Skip to content

Update various dependencies to fix vulnerabilities #2618

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lucas-koehler wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Update various dependencies to fix vulnerabilities #2618

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
67fe1bf
deps: bump angular to 20.3.29
lucas-koehler Aug 27, 2026
c3c62c9
deps(dev): bump babel dependencies
lucas-koehler Aug 27, 2026
40c45c8
deps: fix vulnerabilities in production dependencies
lucas-koehler Sep 22, 2026
7a64043
deps: bump angular to 20.3.31
lucas-koehler Sep 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,8 @@
"build:examples-app": "lerna run build:examples-app && node packages/examples-app/prepare-examples-app.js"
},
"devDependencies": {
"@babel/plugin-proposal-nullish-coalescing-operator": "^7.16.5",
"@babel/plugin-proposal-optional-chaining": "^7.16.5",
"@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6",
"@babel/plugin-proposal-optional-chaining": "^7.21.0",

@sdirix sdirix Sep 22, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These two are deprecated by Babel, but the better move is dropping them rather than bumping. They are only reachable via webpack.base.js (dev server only, build and build:examples-app use rollup) and via the NODE_ENV === 'test' branch in vue / vue-vanilla, where @vue/cli-plugin-babel/preset already pulls in preset-env, which ships both transforms already.

"@istanbuljs/nyc-config-typescript": "^1.0.2",
"@types/lodash": "^4.14.149",
"ajv": "^8.18.0",
Expand Down
30 changes: 15 additions & 15 deletions packages/angular-material/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@
"rxjs": "^6.6.0 || ^7.4.0"
},
"dependencies": {
"lodash": "^4.17.21"
"lodash": "^4.18.1"
},
"devDependencies": {
"@angular-devkit/build-angular": "^20.0.0",
Expand All @@ -87,20 +87,20 @@
"@angular-eslint/eslint-plugin-template": "^20.7.0",
"@angular-eslint/schematics": "^20.7.0",
"@angular-eslint/template-parser": "^20.7.0",
"@angular/animations": "^20.3.24",
"@angular/animations": "^20.3.31",
"@angular/cdk": "^20.2.14",
"@angular/cli": "^20.3.27",
"@angular/common": "^20.3.24",
"@angular/compiler": "^20.3.24",
"@angular/compiler-cli": "^20.3.24",
"@angular/core": "^20.3.24",
"@angular/forms": "^20.3.24",
"@angular/cli": "^20.3.37",
"@angular/common": "^20.3.31",
"@angular/compiler": "^20.3.31",
"@angular/compiler-cli": "^20.3.31",
"@angular/core": "^20.3.31",
"@angular/forms": "^20.3.31",
"@angular/material": "^20.2.14",
"@angular/platform-browser": "^20.3.24",
"@angular/platform-browser-dynamic": "^20.3.24",
"@angular/router": "^20.3.24",
"@babel/plugin-proposal-nullish-coalescing-operator": "^7.16.5",
"@babel/plugin-proposal-optional-chaining": "^7.16.5",
"@angular/platform-browser": "^20.3.31",
"@angular/platform-browser-dynamic": "^20.3.31",
"@angular/router": "^20.3.31",
"@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6",
"@babel/plugin-proposal-optional-chaining": "^7.21.0",

@sdirix sdirix Sep 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These two are dead here. angular-material has no babel config and no reference to babel in its sources or build config (Angular CLI runs its own pipeline), so these devDeps are never used. Dropping them is better than bumping.

"@jsonforms/angular": "workspace:*",
"@jsonforms/core": "workspace:*",
"@jsonforms/examples": "workspace:*",
Expand All @@ -112,7 +112,7 @@
"@typescript-eslint/parser": "^5.54.1",
"babel-loader": "^8.0.6",
"copy-webpack-plugin": "^11.0.0",
"dayjs": "^1.11.10",
"dayjs": "^1.11.11",
"eslint": "^8.56.0",
"eslint-config-prettier": "^8.7.0",
"eslint-plugin-import": "^2.27.5",
Expand All @@ -134,7 +134,7 @@
"prettier": "^2.8.4",
"protractor": "^7.0.0",
"rimraf": "^6.1.0",
"rxjs": "^6.6.0",
"rxjs": "^6.6.7",
"ts-loader": "^9.5.1",
"tslib": "^2.5.0",
"typedoc": "~0.25.3",
Expand Down
12 changes: 6 additions & 6 deletions packages/angular/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@
]
},
"dependencies": {
"lodash": "^4.17.21"
"lodash": "^4.18.1"
},
"peerDependencies": {
"@angular/core": "^20.0.0 || ^21.0.0 || ^22.0.0",
Expand All @@ -81,10 +81,10 @@
"@angular-eslint/eslint-plugin-template": "^20.7.0",
"@angular-eslint/schematics": "^20.7.0",
"@angular-eslint/template-parser": "^20.7.0",
"@angular/compiler": "^20.3.24",
"@angular/compiler-cli": "^20.3.24",
"@angular/core": "^20.3.24",
"@angular/forms": "^20.3.24",
"@angular/compiler": "^20.3.31",
"@angular/compiler-cli": "^20.3.31",
"@angular/core": "^20.3.31",
"@angular/forms": "^20.3.31",
"@jsonforms/core": "workspace:*",
"@typescript-eslint/eslint-plugin": "^5.54.1",
"@typescript-eslint/parser": "^5.54.1",
Expand All @@ -98,7 +98,7 @@
"nyc": "^15.1.0",
"prettier": "^2.8.4",
"rimraf": "^6.1.0",
"rxjs": "^6.6.0",
"rxjs": "^6.6.7",
"source-map-support": "^0.5.21",
"tslib": "^2.3.0",
"typedoc": "~0.25.3",
Expand Down
6 changes: 3 additions & 3 deletions packages/core/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,10 +68,10 @@
]
},
"dependencies": {
"@types/json-schema": "^7.0.3",
"@types/json-schema": "^7.0.15",
"ajv": "^8.18.0",
"ajv-formats": "^2.1.0",
"lodash": "^4.17.21"
"ajv-formats": "^2.1.1",
"lodash": "^4.18.1"
},
"devDependencies": {
"@istanbuljs/nyc-config-typescript": "^1.0.2",
Expand Down
8 changes: 4 additions & 4 deletions packages/examples-react/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,11 @@
"@jsonforms/examples": "workspace:*",
"@jsonforms/react": "workspace:*",
"@mui/material": "^9.2.0",
"@types/react-highlight": "^0.12.5",
"@types/react-tabs": "^2.3.3",
"highlight.js": "^11.3.1",
"@types/react-highlight": "^0.12.8",
"@types/react-tabs": "^2.3.4",
"highlight.js": "^11.9.0",
"json-refs": "3.0.15",
"lodash": "^4.17.21",
"lodash": "^4.18.1",
"react": "^17.0.2",
"react-dom": "^17.0.2",
"react-highlight": "^0.14.0",
Expand Down
2 changes: 1 addition & 1 deletion packages/examples/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@
},
"dependencies": {
"ajv-i18n": "^4.2.0",
"lodash": "^4.17.21"
"lodash": "^4.18.1"
},
"peerDependencies": {
"@jsonforms/core": "3.9.0-alpha.1"
Expand Down
6 changes: 3 additions & 3 deletions packages/material-renderers/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@
"dependencies": {
"@date-io/dayjs": "^3.0.0",
"dayjs": "1.10.7",

