Bump tar, @angular-devkit/build-angular, @angular-eslint/schematics, @angular/cli and ng-packagr#810
Conversation
…@angular/cli and ng-packagr Bumps [tar](https://github.com/isaacs/node-tar) to 7.5.16 and updates ancestor dependencies [tar](https://github.com/isaacs/node-tar), [@angular-devkit/build-angular](https://github.com/angular/angular-cli), [@angular-eslint/schematics](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/schematics), [@angular/cli](https://github.com/angular/angular-cli) and [ng-packagr](https://github.com/ng-packagr/ng-packagr). These dependencies need to be updated together. Updates `tar` from 6.2.0 to 7.5.16 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.2.0...v7.5.16) Updates `@angular-devkit/build-angular` from 14.2.13 to 21.2.16 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@14.2.13...v21.2.16) Updates `@angular-eslint/schematics` from 14.4.0 to 22.0.0 - [Release notes](https://github.com/angular-eslint/angular-eslint/releases) - [Changelog](https://github.com/angular-eslint/angular-eslint/blob/main/packages/schematics/CHANGELOG.md) - [Commits](https://github.com/angular-eslint/angular-eslint/commits/v22.0.0/packages/schematics) Updates `@angular/cli` from 14.2.13 to 22.0.3 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@14.2.13...v22.0.3) Updates `ng-packagr` from 14.2.2 to 22.0.0 - [Release notes](https://github.com/ng-packagr/ng-packagr/releases) - [Changelog](https://github.com/ng-packagr/ng-packagr/blob/main/CHANGELOG.md) - [Commits](ng-packagr/ng-packagr@14.2.2...22.0.0) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.16 dependency-type: indirect - dependency-name: "@angular-devkit/build-angular" dependency-version: 21.2.16 dependency-type: direct:development - dependency-name: "@angular-eslint/schematics" dependency-version: 22.0.0 dependency-type: direct:development - dependency-name: "@angular/cli" dependency-version: 22.0.3 dependency-type: direct:development - dependency-name: ng-packagr dependency-version: 22.0.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
Semgrep found 1 Risk: Affected versions of vite and vite-plus are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Vite's server.fs.deny blocklist—which protects sensitive files such as .env and certificate files from being served—can be bypassed on Windows using alternate path representations (NTFS Alternate Data Stream syntax like Manual Review Advice: A vulnerability from this advisory is reachable if you expose the Vite dev server or vite-plus to the network by configuring a non-loopback address using the --host CLI flag on Windows Fix: Upgrade this library to at least version 7.3.5 at angular2-jwt/package-lock.json:667. Reference(s): GHSA-fx2h-pf6j-xcff Semgrep found 1 Risk: Affected versions of esbuild are vulnerable to Download of Code Without Integrity Check / Untrusted Search Path. esbuild's Deno distribution module ( Manual Review Advice: A vulnerability from this advisory is reachable if you invoke the esbuild Deno module directly as a CLI tool (e.g. Fix: Upgrade this library to at least version 0.28.1 at angular2-jwt/package-lock.json:12097. Reference(s): GHSA-gv7w-rqvm-qjhr |
Bumps tar to 7.5.16 and updates ancestor dependencies tar, @angular-devkit/build-angular, @angular-eslint/schematics, @angular/cli and ng-packagr. These dependencies need to be updated together.
Updates
tarfrom 6.2.0 to 7.5.16Changelog
Sourced from tar's changelog.
... (truncated)
Commits
cf213387.5.1621a8220do not apply PAX header fields to meta entries52632cfupdate project deps302f51ffix inconsequential typo in PENDINGLINKS symbol name55dbb99remove some uses of mutate-fs87cc3097.5.157aef486fix: regression in pending links detection6244eb37.5.149704d8cstricter protection against hardlinks preempting their targets700734fupdate workflows and depsMaintainer changes
This version was pushed to npm by isaacs, a new releaser for tar since your current version.
Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Updates
@angular-devkit/build-angularfrom 14.2.13 to 21.2.16Release notes
Sourced from @angular-devkit/build-angular's releases.
... (truncated)
Changelog
Sourced from @angular-devkit/build-angular's changelog.
... (truncated)
Commits
1efc647release: cut the v21.2.16 release14459e2build: update dependency webpack-dev-server to 5.2.577c9047fix(@angular/cli): update pacote to 21.5.1d052e97fix(@angular/ssr): prioritize options over environment variables in AngularNo...d318dddrelease: cut the v21.2.15 releasec7a7f19fix(@angular/cli): support registry metadata fetching under bun package managerbdc3d2ftest(@angular/cli): ignore engines in version-specifier E2E test when using yarn42ac0edfix(@angular/cli): remove forceAuth and unscoped credential parsing2c25333test(@angular/cli): remove unscoped authentication test cases from registry t...4488398release: cut the v21.2.14 releaseUpdates
@angular-eslint/schematicsfrom 14.4.0 to 22.0.0Release notes
Sourced from @angular-eslint/schematics's releases.
... (truncated)
Changelog
Sourced from @angular-eslint/schematics's changelog.
... (truncated)
Commits
7ee4556chore(release): publish 22.0.0526640ffeat!: drop support for eslint v8 and legacy eslintrc config format (#3056)0a774c7chore(release): publish 21.4.07a48a63fix(schematics): sync application schema with upstream@schematics/angular(#...8f2afdcchore(release): publish 21.3.1a959e4dchore(release): publish 21.3.03ef7fb1feat: add support for ESLint v10 (#2903)6fa321dchore(release): publish 21.2.04fa7889chore(release): publish 21.1.0e7bb47bfix: reference@angular/clipeer in addition to direct dependencies (#2820)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@angular-eslint/schematicssince your current version.Updates
@angular/clifrom 14.2.13 to 22.0.3Release notes
Sourced from @angular/cli's releases.
... (truncated)
Changelog
Sourced from @angular/cli's changelog.
... (truncated)
Commits
b30b9d3release: cut the v22.0.3 releasebc97bb3build: update dependency vite to v7.3.50eddea8fix(@schematics/angular): remove default workspace vscode mcp.json configuration08f9959refactor(@angular/cli): promote experimental MCP tools to stableaab6c10release: cut the v22.0.2 release376e4dcbuild: update cross-repo angular dependenciesd996a27fix(@angular/ssr): avoid caching non-SSG page lookups5714bfcbuild: update pnpm to v10.34.3f26011abuild: lock file maintenance2879ed9build: update bazel dependenciesUpdates
ng-packagrfrom 14.2.2 to 22.0.0Release notes
Sourced from ng-packagr's releases.
... (truncated)
Changelog
Sourced from ng-packagr's changelog.
... (truncated)
Commits
e918dc3release: cut 22.0.07f8a814build: update@angular/compiler-clipeer dependency range to support version ...e7d8e38fix(ng-packagr): invalidate angularDiagnosticCache for html changes7204d85build: update pnpm workspace configuration and remove redundant pnpm settings2684271build: lock file maintenance15a0f56build: update dependency node to v245827827build: update@angular/ng-devdigest to a450a243439543build: update pnpm to v11.4.0efed766build: update dessant/lock-threads digest to 89ae32b27ae92ebuild: update all non-major dependencies to v8.60.0Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for ng-packagr since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.