build(deps): bump the angular group across 1 directory with 10 updates - #109
Open
dependabot[bot] wants to merge 1 commit into
Open
build(deps): bump the angular group across 1 directory with 10 updates#109dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/client/angular-ab34aae4e6
branch
from
August 26, 2026 23:45
fc7a32d to
303f582
Compare
ncoevoet
added a commit
that referenced
this pull request
Sep 1, 2026
Five open Dependabot alerts, all the same transitive dev dependency: undici >= 7.0.0 < 7.29.0, reached through @angular/build and jsdom. One is high (CVE-2026-13697, cross-user disclosure and a parse-time crash via degenerate private cache directives) and four are medium (CRLF injection via a blob-like body type, Cache-Control whitespace disclosure, cookie attribute injection, and response desynchronisation in the retry interceptor). All five are fixed in 7.29.0. `npm audit fix --force` wanted @angular/build 21.2.22, outside the exact 21.2.19 this project pins -- and the Angular bump already in flight (Dependabot #109) only reaches 21.2.21, so it would not have closed these either. An overrides entry patches the transitive dependency without touching the framework pin, which is what this repo already does for ws. The lock is edited surgically rather than regenerated. A plain `npm install` here drops @emnapi/core and @emnapi/runtime -- optional, platform-gated entries this machine does not need and a runner does -- and `npm ci` then refuses the tree with "Missing: @emnapi/core@1.11.3 from lock file". So the only changes are undici 7.28.0 -> 7.29.0 and the removal of node-gyp's nested 6.28.0 copy, which the override dedupes into the root; every other entry is byte-identical to before. Verified with the command that failed: npm ci, then 1969 tests, ng lint, both tsconfig typechecks and a production ng build, plus npm audit reporting zero vulnerabilities.
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/client/angular-ab34aae4e6
branch
from
September 1, 2026 13:56
303f582 to
a403ec6
Compare
Bumps the angular group with 10 updates in the /client directory: | Package | From | To | | --- | --- | --- | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.19` | `21.2.22` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.19` | `21.2.22` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.19` | `21.2.22` | | [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) | `21.2.19` | `21.2.22` | | [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) | `21.2.19` | `21.2.22` | | [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `21.2.19` | `21.2.22` | | [@angular/service-worker](https://github.com/angular/angular/tree/HEAD/packages/service-worker) | `21.2.19` | `21.2.22` | | [@angular/build](https://github.com/angular/angular-cli) | `21.2.19` | `21.2.22` | | [@angular/cli](https://github.com/angular/angular-cli) | `21.2.19` | `21.2.22` | | [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) | `21.2.19` | `21.2.22` | Updates `@angular/common` from 21.2.19 to 21.2.22 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.22/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.22/packages/common) Updates `@angular/compiler` from 21.2.19 to 21.2.22 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.22/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.22/packages/compiler) Updates `@angular/core` from 21.2.19 to 21.2.22 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.22/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.22/packages/core) Updates `@angular/forms` from 21.2.19 to 21.2.22 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.22/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.22/packages/forms) Updates `@angular/platform-browser` from 21.2.19 to 21.2.22 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.22/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.22/packages/platform-browser) Updates `@angular/router` from 21.2.19 to 21.2.22 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.22/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.22/packages/router) Updates `@angular/service-worker` from 21.2.19 to 21.2.22 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.22/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.22/packages/service-worker) Updates `@angular/build` from 21.2.19 to 21.2.22 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v21.2.19...v21.2.22) Updates `@angular/cli` from 21.2.19 to 21.2.22 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v21.2.19...v21.2.22) Updates `@angular/compiler-cli` from 21.2.19 to 21.2.22 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v21.2.22/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.22/packages/compiler-cli) --- updated-dependencies: - dependency-name: "@angular/build" dependency-version: 21.2.21 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/cli" dependency-version: 21.2.21 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/common" dependency-version: 21.2.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/compiler" dependency-version: 21.2.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/compiler-cli" dependency-version: 21.2.20 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/core" dependency-version: 21.2.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/forms" dependency-version: 21.2.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/platform-browser" dependency-version: 21.2.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/router" dependency-version: 21.2.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular - dependency-name: "@angular/service-worker" dependency-version: 21.2.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: angular ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/client/angular-ab34aae4e6
branch
from
September 2, 2026 23:45
a403ec6 to
9f8ebb4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the angular group with 10 updates in the /client directory:
21.2.1921.2.2221.2.1921.2.2221.2.1921.2.2221.2.1921.2.2221.2.1921.2.2221.2.1921.2.2221.2.1921.2.2221.2.1921.2.2221.2.1921.2.2221.2.1921.2.22Updates
@angular/commonfrom 21.2.19 to 21.2.22Release notes
Sourced from @angular/common's releases.
