chore(deps): bump @tootallnate/once and @angular/cli in /angular8-ivy#152
chore(deps): bump @tootallnate/once and @angular/cli in /angular8-ivy#152dependabot[bot] wants to merge 1 commit into
Conversation
Removes [@tootallnate/once](https://github.com/TooTallNate/once). It's no longer used after updating ancestor dependency [@angular/cli](https://github.com/angular/angular-cli). These dependencies need to be updated together. Removes `@tootallnate/once` Updates `@angular/cli` from 15.1.4 to 21.2.12 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@15.1.4...v21.2.12) --- updated-dependencies: - dependency-name: "@tootallnate/once" dependency-version: dependency-type: indirect - dependency-name: "@angular/cli" dependency-version: 21.2.12 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Semgrep found 1 Risk: samples-bootstrap-theme contains malicious code. Remove it immediately. Fix: There are no safe versions of this library available for upgrade. Library included at angular2-jwt-samples/angular8-ivy/package-lock.json:19039. Reference(s): https://osv.dev/vulnerability/MAL-2022-5922 Semgrep found 1 Risk: Affected versions of @babel/plugin-transform-modules-systemjs are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') / Improper Control of Generation of Code ('Code Injection'). @babel/plugin-transform-modules-systemjs mishandles module string specifiers when compiling code into SystemJS module form. An attacker who can supply specially crafted source code to a Babel build that uses this plugin (directly, or transitively via @babel/preset-env configured with Manual Review Advice: A vulnerability from this advisory is reachable if you install Fix: Upgrade this library to at least version 7.29.4 at angular2-jwt-samples/angular8-ivy/package-lock.json:4906. Reference(s): GHSA-fv7c-fp4j-7gwp Semgrep found 1 Risk: Affected versions of @angular/compiler are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). A stored XSS vulnerability in the Angular Template Compiler arises because its internal security schema doesn't classify certain URL‐ holding attributes (e.g. xlink:href, math|href, annotation|href) or the Manual Review Advice: A vulnerability from this advisory is reachable if you allow Fix: Upgrade this library to at least version 19.2.17 at angular2-jwt-samples/angular8-ivy/package-lock.json:2336. Reference(s): GHSA-v4hv-rgfq-gp49, CVE-2025-66412 Semgrep found 6
Risk: Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation. Manual Review Advice: A vulnerability from this advisory is reachable if you use Babel to compile untrusted JavaScript Fix: There are no safe versions of this library available for upgrade. Library included at angular2-jwt-samples/angular8-ivy/package-lock.json:8638. Reference(s): GHSA-67hx-6x53-jw92, CVE-2023-45133 |
Removes @tootallnate/once. It's no longer used after updating ancestor dependency @angular/cli. These dependencies need to be updated together.
Removes
@tootallnate/onceUpdates
@angular/clifrom 15.1.4 to 21.2.12Release notes
Sourced from @angular/cli's releases.
... (truncated)
Changelog
Sourced from @angular/cli's changelog.
... (truncated)
Commits
9dcef4drelease: cut the v21.2.12 releasefeec5bfrefactor(@angular/build): add missingOutputFileimport48c17e8docs: update JSDoc return tag to@returnand fix description in registry.tscbad575fix(@angular/build): ignore virtual esbuild paths with (disabled):6cc9349docs: update ng.ts render function documentation to reflect removal of render...00e3663release: cut the v21.2.11 releaseeafe1a7fix(@angular/ssr): allow all hosts in common engine rendering options to prev...7a116a8fix(@angular/ssr): remove stateful flag from URL_PARAMETER_REGEXPa7705fbbuild: update cross-repo angular dependencies453ed5bbuild: update github/codeql-action action to v4.35.4Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.