Skip to content

chore(deps): bump postcss and @angular-devkit/build-angular in /angular8 - #196

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/angular8/multi-36e024d742
Open

chore(deps): bump postcss and @angular-devkit/build-angular in /angular8#196
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/angular8/multi-36e024d742

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 5, 2026

Copy link
Copy Markdown
Contributor

Bumps postcss to 8.5.25 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates postcss from 8.4.31 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates @angular-devkit/build-angular from 15.2.10 to 22.1.3

Release notes

Sourced from @​angular-devkit/build-angular's releases.

22.1.3

@​angular/cli

Commit Description
fix - f837b788c6 always install package during ng add to inspect manifest on disk for schematics (#33718)
fix - 72ae93638d correctly report available package updates during bare ng update
fix - a949e06568 discover migrations from installed packages when omitted by registry metadata (#33718)
fix - 1d9122fd50 normalize Windows drive-letter casing for process.cwd

@​angular/build

Commit Description
fix - a4860d505a prevent build process hang on unhandled error (#33715)
fix - 7686d66cab retain watch files on error in load result cache
fix - 25b7cf7504 support case-insensitive and alternative license file names
perf - 4fd81402ce release build resources early in non-watch mode (#33715)

@​angular/ssr

Commit Description
fix - 6af906cb94 settle writeResponseToNodeResponse when client disconnects
perf - 917d3b2254 avoid buffering request body when sanitizing headers

22.1.2

@​angular/cli

Commit Description
fix - 57db27ea91 add packages with built-in schematics to devDependencies only

@​angular/build

Commit Description
fix - baed978885 prevent IIFE wrapper interleaving for adjacent classes in minified files

22.1.1

@​angular/cli

Commit Description
fix - ab971a8543 support npm 12 metadata array and error formats

@​angular/build

Commit Description
fix - db24220fb8 rewrite paths from sandboxed execroots when running under Bazel

22.1.0

@​angular/cli

Commit Description
fix - f59bcf529 abort and guide manual mitigation when updating catalog packages
fix - 48f90f5d5 prevent Yarn registry environment variable override
fix - c963ecbec remove algoliasearch dependency and support latest docs versions
fix - 6859d25c3 resolve correct registry name when using npm alias syntax during update
fix - 3a2589dac respect client-side release age settings during update resolution

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

22.1.3 (2026-08-05)

@​angular/cli

Commit Type Description
f837b788c6 fix always install package during ng add to inspect manifest on disk for schematics (#33718)
72ae93638d fix correctly report available package updates during bare ng update
a949e06568 fix discover migrations from installed packages when omitted by registry metadata (#33718)
1d9122fd50 fix normalize Windows drive-letter casing for process.cwd

@​angular/build

Commit Type Description
a4860d505a fix prevent build process hang on unhandled error (#33715)
7686d66cab fix retain watch files on error in load result cache
25b7cf7504 fix support case-insensitive and alternative license file names
4fd81402ce perf release build resources early in non-watch mode (#33715)

@​angular/ssr

Commit Type Description
6af906cb94 fix settle writeResponseToNodeResponse when client disconnects
917d3b2254 perf avoid buffering request body when sanitizing headers

21.2.20 (2026-08-05)

@​angular-devkit/build-angular

Commit Type Description
972f6db7e9 fix upgrade postcss to 8.5.23

@​angular/build

Commit Type Description
8de75ada50 fix upgrade postcss to 8.5.23

20.3.33 (2026-08-05)

... (truncated)