Changelog
Sourced from @angular/common's changelog.
Commits
caf6166fix(http): run root interceptors in the terminal request chainfec5977fix(http): match header values exactly when deletinge33d69afix(http): preserve immutability of materialized clonesUpdates
@angular/compilerfrom 21.2.19 to 21.2.22Release notes
Sourced from @angular/compiler's releases.
Changelog
Sourced from @angular/compiler's changelog.
Commits
6afe6fafix(core): sanitize host bindings on concrete hostsUpdates
@angular/corefrom 21.2.19 to 21.2.22Release notes
Sourced from @angular/core's releases.
Changelog
Sourced from @angular/core's changelog.
Commits
6afe6fafix(core): sanitize host bindings on concrete hostsUpdates
@angular/formsfrom 21.2.19 to 21.2.22Release notes
Sourced from @angular/forms's releases.
Changelog
Sourced from @angular/forms's changelog.
Commits
Updates
@angular/platform-browserfrom 21.2.19 to 21.2.22Release notes
Sourced from @angular/platform-browser's releases.
Changelog
Sourced from @angular/platform-browser's changelog.
Commits
c19a36cfix(platform-browser): disallow event handler attributes in MetaUpdates
@angular/routerfrom 21.2.19 to 21.2.22Release notes
Sourced from @angular/router's releases.
Changelog
Sourced from @angular/router's changelog.
Commits
Updates
@angular/service-workerfrom 21.2.19 to 21.2.22Release notes
Sourced from @angular/service-worker's releases.
Changelog
Sourced from @angular/service-worker's changelog.
Commits
Updates
@angular/buildfrom 21.2.19 to 21.2.22Release notes
Sourced from @angular/build's releases.
Changelog
Sourced from @angular/build's changelog.
... (truncated)
Commits
60dee48release: cut the v21.2.22 releaseb0047b0fix(@angular-devkit/build-angular): update webpack-dev-server to 5.2.690e8059release: cut the v21.2.21 releasef7f60e6fix(@angular/build): bump undici to 7.29.0ba5d16cfix(@angular/cli): update dependency@modelcontextprotocol/sdkto v1.30.0928eb73release: cut the v21.2.20 release972f6dbfix(@angular-devkit/build-angular): upgrade postcss to 8.5.238de75adfix(@angular/build): upgrade postcss to 8.5.23Updates
@angular/clifrom 21.2.19 to 21.2.22Release notes
Sourced from @angular/cli's releases.
Changelog
Sourced from @angular/cli's changelog.
... (truncated)
Commits
60dee48release: cut the v21.2.22 releaseb0047b0fix(@angular-devkit/build-angular): update webpack-dev-server to 5.2.690e8059release: cut the v21.2.21 releasef7f60e6fix(@angular/build): bump undici to 7.29.0ba5d16cfix(@angular/cli): update dependency@modelcontextprotocol/sdkto v1.30.0928eb73release: cut the v21.2.20 release972f6dbfix(@angular-devkit/build-angular): upgrade postcss to 8.5.238de75adfix(@angular/build): upgrade postcss to 8.5.23Updates
@angular/compiler-clifrom 21.2.19 to 21.2.22Release notes
Sourced from @angular/compiler-cli's releases.
Changelog
Sourced from @angular/compiler-cli's changelog.
Commits
6afe6fafix(core): sanitize host bindings on concrete hosts