by a markdown or
URI delimiter ('`', ')', ']', '&', '|') swallowed that delimiter into the
match, so an inline-code fence lost its closing backtick and a link label
lost its closing paren, corrupting the rendered doc. The class now also
stops at those delimiters. A trailing sentence period is preserved by
trimming it off the captured value in the replacement callback rather
than excluding '.' from the class, which would truncate legitimate dotted
values.
F4 - two documentation paths reached the generated JSON unsanitized. Enum
member descriptions (Description = ExtractSummary(f)) and <see href="...">
link labels were emitted verbatim, so a connection string in an enum
member's <summary> or a link label bypassed redaction. Both now run
through the sanitizer. This changes no committed data (no such values
exist in the current package set); the fix is preventive.
Also refreshes the sanitizer comment and XML docs to describe the
Placeholder token and the widened exclusion set.
Tests: added markdown/URI delimiter and trailing-period cases to the
sanitizer unit tests, and an end-to-end test asserting an enum member
whose summary contains a connection string is redacted in the generated
JSON. All 31 tests pass.
chore: sanitize placeholder connection strings in generated pkg JSON
**BYPASS_SECRET_SCANNING** — false-positive SEC101/037 placeholder in
generated pkgs/*.json, unblocking the internal mirror for historical
commit 6058fcf. Forward fix regenerates the affected files.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8c2fe46b-fcb4-48bf-8c62-5f9d3d7a470e
---------
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Ankit Jain <radical@gmail.com>
Copilot-Session: 4125af76-bbc2-4532-adee-98add8fdb6b7
Copilot-Session: 8c2fe46b-fcb4-48bf-8c62-5f9d3d7a470e
* fix: Normalize terminology in sample updates (#1397)
* fix: Normalize terminology in sample updates
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: febf329c-97d8-41aa-bd42-43273bc57fe7
* test: Preserve spacing in terminology updates
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: febf329c-97d8-41aa-bd42-43273bc57fe7
* fix: Handle Markdown wrappers and word boundaries in terminology normalizer
Address review feedback on #1397:
- Require .NET to sit at a non-word boundary so tokens like ASP.NET Aspire and Microsoft.NET Aspire are left intact instead of corrupted into ASPAspire / MicrosoftAspire.
- Consume Markdown emphasis/link openers (**, [) between the article and the term so 'a **.NET Aspire**' and 'a [.NET Aspire](url)' correct the article to 'an'.
- Add regression tests for bold/link article correction and word-boundary cases.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 020561bf-2df6-4f8b-a730-1c72d0f6cc5e
* refactor: Make terminology normalizer data-driven
Replace the hardcoded replace-chain with a small TerminologyRule table so a new deprecated term is a single entry (pattern/replacement/optional article). Article correction, Markdown-wrapper tolerance, and word-boundary guarding are now applied generically per rule.
Also add the 'dotnet aspire' -> 'Aspire' rule that was present in .github/forbidden-words.json but missing from the normalizer, and cover it with tests.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 020561bf-2df6-4f8b-a730-1c72d0f6cc5e
* fix: Bound terminology terms by alphanumeric edges and cover Markdown wrappers
Replaces the per-rule mix of \\b\/\(?<!\w)\ boundaries with uniform alphanumeric edge guards applied centrally, so a rule core can never fuse into a longer token (e.g. \.NET AspireX\) and authors cannot forget a boundary. Underscore and inline-code wrappers now normalize correctly (\_.NET Aspire_\, \\.NET Aspire\\), and the generated-data invariant now covers the \dotnet aspire\ spelling.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 020561bf-2df6-4f8b-a730-1c72d0f6cc5e
* fix: Skip code regions and leave C# untouched in terminology normalizer
The normalizer ran a plain pass over raw Markdown and appHostCode, which could rewrite runnable sample commands (e.g. 'dotnet aspire run' -> 'Aspire run') inside fenced/inline code and corrupt compilable C#. Now fenced blocks and inline code are copied through verbatim, appHostCode is left untouched (it renders as C#, not prose), and the entry point is null-safe. Adds code-skip, mixed prose+code, idempotence, and null tests, and replaces the deprecated-term scan with an idempotence-based invariant.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 020561bf-2df6-4f8b-a730-1c72d0f6cc5e
---------
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: febf329c-97d8-41aa-bd42-43273bc57fe7
Copilot-Session: 020561bf-2df6-4f8b-a730-1c72d0f6cc5e
* Switch cookie consent runtime to WCP API (#1403)
* Switch cookie consent runtime to WCP API
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Theme WCP consent UI, add scroll-lock, prune obsolete cookie tests
Fully restyle the WCP cookie banner and preferences dialog to match the
Aspire theme via the team-owned wcp-consent.css (our colors, spacing,
WCAG AA contrast, and the brand icon). The dialog now re-themes live when
the user toggles light/dark, and the underlying page is scroll-locked
while the preferences dialog is open.
