Bump webpack-dev-server and @angular-devkit/build-angular in /Standalone#546
Bump webpack-dev-server and @angular-devkit/build-angular in /Standalone#546dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) to 5.2.5 and updates ancestor dependency [@angular-devkit/build-angular](https://github.com/angular/angular-cli). These dependencies need to be updated together. Updates `webpack-dev-server` from 4.15.1 to 5.2.5 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.1...v5.2.5) Updates `@angular-devkit/build-angular` from 17.0.0 to 21.2.16 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@17.0.0...v21.2.16) --- updated-dependencies: - dependency-name: webpack-dev-server dependency-version: 5.2.5 dependency-type: indirect - dependency-name: "@angular-devkit/build-angular" dependency-version: 21.2.16 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Semgrep found 1 Risk: Affected versions of vite and vite-plus are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Vite's server.fs.deny blocklist—which protects sensitive files such as .env and certificate files from being served—can be bypassed on Windows using alternate path representations (NTFS Alternate Data Stream syntax like Manual Review Advice: A vulnerability from this advisory is reachable if you expose the Vite dev server or vite-plus to the network by configuring a non-loopback address using the --host CLI flag on Windows Fix: Upgrade this library to at least version 7.3.5 at auth0-angular-samples/Standalone/package-lock.json:389. Reference(s): GHSA-fx2h-pf6j-xcff Semgrep found 1 Risk: Affected versions of esbuild are vulnerable to Download of Code Without Integrity Check / Untrusted Search Path. esbuild's Deno distribution module ( Manual Review Advice: A vulnerability from this advisory is reachable if you invoke the esbuild Deno module directly as a CLI tool (e.g. Fix: Upgrade this library to at least version 0.28.1 at auth0-angular-samples/Standalone/package-lock.json:10444. Reference(s): GHSA-gv7w-rqvm-qjhr |
Bumps webpack-dev-server to 5.2.5 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.
Updates
webpack-dev-serverfrom 4.15.1 to 5.2.5Release notes
Sourced from webpack-dev-server's releases.
... (truncated)
Changelog
Sourced from webpack-dev-server's changelog.
... (truncated)
Commits
c3ee325chore(release): new release (#5682)60173befeat: add changeset validation and release workflow (#5680)948d5e6fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)93e8996fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...fd40130chore(release): 5.2.4ece4f36chore: update deps (#5661)a216144ci: fix test (#5658)df073c5Merge commit from forkb550a70chore(release): 5.2.39704dc5chore: upgrade selfsigned to v5 and remove node-forge dependency (#5618)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
@angular-devkit/build-angularfrom 17.0.0 to 21.2.16Release notes
Sourced from @angular-devkit/build-angular's releases.
... (truncated)
Changelog
Sourced from @angular-devkit/build-angular's changelog.
... (truncated)
Commits
1efc647release: cut the v21.2.16 release14459e2build: update dependency webpack-dev-server to 5.2.577c9047fix(@angular/cli): update pacote to 21.5.1d052e97fix(@angular/ssr): prioritize options over environment variables in AngularNo...d318dddrelease: cut the v21.2.15 releasec7a7f19fix(@angular/cli): support registry metadata fetching under bun package managerbdc3d2ftest(@angular/cli): ignore engines in version-specifier E2E test when using yarn42ac0edfix(@angular/cli): remove forceAuth and unscoped credential parsing2c25333test(@angular/cli): remove unscoped authentication test cases from registry t...4488398release: cut the v21.2.14 releaseDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.