@sdirix sdirix Sep 22, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dayjs is the one production dependency left untouched here while dev dayjs moved to ^1.11.11 in angular-material and vue-vuetify. Was skipping it deliberate? We should also use a caret here, I think.

"lodash": "^4.17.21"
"lodash": "^4.18.1"
},
"peerDependencies": {
"@emotion/react": "^11.5.0",
Expand All @@ -101,8 +101,8 @@
"react": "^16.12.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
},
"devDependencies": {
"@emotion/react": "^11.5.0",
"@emotion/styled": "^11.3.0",
"@emotion/react": "^11.11.4",
"@emotion/styled": "^11.11.5",
"@jsonforms/core": "workspace:*",
"@jsonforms/react": "workspace:*",
"@mui/icons-material": "^9.2.0",
Expand Down
2 changes: 1 addition & 1 deletion packages/react/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@
]
},
"dependencies": {
"lodash": "^4.17.21"
"lodash": "^4.18.1"
},
"peerDependencies": {
"@jsonforms/core": "3.9.0-alpha.1",
Expand Down
2 changes: 1 addition & 1 deletion packages/vanilla-renderers/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@
"customization"
],
"dependencies": {
"lodash": "^4.17.21"
"lodash": "^4.18.1"
},
"peerDependencies": {
"@jsonforms/core": "3.9.0-alpha.1",
Expand Down
8 changes: 4 additions & 4 deletions packages/vue-vanilla/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,12 +53,12 @@
"test": "vue-cli-service test:unit"
},
"dependencies": {
"lodash": "^4.17.21"
"lodash": "^4.18.1"
},
"devDependencies": {
"@babel/core": "^7.9.0",
"@babel/preset-env": "^7.9.5",
"@babel/preset-typescript": "^7.9.0",
"@babel/core": "^7.29.7",
"@babel/preset-env": "^7.29.7",
"@babel/preset-typescript": "^7.29.7",
"@jsonforms/core": "workspace:*",
"@jsonforms/vue": "workspace:*",
"@types/chai": "^4.2.11",
Expand Down
6 changes: 3 additions & 3 deletions packages/vue-vuetify/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,13 +93,13 @@
"ajv-keywords": "^5.1.0",
"core-js": "^3.9.1",
"cross-env": "^10.1.0",
"dayjs": "^1.10.6",
"dayjs": "^1.11.11",
"eslint": "^8.57.0",
"eslint-plugin-vue": "^9.23.0",
"eslint-plugin-vue-scoped-css": "^2.8.0",
"jsdom": "^27.2.0",
"json-refs": "3.0.15",
"lodash": "^4.17.21",
"lodash": "^4.18.1",
"maska": "^2.1.11",
"monaco-editor": "^0.49.0",
"npm-run-all2": "^6.1.2",
Expand All @@ -119,6 +119,6 @@
"vue": "^3.5.17",
"vue-eslint-parser": "^9.4.2",
"vue-tsc": "^2.2.0",
"vuetify": "^3.11.0"
"vuetify": "^3.12.8"
}
}
8 changes: 4 additions & 4 deletions packages/vue/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,12 +48,12 @@
"test": "jest"
},
"dependencies": {
"lodash": "^4.17.21"
"lodash": "^4.18.1"
},
"devDependencies": {
"@babel/core": "^7.16.0",
"@babel/preset-env": "^7.16.4",
"@babel/preset-typescript": "^7.9.0",
"@babel/core": "^7.29.7",
"@babel/preset-env": "^7.29.7",
"@babel/preset-typescript": "^7.29.7",
"@jsonforms/core": "workspace:*",
"@rollup/plugin-alias": "^3.1.8",
"@types/jest": "^29.5.14",
Expand Down
Loading
Loading