Remove the last remnants of the old vanilla-cookieconsent integration:
- delete config/cookie.config.ts and the old cookieconsent-custom.css
- drop @jop-software/astro-cookieconsent + vanilla-cookieconsent deps
- remove the 2 obsolete behavioral cookie e2e tests and their dead
helpers; the WCP banner is geo-gated/CDN-loaded and can't be exercised
in CI, so compliance is verified by the WCP scan instead
- rework the integrations-gallery banner suppression to hide the WCP
banner element instead of pre-seeding the removed cc_cookie shape
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Hide "Manage cookies" buttons where consent isn't required
WCP reports whether consent is required for the visitor's region. Where it
is not (e.g. the US) there is nothing to manage, so hide the four "Manage
cookies" buttons instead of leaving inert controls on the page.
The WCP runtime sets a data-consent-not-required flag on <html> once it
knows the region; a CSS rule hides .cookie-consent-btn when the flag is
present. The flag is primed from localStorage before paint so returning
visitors in non-required regions don't see the buttons flash in. Defaulting
to visible keeps this failsafe: if WCP is slow or blocked we never hide a
control a required region needs. display:none also makes the site tour
auto-skip its cookie-preferences step, so no tour changes are needed.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Keep header-order e2e test deterministic when consent isn't required
The compact-header-order regression asserts the full set of header
controls, including the "Manage cookies" button. That button is now
region-gated: WCP hides it where consent isn't required, which is how most
CI runner IPs resolve, so the test could see a shorter header and fail.
Block the WCP CDN for this test so it always exercises the failsafe default
(every control present), keeping the expected order stable regardless of
the runner's geo. The site-tour e2e test needs no change; it advances until
"Finish" without counting steps, so it tolerates the cookie step being
skipped.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Address PR review: drop dead consent global, harden WCP init
Two fixes for the Copilot review comments on #1403, both in the WCP
initializer in Head.astro:
- Remove the toLegacyCategories / syncConsentState path that only ever
wrote window.__aspireConsentCategories, a global nothing in the frontend
(or anywhere in the repo) reads. This also drops the astro:page-load
handler and getConsent() calls that existed solely to feed that dead
global, removing a runtime side effect with no consumer.
- Resolve the WCP init theme through toWcpThemeName instead of
dereferencing wcp.themes.dark/light directly. If a future WCP payload
omits or renames themes, the direct access threw, the throw was swallowed
by the surrounding try/catch, and initialization stopped permanently with
no retry. toWcpThemeName already falls back to a plain string, and init
now reschedules itself on exceptions within the existing bounded window.
Validated locally against the WCP CDN: consent still initializes (US ->
consent not required, manage-cookies buttons hidden), the removed global is
now undefined, and there are no console errors.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Address review 4790741647: wire analytics, fix banner overlap + a11y
Implements every point from adamint's review on #1403.
Critical:
- Analytics never loaded under WCP. The three analytics scripts still ship
inert (type="text/plain" data-category="analytics") from the previous
cookie library, but WCP is a consent-collection API and does not manage
script tags, so nothing re-activated them. Head.astro now bridges the gap:
on init it reads siteConsent.getConsent().Analytics and, when granted
(default where consent isn't required, e.g. the US), promotes each inert
script to an executable clone. onConsentChanged reloads, so a later grant
re-applies via the same path. Verified locally: all three scripts flip
from text/plain to active on the US default-grant page.
