Skip to content

Update various dependencies to fix vulnerabilities - #2618

Open
lucas-koehler wants to merge 4 commits into
masterfrom
lk/update-deps
Open

lucas-koehler wants to merge 4 commits into
masterfrom
lk/update-deps

Conversation

@lucas-koehler

@lucas-koehler lucas-koehler commented Aug 27, 2026 •

Copy link
Copy Markdown
Contributor
  • Explicitly bump babel and angular dependencies to fix various open dependabot alerts
  • Bump dependencies to fix all known vulnerabilities in production (i.e. not dev) dependencies

@netlify

netlify Bot commented Aug 27, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for jsonforms-examples ready!

Name Link
🔨 Latest commit 7a64043
🔍 Latest deploy log https://app.netlify.com/projects/jsonforms-examples/deploys/6ab29f3b895b8a0008608f68
😎 Deploy Preview https://deploy-preview-2618--jsonforms-examples.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@lucas-koehler
lucas-koehler requested a review from sdirix August 27, 2026 16:17
@coveralls

coveralls commented Aug 27, 2026 •

Copy link
Copy Markdown

Coverage Status

coverage: 84.521%. remained the same — lk/update-deps into master

@lucas-koehler lucas-koehler added the dependencies Pull requests that update a dependency file label Sep 22, 2026
@lucas-koehler lucas-koehler added this to the 3.9 milestone Sep 22, 2026

@sdirix sdirix left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Works for me. Just minor suggestions which could also be done in a follow up.

@@ -88,7 +88,7 @@
"dependencies": {
"@date-io/dayjs": "^3.0.0",
"dayjs": "1.10.7",

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dayjs is the one production dependency left untouched here while dev dayjs moved to ^1.11.11 in angular-material and vue-vuetify. Was skipping it deliberate? We should also use a caret here, I think.

Comment thread package.json
"@babel/plugin-proposal-nullish-coalescing-operator": "^7.16.5",
"@babel/plugin-proposal-optional-chaining": "^7.16.5",
"@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6",
"@babel/plugin-proposal-optional-chaining": "^7.21.0",

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These two are deprecated by Babel, but the better move is dropping them rather than bumping. They are only reachable via webpack.base.js (dev server only, build and build:examples-app use rollup) and via the NODE_ENV === 'test' branch in vue / vue-vanilla, where @vue/cli-plugin-babel/preset already pulls in preset-env, which ships both transforms already.

"@angular/platform-browser-dynamic": "^20.3.31",
"@angular/router": "^20.3.31",
"@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6",
"@babel/plugin-proposal-optional-chaining": "^7.21.0",

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These two are dead here. angular-material has no babel config and no reference to babel in its sources or build config (Angular CLI runs its own pipeline), so these devDeps are never used. Dropping them is better than bumping.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants