Update React to 19.2.1 to address CVE-2025-66478

[Copilot]

Description

Patches critical RCE vulnerability (CVE-2025-66478, CVSS 10.0) in React Server Components affecting React 19.0.0, 19.1.0, 19.1.1, and 19.2.0.

Changes

Updated React and React-DOM dependencies across playground apps and project templates:

• playground/AspireWithJavaScript/AspireJavaScript.Vite: 19.0.0 → 19.0.1
• playground/AspireWithJavaScript/AspireJavaScript.React: 19.1.1 → 19.1.2
• templates/aspire-py-starter/frontend: 19.1.1 → 19.1.2
• templates/aspire-js-frontend-starter/frontend: 19.1.1 → 19.1.2

All package-lock.json files regenerated via npm install, resolving to React 19.2.1 (latest patched version).

Added playground/**/dist/ to .gitignore to exclude build artifacts.

Security Advisory

• CVE: CVE-2025-66478 (GHSA-9qr9-h5gf-34mp)
• Patched versions: 19.0.1, 19.1.2, 19.2.1
• Reference: GHSA-9qr9-h5gf-34mp

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes (upstream React security advisory)
      • No
  • No
• Does the change require an update in our Aspire docs?
  • Yes
  • No

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com//advisories
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Update React templates, playground apps, etc. due to CVE</issue_title>
<issue_description>React CVE: GHSA-9qr9-h5gf-34mp</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Update React templates, playground apps, etc. due to CVE #13314

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.