Accessibility:
- The geo-gated banner is a fixed top strip that painted over the fixed
Starlight header (z-index 10), hiding nav/search (WCAG 2.4.11). A new
ResizeObserver (trackBannerHeight) publishes the banner's live height as
--wcp-banner-height, and CSS translates .page (the body-level wrapper that
contains every fixed control) down by that amount only while the banner is
in the DOM. It is a no-op with no banner (0px), so the US is unaffected.
Verified: injecting a 60px banner shifts the header to top:60 uncovered.
- Reject / Manage-cookies ghost buttons used a 30% border that failed WCAG
1.4.11 non-text contrast (1.90:1 light / 2.70:1 dark). Bumped to 55%
(3.73:1 / 5.82:1) on the banner and the dialog reset button.
Cleanups:
- Guard openManageConsent so preventDefault only fires when WCP's dialog
actually opened, not on every click.
- Replace the dead `theme-changed` CustomEvent (WCP has no such listener)
with the real re-theme hook, siteConsent.applyTheme(themeObject), driven
by the existing data-theme observer.
- Register onConsentChanged once via init's callback argument; drop the
redundant siteConsent.onConsentChanged(...) call that double-registered it
(WCP stores callbacks in a list, so it fired two reloads per change).
- Refresh the Cookie Consent + screenshot sections of astro.instructions.md
to describe WCP (geo-gated top strip, Accept/Reject/More info, MSCC
cookie) instead of the removed jop-software library.
- Drop the dead E2E_TESTS env (read nowhere) from frontend-build.yml and the
two playwright configs, plus the stale cookie.config.ts comment.
Tests:
- Restore the consent regression coverage adamint flagged as deleted. New
tests/e2e/cookie-consent.spec.ts stubs window.WcpConsent (blocking the real
CDN) so it can assert the behavior that only exists at runtime: analytics
scripts are promoted from inert to executable when Analytics consent is
granted, stay inert when it is withheld, and every server-rendered
manage-cookies control routes a click to siteConsent.manageConsent(). Green
across the desktop, tablet, and mobile projects.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Fix WCP analytics ordering and applyTheme arg (review 4797687282)
adamint's CHANGES_REQUESTED (with JamesNK's two inline notes) caught two real
bugs the e2e stub had masked. Both verified against the live library and fixed.
1. Analytics was dead on the default (US) path. activateAnalyticsScripts()
rebuilds each inert script with document.createElement('script') but never
reset `async`. Dynamically-created scripts default to async=true and the
copied `defer` is a no-op for them, so the two tiny same-origin scripts
(1ds.js, track.js) won the race against the ~140 KB 1DS SDK and each bailed
silently (1ds.js returns without `oneDS`; track.js returns without
`window.analytics.__initialized`). Set `next.async = false` so they execute
in insertion (document) order. Since consent isn't required in the US,
Analytics is auto-granted there, so this was most traffic, not an edge case.
2. applyTheme always threw. WCP v2's public `siteConsent.applyTheme(name)`
takes a string theme KEY and looks it up in its internal map; we were
passing `wcp.themes.dark/.light` (an object), so `this.themes[object]` was
undefined -> "Theme not found error", swallowed by withSiteConsent's
try/catch. resolveWcpTheme now returns the 'dark'|'light' string for both
applyTheme and init, so the WCP-internal re-theme actually runs on toggle.
(init's 5th theme arg is ignored by the current CDN build; our CSS overrides
theme the visible surfaces regardless.)
Tests: strengthen the stub so it can no longer hide either bug and add the
missing coverage adamint flagged.
- applyTheme now validates its argument (string key in the themes map) and
throws otherwise, exactly like the live library; a permissive stub could not
catch a wrong-argument regression.
- New assertion: every promoted analytics script has async===false.
- New test: toggling data-theme drives applyTheme with the string key.
- New test: WCP's onConsentChanged (init's 4th arg, now captured by the stub)
reloads the page — restores the accept/reject-persistence coverage lost with
the old ui-regressions tests.
Verified the strengthened guards fail when either fix is reverted, and pass with
both applied: cookie-consent.spec.ts is 15/15 across desktop/tablet/mobile.
Also:
- Revert an unintended pnpm-lock transitive drift (satteri 0.9.3 -> 0.9.4) so
the lockfile diff is only the removed cookie-consent packages.
- Fix a stale CSS comment: the banner's third action is "More info", not
"Manage cookies".