Commits
  • 60078fc release: cut the v22.1.3 release
  • 434e070 refactor(@​angular/cli): remove unused eslint-disable comment in git utility
  • 3a49bd4 build: update pnpm to v11.20.0
  • 7686d66 fix(@​angular/build): retain watch files on error in load result cache
  • 1d9122f fix(@​angular/cli): normalize Windows drive-letter casing for process.cwd
  • 4e54f3a ci: schedule ng-snapshot Renovate updates for early morning only
  • 6f75b73 build: update cross-repo angular dependencies
  • 25b7cf7 fix(@​angular/build): support case-insensitive and alternative license file names
  • 212373a build: lock file maintenance
  • 74d6d0b build: update dependency postcss to v8.5.25
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump postcss and @angular-devkit/build-angular in /angular8
081a4dc 
Bumps [postcss](https://github.com/postcss/postcss) to 8.5.25 and updates ancestor dependency [@angular-devkit/build-angular](https://github.com/angular/angular-cli). These dependencies need to be updated together.


Updates `postcss` from 8.4.31 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.31...8.5.25)

Updates `@angular-devkit/build-angular` from 15.2.10 to 22.1.3
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](angular/angular-cli@15.2.10...v22.1.3)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
- dependency-name: "@angular-devkit/build-angular"
  dependency-version: 22.1.3
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 5, 2026
@semgrep-code-auth0-samples

semgrep-code-auth0-samples Bot commented Aug 5, 2026

Copy link
Copy Markdown

Semgrep found 1 ssc-ace67ff4-0843-40f4-a8d3-13e050943589 finding:

Risk: Affected versions of js-yaml are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). js-yaml is vulnerable to prototype pollution through its YAML merge key (<<) handling. When parsing untrusted YAML with load, loadAll, safeLoad, or safeLoadAll, a crafted document containing a __proto__ key inside a merged mapping can modify the prototype of the resulting object, leading to integrity violations in the application.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using js-yaml on the CLI

Fix: Upgrade this library to at least version 3.14.2 at angular2-jwt-samples/angular8/package-lock.json:14650.

Reference(s): GHSA-mh29-5h37-fv8m, CVE-2025-64718

Semgrep found 1 ssc-mal-11e0168e322a88b7a928c64b1f3ac77c0cab9fd6 finding:

Risk: samples-bootstrap-theme contains malicious code. Remove it immediately.

Fix: There are no safe versions of this library available for upgrade. Library included at angular2-jwt-samples/angular8/package-lock.json:20748.

Reference(s): https://osv.dev/vulnerability/MAL-2022-5922

Semgrep found 1 ssc-b5be3fd7-c1fb-4156-b16f-2fc35cb62b00 finding:

Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. An attacker can supply a YAML document containing a chain of mappings that each merge the previous one via the merge key (<<), causing js-yaml to spend quadratic CPU time while parsing input whose size grows only linearly, resulting in a denial of service.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using js-yaml on the CLI

Fix: Upgrade this library to at least version 3.15.0 at angular2-jwt-samples/angular8/package-lock.json:14650.

Reference(s): GHSA-52cp-r559-cp3m, CVE-2026-59869

Semgrep found 1 ssc-2427bad3-7619-448f-8f95-70806990606e finding:

Risk: Affected versions of @angular/compiler are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). A stored XSS vulnerability in the Angular Template Compiler arises because its internal security schema doesn't classify certain URL‐ holding attributes (e.g. xlink:href, math|href, annotation|href) or the attributeName binding on SVG animation elements (<animate>, <set>, etc.) as requiring strict URL sanitization. An attacker who can supply untrusted input to template bindings like [attr.xlink:href] or <animate [attributeName]="'href'" [values]="maliciousURL"> can inject a javascript: URL payload. When the element is activated (e.g. clicked) or the animation runs, the malicious script executes in the application's origin, enabling session hijacking, data exfiltration, or unauthorized actions.

Manual Review Advice: A vulnerability from this advisory is reachable if you allow SVG/MathML attributes (e.g., xlink:href, href) or to the attributeName field of SVG animation tags (, , etc.) in HTML templates

Fix: Upgrade this library to at least version 19.2.17 at angular2-jwt-samples/angular8/package-lock.json:1867.

Reference(s): GHSA-v4hv-rgfq-gp49, CVE-2025-66412

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants