chore(deps): bump braces and @angular/compiler-cli in /angular8-ivy - #194
chore(deps): bump braces and @angular/compiler-cli in /angular8-ivy#194dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [braces](https://github.com/micromatch/braces) to 3.0.3 and updates ancestor dependency [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli). These dependencies need to be updated together. Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `@angular/compiler-cli` from 8.0.3 to 22.0.8 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v22.0.8/packages/compiler-cli) --- updated-dependencies: - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect - dependency-name: "@angular/compiler-cli" dependency-version: 22.0.8 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Semgrep found 1 Risk: Affected versions of @babel/helpers, @babel/runtime, @babel/runtime-corejs2, and @babel/runtime-corejs3 are vulnerable to Inefficient Regular Expression Complexity. Babel generates a polyfill (the Fix: Upgrade this library to at least version 7.26.10 at angular2-jwt-samples/angular8-ivy/package-lock.json:3323. Reference(s): GHSA-968p-4wvh-cqc8, CVE-2025-27789 Semgrep found 1 Risk: Affected versions of esbuild are vulnerable to Origin Validation Error. esbuild's development server responds to every request, including Server-Sent Events connections, with Manual Review Advice: A vulnerability from this advisory is reachable if you run esbuild with the Fix: Upgrade this library to at least version 0.25.0 at angular2-jwt-samples/angular8-ivy/package-lock.json:319. Reference(s): GHSA-67mh-4wv8-2f99 Semgrep found 1 Risk: Affected versions of js-yaml are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). js-yaml is vulnerable to prototype pollution through its YAML merge key ( Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 3.14.2 at angular2-jwt-samples/angular8-ivy/package-lock.json:9726. Reference(s): GHSA-mh29-5h37-fv8m, CVE-2025-64718 Semgrep found 1 Risk: Affected versions of webpack-dev-server are vulnerable to Exposed Dangerous Method or Function. webpack-dev-server serves bundled assets without rejecting cross-origin classic script requests. Because such Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 5.2.1 at angular2-jwt-samples/angular8-ivy/package-lock.json:15646. Reference(s): GHSA-4v9v-hfq4-rm2v, CVE-2025-30359 Semgrep found 1 Risk: Affected versions of webpack-dev-server are vulnerable to Origin Validation Error. webpack-dev-server improperly validates the WebSocket connection Origin header, unconditionally accepting any IP-address-based Origin. A malicious website can perform a cross-site WebSocket hijack against a running dev server and exfiltrate the developer source code carried in Hot Module Reloading (HMR) messages. The insecure origin check is the package default and is reached on every WebSocket connection, so any project running an affected version is vulnerable. Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 5.2.1 at angular2-jwt-samples/angular8-ivy/package-lock.json:15646. Reference(s): GHSA-9jgg-88mc-972h, CVE-2025-30360 Semgrep found 1 Risk: Affected versions of webpack are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). webpack's AutoPublicPathRuntimeModule emits runtime code that derives the asset public path from document.currentScript. Because document.currentScript can be DOM-clobbered by an injected scriptless element (e.g. Manual Review Advice: A vulnerability from this advisory is reachable if you build with output.publicPath unset Fix: Upgrade this library to at least version 5.94.0 at angular2-jwt-samples/angular8-ivy/package-lock.json:15555. Reference(s): GHSA-4vvj-4cpr-p986, CVE-2024-43788 Semgrep found 1 Risk: samples-bootstrap-theme contains malicious code. Remove it immediately. Fix: There are no safe versions of this library available for upgrade. Library included at angular2-jwt-samples/angular8-ivy/package-lock.json:13804. Reference(s): https://osv.dev/vulnerability/MAL-2022-5922 Semgrep found 1 Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. An attacker can supply a YAML document containing a chain of mappings that each merge the previous one via the merge key ( Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 3.15.0 at angular2-jwt-samples/angular8-ivy/package-lock.json:9726. Reference(s): GHSA-52cp-r559-cp3m, CVE-2026-59869 Semgrep found 1 Risk: Affected versions of @babel/plugin-transform-modules-systemjs are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') / Improper Control of Generation of Code ('Code Injection'). @babel/plugin-transform-modules-systemjs mishandles module string specifiers when compiling code into SystemJS module form. An attacker who can supply specially crafted source code to a Babel build that uses this plugin (directly, or transitively via @babel/preset-env configured with Manual Review Advice: A vulnerability from this advisory is reachable if you install Fix: Upgrade this library to at least version 7.29.4 at angular2-jwt-samples/angular8-ivy/package-lock.json:2896. Reference(s): GHSA-fv7c-fp4j-7gwp, CVE-2026-44728 Semgrep found 1 Risk: Affected versions of @angular/compiler are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). A stored XSS vulnerability in the Angular Template Compiler arises because its internal security schema doesn't classify certain URL‐ holding attributes (e.g. xlink:href, math|href, annotation|href) or the Manual Review Advice: A vulnerability from this advisory is reachable if you allow Fix: Upgrade this library to at least version 19.2.17 at angular2-jwt-samples/angular8-ivy/package-lock.json:931. Reference(s): GHSA-v4hv-rgfq-gp49, CVE-2025-66412 Semgrep found 6
Risk: Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation. Manual Review Advice: A vulnerability from this advisory is reachable if you use Babel to compile untrusted JavaScript Fix: There are no safe versions of this library available for upgrade. Library included at angular2-jwt-samples/angular8-ivy/package-lock.json:5322. Reference(s): GHSA-67hx-6x53-jw92, CVE-2023-45133 |
Bumps braces to 3.0.3 and updates ancestor dependency @angular/compiler-cli. These dependencies need to be updated together.
Updates
bracesfrom 3.0.2 to 3.0.3Commits
74b2db23.0.388f1429update eslint. lint, fix unit tests.415d660Snyk js braces 6838727 (#40)190510ffix tests, skip 1 test in test/braces.expand716eb9freadme bumpa5851e5Merge pull request #37 from coderaiser/fix/vulnerability2092bd1feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...9f5b4cffix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)98414f9remove funding file665ab5dupdate keepEscaping doc (#27)Updates
@angular/compiler-clifrom 8.0.3 to 22.0.8Release notes
Sourced from @angular/compiler-cli's releases.
... (truncated)
Changelog
Sourced from @angular/compiler-cli's changelog.
... (truncated)
Commits
7eec520test(compiler-cli): cover DOM-only vs full instruction set across compilation...70500e4fix(core): preserve explicit input transform write typec88dddefix(compiler-cli): re-tag SourceFiles after TsCreateProgramDriver.updateFiles()c82ae67Revert "fix(core): allow static attributes for explicit input transforms"94d9591fix(core): allow static attributes for explicit input transforms534fe81fix(compiler-cli): apply debugName transform to required signal queriesf5e69derefactor(compiler-cli): use BindingType enum check in suffix-not-supported ex...3b08201fix(compiler-cli): detect uninvoked signals in bound expressions using ternaryfd4ddcafix(compiler): use regular optional chaining expression for safe function cal...c3be83crefactor(core): allow AnimationClassBindingFn to return undefined or nullMaintainer changes
This version was pushed to npm by google-wombot, a new releaser for
@angular/compiler-clisince your current version.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.