[Jay W (JayDoubleu)]

What is being addressed

Dependabot reports seven open alerts in ui/app/package-lock.json (alerts #628 to #634). The UI pins vite 7.3.6 and Vitest 4.1.11. The fixed versions are vite 7.3.7 and @vitest/mocker 4.1.12.

Alert	Package	Severity	Advisory	Summary
#629	vite	high	GHSA-587h-7wmj-h5pm	launch-editor: on Windows, a request can bypass the fs.existsSync() test
#628	vite	medium	GHSA-698v-4r3x-3vcv	launch-editor: escapeCmdArgs() does not escape % on Windows
#630	vite	medium	GHSA-r825-w8mm-5pxw	launch-editor: some editors read a file name as a CLI flag
#631	vite	medium	GHSA-rq7h-c2jc-7f22	The dev server can serve files outside server.fs.allow
#632	vite	low	GHSA-9jrq-w75r-8gcw	Cross-origin script execution through custom middleware
#633	@vitest/mocker	medium	GHSA-xp26-3454-mjgp	Windows backslash paths bypass the redirect allowlist
#634	@vitest/mocker	medium	GHSA-qxg6-89mg-rqv8	Code injection through manual mock registration without authentication

All seven advisories apply to the development server and the test runner. The deployment script devops/scripts/build_deploy_ui.sh uploads only the static build output in ui/app/dist.

How is this addressed

• Pin vite to 7.3.7.
• Pin vitest, @vitest/ui and @vitest/coverage-v8 to 4.1.12.
• Update the lock file with npm 11.21.1. The lock file has one copy of each affected package, so these pins fix all seven alerts.
• Increase the UI version from 0.10.3 to 0.10.4.
• Add an entry to CHANGELOG.md under BUG FIXES.

The lock file changes only vite, the ten Vitest packages and seven dependencies of Vitest (chai, es-module-lexer, obug, std-env, tinyexec, tinyrainbow, and picomatch inside vitest). npm 11.9.0 removed the libc fields from 13 @rollup/* entries, but npm 11.21.1 keeps them. The root entry of the lock file now copies the latest specs from package.json in place of *.

Validation

I ran these checks on Linux x64 with Node 24.14.0 and npm 11.21.1:

Check	Result
npm audit --package-lock-only	None of the seven advisories remain
npm ci	Passed. The lock file did not change
npm test -- run	453 tests passed in 52 files
npm run lint	Passed
npm run build	Passed
npx vite dev server	Returned HTTP 200 for / and /src/index.tsx, and HTTP 403 for /@fs/etc/passwd
pre-commit run on the changed files	Passed

npm audit still reports one high advisory, GHSA-vfj7-8cjw-p6xm, for braces 3.0.3. The advisory has no patched version, so this PR does not change braces.

The same file tree also ran in a pull request in another fork:

• Lint, Build images, the UI unit tests and CodeQL 2.27.3 passed. CodeQL reported 0 results for actions, Java, Python and TypeScript.
• A /test run deployed a full TRE and passed the smoke tests.
• In that run, the Deploy UI job built tre-ui@0.10.4 with vite v7.3.7 and uploaded it to static web storage.

The smoke tests do not open the UI. Nobody signed in to the deployed UI.

[github-actions]

Unit Test Results

453 tests   453 ✅  1m 3s ⏱️
 52 suites    0 💤
  1 files      0 ❌

Results for commit b76d8b9.

[Jay W (JayDoubleu)]

/test b76d8b9

[github-actions]

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/39859163650

(in response to this comment from Jay W (@JayDoubleu))

[Copilot]

🟢 Approval recommended

The scoped dependency updates and release metadata are consistent, reported validation passed, and no blocking defects were identified.

No open issues 🎉

1 file not reviewed

• ui/app/package-lock.json: Generated file

What changed in this PR

Updates Azure TRE’s UI development and test dependencies to address seven reported security advisories without changing application code.

Changes:

• Pins Vite to 7.3.7 and Vitest packages to 4.1.12.
• Refreshes affected lockfile dependencies and aligns root dependency specifications.
• Increments the UI version to 0.10.4 and records the fixes in the changelog.

Reported validation includes 453 passing tests, lint, build, and deployment checks. Deployed UI sign-in remains untested.

File	Description
ui/​app/​package.json	Updates dependency pins and the UI version.
ui/​app/​package-lock.json	Synchronizes resolved dependencies and version metadata.
CHANGELOG.md	Documents the security updates under Unreleased bug fixes.

_{Review effort: Balanced}