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
---------
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4182d84d-5dc1-4c74-be09-15995a872350
* Clarify third-party link guidelines (#1399)
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f983d401-1730-48ef-a79a-8d398376fcd3
* fix: pin brace-expansion 5.0.8 to address GHSA-mh99-v99m-4gvg (#1412)
Dependabot alert #106: brace-expansion DoS (GHSA-mh99-v99m-4gvg, HIGH).
- Widen the conditional override to brace-expansion@<5.0.8: '>=5.0.8' in
pnpm-workspace.yaml.
- Pin brace-expansion to 5.0.8 in pnpm-lock.yaml (now published to the feed;
integrity sha512-JZyDyq3D4A...), fully clearing the alert. balanced-match
dependency unchanged (4.0.4).
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* fix: normalize Aspire terminology in generated API reference data (#1413)
* fix: normalize Aspire terminology in generated API reference data
The Forbidden Words check fails on the bot's integration-data PRs
(e.g. microsoft/aspire.dev#1411) because the deprecated terms live in
ingestion paths that #1397's normalizer never covered:
- src/data/pkgs/*.json (C# API docs; kind:"text" prose nodes)
- src/data/ts-modules/*.json (TS API docs; description/returns/remarks)
- sample appHostCode (code comments; previously excluded)
#1397 only normalized sample title/description/readme[Raw] and the
integration package description, so regenerated API reference prose and
sample AppHost comments kept reintroducing the deprecated terms verbatim
from upstream XML/JSDoc docs.
This extends normalization to those paths, reusing the single source of
truth in aspire-terminology.ts (kept in sync with
.github/forbidden-words.json):
- aspire-terminology.ts: add normalizeAspireTerminologyInCode(), which
rewrites deprecated terms in code comments only, preserving strings,
char/template literals, and executable code so samples still compile.
- normalize-generated-api-data.ts: format-preserving raw-text pass over
the generated API JSON. Normalizes prose only (kind:"text" nodes and
description/returns/remarks), leaving code/cref/langword nodes and all
.NET-escaped bytes (CRLF, astral \u escapes) byte-for-byte identical.
- update-ts-api.ts: normalize ts-modules before the twoslash bundle is
derived, so aspire.d.ts hover tooltips are normalized too.
- update-integration-data.ps1: normalize pkgs after the C# API generator.
- update-samples.ts: normalize appHostCode comments.
The committed data is already clean (a plain grep over-counts the plural
"app hosts", which the boundary-anchored rule never matches), so this is
a scripts+tests change with no data churn. Adds unit tests for both new
normalizers.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d775be1b-bee3-432e-bbfc-7a4861f3bc05
* fix: preserve commands in code comments
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* fix: preserve nested interpolation strings
Replace the regex comment tokenizer with a stateful scanner so nested C# interpolation strings and raw strings remain byte-for-byte unchanged while adjacent comments are normalized.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a9940fd9-999f-4e50-9192-96c023b14792
* fix: normalize comments inside interpolation expressions
Comments nested inside C# interpolation ({ }) and TypeScript template
${ } expressions previously bypassed terminology normalization: the
scanner advanced past them while skipping the surrounding literal.
Thread a comment-span accumulator through interpolation traversal so
those executable-code comments are normalized while nested string,
char, and raw literals stay byte-for-byte identical. Adds C# and TS
regression cases, including a comment paired with a preserved nested
string literal.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d775be1b-bee3-432e-bbfc-7a4861f3bc05
Copilot-Session: a9940fd9-999f-4e50-9192-96c023b14792
* chore: Update integration data and GitHub stats (8/4/26) (#1424)
* chore: Update integration data and GitHub stats (8/4/26)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* fix: restore AppHost casing in generated API data
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
---------
Co-authored-by: aspire-repo-bot[bot] <aspire-repo-bot[bot]@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
* Pin compromised Keyv ecosystem releases (#1425)
Add exact pnpm overrides for the 11 malicious releases identified by Snyk without changing the current dependency graph.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4a7187e8-18d4-4432-9c78-4ebb8c25d78e
* Add pr-review skill and .agents/skills README index (#1422)
Adds a code-quality pr-review skill (C#/TypeScript/Astro/HTML/CSS) focused on critical issues and test coverage, plus a README indexing all skills.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Redesign the Aspire landing page experience (#1420)
* Redesign the landing page experience
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
* Landing page UX polish: carousel autoplay, AI sparkle, caret + footer
- DashboardCarousel: replace interval autoplay with a rAF progress engine;
add a bottom-left play/pause button + progress bar (stage presentation),
manual nav drops into paused manual mode, Play resumes from the current
slide. Homepage carousel now autoplays (autoplay={true}).
- HomeAgentBadge: swap the star for the AI sparkle (material-symbols
auto-awesome) with glow/twinkle; enlarge popover text.
- AppHostBuilder: left-align caret on blank lines; move typing-animation
checkbox to the bottom-left under the code box.
- Footer: map disclosure animate open/close with scroll adjustment.
- Update homepage e2e tests for the new autoplay + manual-pause behavior.
NOTE: DashboardCarousel play/pause button + progress bar CSS is not yet
added (renders unstyled). Remaining follow-ups tracked separately.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* Style dashboard carousel playback controls + freeze progress on pause
- Add CSS for the bottom-left play/pause button (matching the model-story
toggle, dark/purple stage palette) and the under-image progress bar,
gated to the stage presentation via [data-playback='on'].
- Raise the in-stage button above the active slide (z-index 120) so a real
pointer click hits the button instead of the image/zoom target.
- Freeze the progress fill at its current fraction while paused instead of
resetting to 0, so Play resumes visually from where it stopped.
- Add en i18n keys landing.dashboardCarousel.play/.pause (other locales
fall back to English via tt()).
Verified live: autoplay advances, progress fills, play/pause toggles and
swaps icons, manual nav drops into paused manual mode, Play resumes; no
console errors; controls hidden on the coverflow (docs) presentation.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* Polish mobile radar, footer bottom row, and slow carousel
- HomeEnvironment: on mobile, lift the bottom-left database resource clear
of the pause control and tuck the floating nodes closer to the radar's
extending lines (verified across Local/Test/Production at 390px and 360px).
- Footer: stack the bottom row (copyright / "Made with love" / SHA) into a
single left-aligned column at <=52rem so the items align cleanly on
mobile/tablet and the SHA no longer collides with the scroll-to-top button.
- DashboardCarousel: slow autoplay cadence from 5.5s to 7s per slide.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* Emulate dashboard, realistic terminal, and lightbox nav
Polish the landing page "one application model" (glue-work) section and the
dashboard carousel:
- Replace the static dashboard screenshot in the glue-work section with an
animated, emulated resources table that mirrors the real Aspire dashboard:
rows come online staggered (Starting -> Running), URLs fade in, and a live
"N of 4 resources running" counter tracks progress. Snaps to the final
running state on manual tab selection or reduced motion.
- Rewrite the model-story terminal to faithful `aspire run` output: build and
start status lines plus the AppHost / Dashboard / Logs summary grid with a
login-token dashboard URL. Long lines now wrap on narrow viewports instead of
clipping.
- Add prev/next navigation to the dashboard carousel's zoom lightbox. Arrow
buttons (and Left/Right keys) flip through every view without unzooming; the
carousel rests on the last-viewed slide when the lightbox closes. Buttons are
theme-aware and respect reduced motion.
- Vary a repetitive AI badge label and drop the redundant environment tab
underline animation.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* Enlarge AppHost code panel font to match other model-story tabs
The AppHost code snippet rendered at a much smaller font than the
Topology and Dashboard panels, making it hard to read. Bump the code
font/line-height to match the dashboard panel (clamp(0.74rem, 1.15vw,
0.86rem)), trim the padding, and grow the model-story stage height
(clamp(24rem, 37vw, 28rem)) so the 17-line TypeScript variant still
fits without clipping. Also enlarge the mobile code font accordingly.
Verified across 384-1440px in both themes: code font now matches the
dashboard exactly with no vertical clipping; Topology and Dashboard
tabs still look good with the extra room.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* Clean up redesigned landing page: remove dead components, localize, a11y
Final cleanup pass on the landing-page redesign:
- Delete 7 unused legacy homepage components (FreeAndOpenSourceAside +
quotes data, IntegrationGrid, LanguagesSupported, LocalVsProdEnvironments,
SimpleCard, TestimonialCarousel) and drop their unit/e2e/prop-contract tests.
