Skip to content

build: lock file maintenance (main)#32946

Merged
dgp1130 merged 1 commit into
angular:mainfrom
angular-robot:ng-renovate/main-lock-file-maintenance
Apr 8, 2026
Merged

build: lock file maintenance (main)#32946
dgp1130 merged 1 commit into
angular:mainfrom
angular-robot:ng-renovate/main-lock-file-maintenance

Conversation

@angular-robot

@angular-robot angular-robot commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Update Change
lockFileMaintenance All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.


  • If you want to rebase/retry this PR, check this box

@angular-robot angular-robot added action: merge The PR is ready for merge by the caretaker area: build & ci Related the build and CI infrastructure of the project target: automation This PR is targeted to only merge into the branch defined in Github [bot use only] labels Apr 7, 2026

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates numerous dependencies in pnpm-lock.yaml. Several security concerns were identified regarding suspicious package versions and the removal of deprecation warnings for vulnerable packages. Specifically, lodash@4.18.1 and express-rate-limit@8.3.2 appear to be non-standard or potentially malicious versions. Additionally, the removal of the deprecation notice for @xmldom/xmldom@0.8.12 is problematic as that version contains known critical vulnerabilities.

Comment thread pnpm-lock.yaml
Comment thread pnpm-lock.yaml
Comment thread pnpm-lock.yaml
@angular-robot
angular-robot force-pushed the ng-renovate/main-lock-file-maintenance branch from 90957bd to f6fddfb Compare April 7, 2026 08:51
See associated pull request for more information.
@angular-robot
angular-robot force-pushed the ng-renovate/main-lock-file-maintenance branch from f6fddfb to 1e57f31 Compare April 8, 2026 16:52
@dgp1130
dgp1130 merged commit 7927a97 into angular:main Apr 8, 2026
35 checks passed
@dgp1130

dgp1130 commented Apr 8, 2026

Copy link
Copy Markdown
Collaborator

This PR was merged into the repository. The changes were merged into the following branches:

@angular-automatic-lock-bot

Copy link
Copy Markdown

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

This action has been performed automatically by a bot.

@angular-automatic-lock-bot angular-automatic-lock-bot Bot locked and limited conversation to collaborators May 9, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

action: merge The PR is ready for merge by the caretaker area: build & ci Related the build and CI infrastructure of the project target: automation This PR is targeted to only merge into the branch defined in Github [bot use only]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants