chore: resolve open dependabot security alerts - #1446
Merged
Conversation
- undici -> 7.29.0 via override on @angular/build (high, alerts #264,263,262,261,260) - @hono/node-server -> 2.1.0 via override on @modelcontextprotocol/sdk (high, alert #232) - uuid -> 11.1.1 via override on @cucumber/messages and jest-cucumber (high, alert #179) - ip-address -> 10.4.0 (moderate, alerts covering transitive resolution) - js-yaml -> 4.3.1 (eslint dependency, moderate) - postcss -> 8.5.25 (moderate) - @angular/core, @angular/common, @angular/compiler, @angular/compiler-cli, @angular/animations, @angular/forms, @angular/platform-browser, @angular/platform-browser-dynamic, @angular/router -> 21.2.19 (moderate) Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR adds ChangesAngular dependency management
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
jonathannorris
marked this pull request as ready for review
August 4, 2026 14:12
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/angular/package.json`:
- Around line 24-34: Update `@angular/common`, `@angular/compiler`,
`@angular/compiler-cli`, and `@angular/core` in packages/angular/package.json to
^21.2.19, then refresh the lockfile so the Angular dependency graph is aligned.
Also verify the sibling entries in
packages/angular/projects/angular-sdk/package.json at lines 28-31; no direct
change is needed there unless the lockfile refresh requires it.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 81ae27f7-ef7f-46cc-9a36-4728ace7119a
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (3)
package.jsonpackages/angular/package.jsonpackages/angular/projects/angular-sdk/package.json
Comment on lines
+24
to
+34
| "@angular/animations": "^21.2.19", | ||
| "@angular/build": "^21.2.19", | ||
| "@angular/cli": "^21.2.19", | ||
| "@angular/common": "^21.2.17", | ||
| "@angular/compiler": "^21.2.17", | ||
| "@angular/compiler-cli": "^21.2.17", | ||
| "@angular/core": "^21.2.17", | ||
| "@angular/forms": "^21.2.17", | ||
| "@angular/platform-browser": "^21.2.17", | ||
| "@angular/platform-browser-dynamic": "^21.2.17", | ||
| "@angular/router": "^21.2.17", | ||
| "@angular/forms": "^21.2.19", | ||
| "@angular/platform-browser": "^21.2.19", | ||
| "@angular/platform-browser-dynamic": "^21.2.19", | ||
| "@angular/router": "^21.2.19", |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Relevant package.json version entries:\n'
for f in packages/angular/package.json packages/angular/projects/angular-sdk/package.json; do
echo "--- $f"
python3 - <<'PY' "$f"
import json, sys
p=sys.argv[1]
with open(p) as fh:
data=json.load(fh)
for sec in ('dependencies','devDependencies','peerDependencies','overrides','resolutions'):
deps=data.get(sec)
if deps:
print(f'[{sec}]')
for k,v in sorted(deps.items()):
if k.startswith('`@angular/`'):
print(f'{k}: {v}')
PY
done
printf '\nAll Angular package declaration sites:\n'
rg -n '"`@angular/`(animations|build|cli|common|compiler|compiler-cli|core|forms|platform-browser|platform-browser-dynamic|router|openfeature)"\s*:' -S .Repository: open-feature/js-sdk
Length of output: 5191
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Angular package lock/installer files present:\n'
git ls-files | rg '(^|/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb|bun\.lock)$|packages/angular/(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb|bun\.lock)$' || true
printf '\nLockfile Angular version entries (top-level occurrences if present):\n'
for lock in package-lock.json pnpm-lock.yaml yarn.lock bun.lock; do
if [ -f "$lock" ]; then
echo "--- $lock"
rg -n '`@angular/`(common|compiler|compiler-cli|core|form|platform-browser|router|animations|build|cli)',max-count=80 "$lock" || true
fi
doneRepository: open-feature/js-sdk
Length of output: 313
Align Angular package versions to ^21.2.19. packages/angular/package.json still pins @angular/common, @angular/compiler, @angular/compiler-cli, and @angular/core to ^21.2.17, while sibling Angular packages in this package and the SDK dependency entries use ^21.2.19. Update those four ranges to ^21.2.19 and refresh the lockfile to keep the Angular graph aligned.
📍 Affects 2 files
packages/angular/package.json#L24-L34(this comment)packages/angular/projects/angular-sdk/package.json#L28-L31
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/angular/package.json` around lines 24 - 34, Update `@angular/common`,
`@angular/compiler`, `@angular/compiler-cli`, and `@angular/core` in
packages/angular/package.json to ^21.2.19, then refresh the lockfile so the
Angular dependency graph is aligned. Also verify the sibling entries in
packages/angular/projects/angular-sdk/package.json at lines 28-31; no direct
change is needed there unless the lockfile refresh requires it.
- hono 4.12.32 -> 4.13.1 (patched 4.12.34, alerts #269, #270, #271) - fast-uri 3.1.4 -> 3.1.5 (patched 3.1.5, alert #268) - add @angular/compiler as explicit root devDependency so it hoists alongside @angular/core, fixing 'Cannot find package @angular/compiler' failures in build-test CI caused by npm's workspace hoisting decision for the 21.2.19 Angular peer graph Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
The overrides were load-bearing: @angular/build exact-pins undici 7.28.0, @angular/cli->mcp-sdk pins @hono/node-server ^1.19.9, and jest-cucumber pins uuid ^10, so no parent-bump path exists without an Angular 22 major. All three are build/test tooling, not in any published @openfeature/* runtime surface, so dismiss them in Dependabot as not-in-production-path rather than carrying overrides that a fresh npm install silently reverts. Keeps the legit in-range bumps (ip-address, js-yaml, postcss, @angular 21.2.19).
toddbaert
approved these changes
Aug 12, 2026
Signed-off-by: Todd Baert <todd.baert@dynatrace.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
overridesonly where a vulnerable transitive version was pinned by a parent with no direct upgrade path)Dependabot Alerts Resolved
undici^7.29.0scoped to@angular/buildundici^7.29.0scoped to@angular/buildundici^7.29.0scoped to@angular/buildundici^7.29.0scoped to@angular/buildundici^7.29.0scoped to@angular/build@hono/node-server^2.1.0scoped to@modelcontextprotocol/sdkuuid^11.1.1scoped to@cucumber/messagesandjest-cucumberip-address10.4.0js-yaml4.3.1(eslint copy)postcss8.5.25@angular/*@angular/core,@angular/common,@angular/compiler,@angular/compiler-cli,@angular/animations,@angular/forms,@angular/platform-browser,@angular/platform-browser-dynamic,@angular/routerto21.2.19Notes on the
@hono/node-serveroverride: version2.0.5-2.0.9carry a separate known memory-leak DoS advisory (GHSA-9mqv-5hh9-4cgg), so the override target was set to^2.1.0rather than the minimum patched version.Verification
npm cisucceeds cleanly from a fresh installnpm run buildpassesnpm run test:jestpasses (35/35 suites, 612/612 tests)npm run test:angularpasses (3/3 suites, 45/45 tests)npm auditshows only pre-existing findings unrelated to the 14 resolved alerts