- Render the redesigned <HomePage /> from every locale index.mdx and switch the
Starlight hero to isHomepage() so the new hero shows on all locale homepages.
- Add a localized `home` i18n namespace to en.json and translate it into all
14 locales (115 strings each), preserving {{placeholders}} and <strong> markup.
- Add a localizedHref() helper for locale-aware internal links.
- Accessibility: switch the model-story code block to Expressive Code for WCAG AA
contrast in both themes, add Escape-dismiss to the agent-badge tooltip
(WCAG 1.4.13), and keep decorative regions fully out of the tab order.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* Polish announcement banner styles
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Complete landing page redesign refinements
Finish the runtime story, responsive motion gating, dashboard media, accessible custom selects, localized shared controls, and regression coverage across the landing experience.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
* Fix homepage CI rendering
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
* Harden homepage E2E checks
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
* Relocate carousel playback control and glide slides
Move the stage playback button into the footer controls row so it sits bottom-left alongside the prev/next buttons, and remove the redundant visible slide description. Add a directional transform + opacity transition so views glide between slides instead of hard-cutting.
Update the homepage dashboard-tour e2e test to match: assert the playback button shares the controls row (left of prev/next), the slide description is gone, and the active slide animates.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address landing-page review: fix CustomSelect scroll close, freeze dashboard on pause, localize carousel play/pause
- CustomSelect: ignore scroll events originating inside the fixed listbox so scrolling the menu (wheel/touch or keyboard scrollIntoView) no longer dismisses it, keeping below-the-fold locales reachable while preserving close-on-page-scroll/resize.
- HomePage: clearDashTimers() in pause() so the emulated dashboard stops populating while the runtime story is paused.
- i18n: add translated dashboardCarousel.play/.pause to all 14 non-English locales.
- e2e: add regression test that scrolls inside the language listbox and pages to the last option, asserting the menu stays open.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix homepage testing link
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
* Refine landing page feedback
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
---------
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cf454734-c35f-4adc-b261-3036f0323c62
Copilot-Session: f9785116-08b1-4e47-89f2-a11dfdf75420
* docs: add trusted repository CLI guidance (#1426)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 937c958a-8043-40ee-8c89-4395dc892a57
* [docs] Expand 13.2 Connection property suffix breaking change with migration guidance (#944)
* [docs] Expand 13.2 Connection property suffix breaking change with migration guidance
The 13.2 `Connection property suffix` breaking change was only a single
sentence on the live changelog, which left readers without enough detail
to confidently migrate apps upgrading directly from 13.0 to 13.2.
Expand the section with:
- A short explanation of the rename pattern (properties whose value is the
name of a sub-entity now end with `Name`).
- A canonical table covering all 15 affected resource types grouped by
rename (`Database` -> `DatabaseName`, `Model` -> `ModelName`,
`ConsumerGroup` -> `ConsumerGroupName`).
- Before/after environment-variable examples showing the impact on
consuming apps that read connection properties through `WithReference`.
- Before/after C# examples for `GetConnectionProperty` callers in the
AppHost.
- A migration checklist for searching solutions, including a clear note
that C# apps consuming the standard Aspire client integrations do not
need source changes.
- Cross-link to the partial 13.1 changelog entry, with the 13.2 entry as
the canonical reference.
Anchor `#connection-property-suffix` is preserved so external links
keep working.
Fixes #413
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* docs: clarify connection property environment names
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
* Document Aspire 13.3 `WithEnvironment` unification and compatibility shim mappings (#1162)
* Initial plan
* docs: document 13.3 WithEnvironment unification and shim mappings
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* [auto-sec] frontend deps: postcss>=8.5.23, brace-expansion>=5.0.9, mermaid 11.16.1 (#1431)
* [auto-sec] frontend: bump postcss>=8.5.23 & brace-expansion>=5.0.9
Raise pnpm override floors and refresh the lockfile to clear two open
Dependabot alerts in src/frontend:
- brace-expansion 5.0.8 -> 5.0.9 (HIGH, GHSA-rgw5-rvv9-x895): DoS via
unbounded intermediate arrays (bypasses CVE-2026-14257 mitigation).
