From 8b997cf357e821484d2147eedd3860e7d85ce8af Mon Sep 17 00:00:00 2001 From: Daniel Sogl Date: Mon, 27 Jul 2026 21:41:54 +0200 Subject: [PATCH] fix(deps): update angular to 20.3.26 to patch @babel/core advisory @angular/compiler-cli pinned @babel/core 7.29.0, which is affected by GHSA-4x5r-pxfx-6jf8 (arbitrary file read via sourceMappingURL). 20.3.26 pins 7.29.7. Staying inside Angular 20 keeps the emitted partial-compilation declarations unchanged (minVersion 12.0.0), so nothing changes for consumers. npm audit fix additionally resolved the transitive brace-expansion GHSA-3jxr-9vmj-r5cp in the lockfile. --- package-lock.json | 111 ++++++++++++++++++++++------------------------ package.json | 8 ++-- 2 files changed, 58 insertions(+), 61 deletions(-) diff --git a/package-lock.json b/package-lock.json index b2924d9a2..e4fc88b86 100644 --- a/package-lock.json +++ b/package-lock.json @@ -12,10 +12,10 @@ "tslib": "2.8.1" }, "devDependencies": { - "@angular/common": "20.3.18", - "@angular/compiler": "20.3.18", - "@angular/compiler-cli": "20.3.18", - "@angular/core": "20.3.18", + "@angular/common": "20.3.26", + "@angular/compiler": "20.3.26", + "@angular/compiler-cli": "20.3.26", + "@angular/core": "20.3.26", "@eslint/js": "^10.0.0", "@swc/core": "^1.15.46", "@swc/jest": "^0.2.39", @@ -41,24 +41,10 @@ "node": ">=20" } }, - "node_modules/@ampproject/remapping": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.3.0.tgz", - "integrity": "sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==", - "dev": true, - "license": "Apache-2.0", - "dependencies": { - "@jridgewell/gen-mapping": "^0.3.5", - "@jridgewell/trace-mapping": "^0.3.24" - }, - "engines": { - "node": ">=6.0.0" - } - }, "node_modules/@angular/common": { - "version": "20.3.18", - "resolved": "https://registry.npmjs.org/@angular/common/-/common-20.3.18.tgz", - "integrity": "sha512-M62oQbSTRmnGavIVCwimoadg/PDWadgNhactMm9fgH0eM9rx+iWBAYJk4VufO0bwOhysFpRZpJgXlFjOifz/Jw==", + "version": "20.3.26", + "resolved": "https://registry.npmjs.org/@angular/common/-/common-20.3.26.tgz", + "integrity": "sha512-35+aHaCmldFZ2qFiH83+cHcDXwUqSEuUR5DVApcd+Ku8PfIIGo8uMiD5++Qq7QIUTbZCD2glAiE9jLroGrf1Cw==", "dev": true, "license": "MIT", "dependencies": { @@ -68,14 +54,14 @@ "node": "^20.19.0 || ^22.12.0 || >=24.0.0" }, "peerDependencies": { - "@angular/core": "20.3.18", + "@angular/core": "20.3.26", "rxjs": "^6.5.3 || ^7.4.0" } }, "node_modules/@angular/compiler": { - "version": "20.3.18", - "resolved": "https://registry.npmjs.org/@angular/compiler/-/compiler-20.3.18.tgz", - "integrity": "sha512-AaP/LCiDNcYmF135EEozjyR04NRBT38ZfBHQwjhgwiBBTejmvcpHwJaHSkraLpZqZzE4BQqqmgiQ1EJqxEwLVA==", + "version": "20.3.26", + "resolved": "https://registry.npmjs.org/@angular/compiler/-/compiler-20.3.26.tgz", + "integrity": "sha512-H4DVTBCiyM4dGytFi2C8sMGflxXzPnoQ6Ajfs4hJ/Dekg6ypfvW5Ze7BDh4TaMQvaX2joM5LhBYW5jTxBx66hA==", "dev": true, "license": "MIT", "dependencies": { @@ -86,13 +72,13 @@ } }, "node_modules/@angular/compiler-cli": { - "version": "20.3.18", - "resolved": "https://registry.npmjs.org/@angular/compiler-cli/-/compiler-cli-20.3.18.tgz", - "integrity": "sha512-zsoEgLgnblmRbi47YwMghKirJ8IBKJ3+I8TxLBRIBrhx+KHFp+6oeDeLyu9H+djdyk88zexVd09wzR/YK73F0g==", + "version": "20.3.26", + "resolved": "https://registry.npmjs.org/@angular/compiler-cli/-/compiler-cli-20.3.26.tgz", + "integrity": "sha512-3rHtC87ecldvaiFHwQEZ6Wx3QaZ/Q7b0Gb7XORDOjn/M+5CYZ4rQsvbxE5TUjwreg07oQ4Y2h8ADESXTJEUYOQ==", "dev": true, "license": "MIT", "dependencies": { - "@babel/core": "7.28.3", + "@babel/core": "7.29.7", "@jridgewell/sourcemap-codec": "^1.4.14", "chokidar": "^4.0.0", "convert-source-map": "^1.5.1", @@ -109,7 +95,7 @@ "node": "^20.19.0 || ^22.12.0 || >=24.0.0" }, "peerDependencies": { - "@angular/compiler": "20.3.18", + "@angular/compiler": "20.3.26", "typescript": ">=5.8 <6.0" }, "peerDependenciesMeta": { @@ -119,9 +105,9 @@ } }, "node_modules/@angular/core": { - "version": "20.3.18", - "resolved": "https://registry.npmjs.org/@angular/core/-/core-20.3.18.tgz", - "integrity": "sha512-B+NQQngd/aDbcfW0zGLis3wTLDeHTeTYMl/mGKQH+HwdPaRCKI1wEtaXaOYVJXkP2FeThocPevB8gLwNlPQUUw==", + "version": "20.3.26", + "resolved": "https://registry.npmjs.org/@angular/core/-/core-20.3.26.tgz", + "integrity": "sha512-v+YtZ9eQVDb6v3V1TbUUBHU63FEp8Hqqqb3UhM4MLAOm0chyyh9jah7FiHr3HbCKrV1f4long1coftFK/KThog==", "dev": true, "license": "MIT", "dependencies": { @@ -131,7 +117,7 @@ "node": "^20.19.0 || ^22.12.0 || >=24.0.0" }, "peerDependencies": { - "@angular/compiler": "20.3.18", + "@angular/compiler": "20.3.26", "rxjs": "^6.5.3 || ^7.4.0", "zone.js": "~0.15.0" }, @@ -191,22 +177,22 @@ } }, "node_modules/@babel/core": { - "version": "7.28.3", - "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.28.3.tgz", - "integrity": "sha512-yDBHV9kQNcr2/sUr9jghVyz9C3Y5G2zUM2H2lo+9mKv4sFgbA8s8Z9t8D1jiTkGoO/NoIfKMyKWr4s6CN23ZwQ==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz", + "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==", "dev": true, "license": "MIT", "dependencies": { - "@ampproject/remapping": "^2.2.0", - "@babel/code-frame": "^7.27.1", - "@babel/generator": "^7.28.3", - "@babel/helper-compilation-targets": "^7.27.2", - "@babel/helper-module-transforms": "^7.28.3", - "@babel/helpers": "^7.28.3", - "@babel/parser": "^7.28.3", - "@babel/template": "^7.27.2", - "@babel/traverse": "^7.28.3", - "@babel/types": "^7.28.2", + "@babel/code-frame": "^7.29.7", + "@babel/generator": "^7.29.7", + "@babel/helper-compilation-targets": "^7.29.7", + "@babel/helper-module-transforms": "^7.29.7", + "@babel/helpers": "^7.29.7", + "@babel/parser": "^7.29.7", + "@babel/template": "^7.29.7", + "@babel/traverse": "^7.29.7", + "@babel/types": "^7.29.7", + "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", @@ -2015,6 +2001,17 @@ "@jridgewell/trace-mapping": "^0.3.24" } }, + "node_modules/@jridgewell/remapping": { + "version": "2.3.5", + "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz", + "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "@jridgewell/gen-mapping": "^0.3.5", + "@jridgewell/trace-mapping": "^0.3.24" + } + }, "node_modules/@jridgewell/resolve-uri": { "version": "3.1.2", "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz", @@ -3851,16 +3848,16 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/browserslist": { @@ -4897,9 +4894,9 @@ "license": "MIT" }, "node_modules/glob/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "dev": true, "license": "MIT", "dependencies": { @@ -7477,9 +7474,9 @@ "license": "MIT" }, "node_modules/test-exclude/node_modules/brace-expansion": { - "version": "1.1.15", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz", - "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index b9691187e..ab9b36a69 100644 --- a/package.json +++ b/package.json @@ -27,10 +27,10 @@ "tslib": "2.8.1" }, "devDependencies": { - "@angular/common": "20.3.18", - "@angular/compiler": "20.3.18", - "@angular/compiler-cli": "20.3.18", - "@angular/core": "20.3.18", + "@angular/common": "20.3.26", + "@angular/compiler": "20.3.26", + "@angular/compiler-cli": "20.3.26", + "@angular/core": "20.3.26", "@eslint/js": "^10.0.0", "@swc/core": "^1.15.46", "@swc/jest": "^0.2.39",