Refresh frontend lockfile for security advisories

[IEvangelist]

Summary

Refresh the frontend dependency graph in src/frontend to clear the currently open Dependabot alerts for dompurify and esbuild.

What changed

• Added pnpm overrides that force patched dompurify and esbuild releases.
• Regenerated src/frontend/pnpm-lock.yaml so the patched transitive versions are resolved everywhere in the site build.

Alerts addressed

• dompurify advisories in src/frontend/pnpm-lock.yaml
• esbuild advisory in src/frontend/pnpm-lock.yaml

Validation

• pnpm install --frozen-lockfile
• pnpm lint
• pnpm test:unit
• pnpm build

[aspire-repo-bot]

Frontend HTML artifact ready

The latest frontend build uploaded the frontend-dist artifact for PR #1308. Use the VS Code button below to open this PR with GitHub Artifacts Explorer and browse the built HTML locally.

This comment updates automatically when a new frontend build artifact is uploaded.

[Copilot]

Pull request overview

This PR refreshes the src/frontend dependency graph to resolve Dependabot security alerts by forcing patched versions of dompurify and esbuild via pnpm overrides and regenerating the lockfile accordingly.

Changes:

• Updated pnpm overrides to require dompurify >= 3.4.11 (for < 3.4.11).
• Added a pnpm override to require esbuild >= 0.28.1 (for < 0.28.1).
• Regenerated src/frontend/pnpm-lock.yaml so the resolved graph consistently uses the patched versions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
src/frontend/package.json	Updates pnpm overrides to enforce patched dompurify and esbuild versions.
src/frontend/pnpm-lock.yaml	Regenerates the lockfile so patched dompurify/esbuild versions are resolved across the graph.

Files not reviewed (1)

• src/frontend/pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[IEvangelist]

Closing this stale security PR. The microsoft/aspire.dev repo currently has zero open Dependabot security alerts, and the frontend lockfile on main is already clean. This PR has accumulated conflicts with main and failing CI, making it harder to merge than simply keeping main up to date. If new security alerts emerge, a fresh canonical PR will be created.