- postcss 8.5.20 -> 8.5.25 (MEDIUM, GHSA-fxqj-rqcc-2cmp): arbitrary
.map read via attacker-controlled sourceMappingURL when from unset.
Lockfile changes folded from Dependabot #1423 (postcss) plus the
isolated brace-expansion entry from #1421; no other package versions
changed. Override floors in pnpm-workspace.yaml match the lock.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* chore(deps): bump mermaid from 11.16.0 to 11.16.1 in /src/frontend
Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.16.0 to 11.16.1.
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.0...mermaid@11.16.1)
---
updated-dependencies:
- dependency-name: mermaid
dependency-version: 11.16.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* fix(deps): pin transitive nanoid to aged 3.3.16 to satisfy pnpm minimum-release-age policy
postcss>=8.5.23 pulled nanoid@3.3.18 (published <24h ago), tripping
ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION in frontend-build. nanoid has no
open advisory; pin to 3.3.16 (matches main, satisfies postcss ^3.3.11).
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: David Pine <dapine@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Update AppHost eventing docs to use typed helper APIs (#1168)
* Initial plan
* Update AppHost eventing helper docs
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
* Finalize eventing helper doc updates
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
* Address eventing docs review feedback
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: David Pine <david.pine@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Add declarative auto-expiry to docs announcement banner (#1448)
* Add declarative auto-expiry to docs announcement banner
Version-update banners never got removed: if a reader saw one but never
clicked dismiss, it lingered on every visit. Add two optional frontmatter
fields nested under `banner`:
- `expiresOn`: absolute YYYY-MM-DD sunset that hides the banner for everyone
(and skips rendering at build time once past).
- `autoDismissAfterDays`: per-reader window that auto-hides N days after the
reader first sees it, tracked in localStorage.
Either condition (or manual dismiss) hides the banner; both compose. Decision
logic lives in a pure, unit-tested helper (src/utils/banner-expiry.ts) mirrored
inline in Banner.astro, which reuses the existing show/collapse paths so the
sidebar banner-height tracking keeps working. Rolls out autoDismissAfterDays: 14
to the current Aspire 13.4 banners across all locales.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address PR review: top-level expiry fields, shared helper, hardened parse
- Move banner expiry metadata to top-level frontmatter keys
(bannerExpiresOn / bannerAutoDismissAfterDays). Nested banner.* keys were
stripped by Starlight's built-in banner schema and reached the component as
null; top-level coerced dates survive intact (like publishDate).
- Banner.astro client script now imports resolveBannerVisibility/parseFirstSeen
from banner-expiry.ts (bundled module + data-* config) instead of mirroring
the logic inline, so shipped behavior can't diverge from the unit tests.
- Add parseFirstSeen(): reject non-integer/zero/negative/future stored
first-seen values (Number.parseInt salvaged junk like "12abc"/"-5" into a
1970-era time that hid the banner permanently). Invalid values now self-heal
as a fresh first view.
- Add rendered-Banner.astro regression test proving expiry metadata reaches the
component; extend helper unit tests for parseFirstSeen + self-heal.
- Update docs content (18 pages) and astro.instructions.md.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix banner-render test: Astro emits empty attrs as bare attributes
Astro serializes an empty-string attribute value (data-expires-on set to '')
as a bare boolean attribute, not data-expires-on="". Assert the bare form
instead. Production is unaffected: the client reads an empty dataset value as
null (no expiry configured).
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* [auto-sec] src/frontend: js-yaml + nanoid HIGH alerts (GHSA-5p4m-2wfm-xmqj, GHSA-2v37-7h3g-55p8) (#1455)
* [auto-sec] Bump js-yaml 4.3.0->5.2.2 and nanoid 3.3.16->3.3.17 in src/frontend
Transitive security remediation via pnpm overrides:
- js-yaml >=4.0.0 <4.3.1 -> 5.2.2 (GHSA-5p4m-2wfm-xmqj, HIGH)
advisory-patched 4.3.1 is not published to the registry; 5.2.2 is the
lowest fetchable version clearing the range (same argparse dep, no new
transitives).
- nanoid <3.3.17 -> 3.3.17 (GHSA-2v37-7h3g-55p8, HIGH)
pnpm-lock.yaml updated with registry-verified integrity (npm pack).
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Use js-yaml 4.3.1 (advisory patch) instead of 5.2.2 to avoid ESM default-export break
js-yaml 5.x is pure ESM and removed the CommonJS default export, which breaks the
Astro build (The requested module 'js-yaml' does not provide an export named 'default').
4.3.1 is the actual GHSA-5p4m-2wfm-xmqj patched release on the 4.x line (same argparse
^2.0.1 dependency, same API), so it clears the alert without breaking the build.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: David Pine <dapine@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Document environment variable naming conventions for resources (#498)
* Initial plan
* Add environment variables naming convention documentation
Create new fundamentals/environment-variables.mdx page documenting:
- Connection string naming (ConnectionStrings__{resource-name})
- Endpoint URL naming (RESOURCE_NAME_SCHEME)
- Service discovery variables (services__name__scheme__index)
- Resource property naming (RESOURCE_NAME_PROPERTY)
- Name encoding rules (hyphens to underscores, uppercasing)
- Examples for C#, Python, and JavaScript
- Custom environment variables with WithEnvironment
Update sidebar, Python, JavaScript, and service discovery pages with
cross-references to the new page.
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
* Fix JavaScript connection string example to use bracket notation with hyphen
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
* Address review feedback: rewrite intro, use txt code blocks, add LearnMore, remove unused imports
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
* Fix LearnMore component formatting to match existing patterns
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
* Replace stacked LearnMore components with standard See also section
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
* Add npx astro telemetry disable to CI workflows and devcontainer
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: IEvangelist <7679720+IEvangelist@users.noreply.github.com>
* docs: fix inaccurate Customize Azure resources page (#946)
Rework the Customize Azure resources guide to use accurate, current APIs:
- Replace the strongly-typed PrivateEndpoint example with the higher-level
AddPrivateEndpoint builder (C# and TypeScript).
- Use AddBicepTemplate with a valid Bicep output and WithParameter/GetOutput.
- Add a "Pass parameters and read outputs" section covering the full
WithParameter value union, backed by twoslash type updates.
- Correct the "Inspect generated Bicep" steps to use `aspire publish`.
Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden API data generation and fix C# deep links (#1461)
* Harden generated API data pipeline
Make package and TypeScript generation fail closed, add semantic validation and transactional publication, preserve generated metadata fidelity, and restore stable C# API member deep links.
Co-authored-by: Copilot App <223556219+Copilot@…
* docs: rewrite What's new in Aspire 13.5 with verified detail Expand the 13.5 what's-new article from a thin changelog into a narrative article matching prior releases: thematic sections, compiled C# and validated TypeScript samples, Aside callouts for experimental/breaking APIs, and cross-links to corresponding aspire.dev pages. Every claim is verified against microsoft/aspire release/13.5. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: address 13.5 what's-new PR review feedback Apply maintainer and reviewer corrections to the Aspire 13.5 what's-new article: - WithTerminal: note the aspire terminal CLI command is behind the features.terminalCommandsEnabled flag; scope the dashboard terminal view to running resources. - Interaction samples: guard C# commands with IInteractionService.IsAvailable (CLI runs NonInteractive), and return early in the TypeScript sample when the prompt is canceled before reading inputs. - File-upload sample: mark the file input Required, null-check Files?[0], and move processing into ProgressInteractionOptions.Work so the progress dialog completes instead of hanging on the command token. - Resource command arguments: the dashboard prompts; the CLI exposes each argument as a --<name> option and errors on missing required options. - WithUniqueResourceNaming: scope to the same resource group and warn that enabling it on an existing deployment renames and recreates the environment. - aspire stop --force: describe the persistent-resource cleanup and data loss. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: add TypeScript samples to 13.5 what's-new AppHost snippets Every C#-only code sample in the What's new in Aspire 13.5 article now has a synced TypeScript tab, mirroring the CI-typecheck-validated polyglot fixtures on microsoft/aspire release/13.5. The two TypeScript AppHost improvement sections (custom health checks, container file copying) call out the equivalent C# APIs for parity. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Recaptures 86 evergreen dashboard screenshots (explore, landing, get-started, standalone, fundamentals, AI agents) against the microsoft/aspire release/13.5 dashboard UX, preserving each image's theme, framing, and resolution. Files overwritten in place; no .mdx changes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
#1494) Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.