Repository navigation
chore(deps): October dependency sweep - #6039
Merged
norman-abramovitz merged 10 commits intoOct 21, 2026
Merged
norman-abramovitz merged 10 commits into
norman-abramovitz merged 10 commits into
Conversation
Angular 22.2.1 -> 22.2.3 and angular-eslint 22.5.0 -> 22.6.0, as Dependabot proposed in cloudfoundry#6011. The root package.json and bun.lock are that PR's result unchanged; its base had the same root manifests as develop. The nested package manifests move in the same commit: they install nothing, but the pin-drift guard fails lint on a root-only bump, which is why cloudfoundry#6011 could not merge on its own.
Supersedes cloudfoundry#6013, which bumped root only and failed the nested pin guard on src/frontend/packages/core/package.json. lockdiff: marked is the only identity that changes.
Supersedes cloudfoundry#6015. lockdiff: js-yaml is the only identity that changes.
Supersedes cloudfoundry#6014 (30.1.2); 30.1.3 is the current patch. The other 11 changed identities are jsdom's own dependencies (css-color, dom-selector, data-urls, whatwg-url, undici).
Supersedes cloudfoundry#6012: root and the builders workspace. bun left happy-dom on a nested 26.6.4 copy; that one lock entry is dropped so happy-dom shares the root 26.6.5, as in the Dependabot result. lockdiff: only @types/node changes.
The devkit package.json and package-lock.json are cloudfoundry#6010's result unchanged; devkit's manifests have not moved since its base. It brings webpack-dev-server's launch-editor to 2.14.2, which clears three Dependabot alerts on that package.
@angular/build 22.2.3 pins vite to exactly 8.3.0, inside the range (8.3.0 - 8.3.2) of three Dependabot alerts on the devkit lockfile, and no Angular patch moves it yet. An npm override lifts it to 8.3.5, the same mechanism the root package.json uses for vite. Lockfile from `npm install --package-lock-only` alone: vite brings its own rolldown 1.2.14 and postcss 8.5.31, nested; nanoid 3.3.18 -> 3.3.20. `npm dedupe` was not run: it added unrelated babel bumps. Drop the override once @angular/build requires vite >= 8.3.3.
Supersedes cloudfoundry#6038 and cloudfoundry#6034. The 11 updates cloudfoundry#6038 proposed: code.cloudfoundry.org/cli/v8 8.19.1 code.cloudfoundry.org/clock 1.91.0 github.com/aws/aws-sdk-go-v2 1.47.3 github.com/aws/aws-sdk-go-v2/config 1.33.9 github.com/aws/aws-sdk-go-v2/credentials 1.20.9 github.com/aws/aws-sdk-go-v2/service/sts 1.51.4 github.com/prometheus/client_golang 1.25.0 golang.org/x/crypto 0.58.0 golang.org/x/sync 0.24.0 helm.sh/helm/v3 3.22.1 sigs.k8s.io/aws-iam-authenticator 0.7.22 plus github.com/klauspost/compress 1.18.0 -> 1.20.1 in cfapppush, the version every other module resolves after these bumps. This clears the Dependabot alert on cfapppush/go.mod (GHSA-259r-337f-4rfw, fixed in 1.18.7). The backend binary was not exposed: through the replace directives it already resolved 1.19.1. Dependabot edits each module on its own, so cloudfoundry#6038 left monocular needing `go mod tidy` and failed lint and backend tests. All seven modules are tidied here until `go mod tidy -diff` is empty in each. aws-iam-authenticator 0.7.22 requires Go 1.27.2, which moves the go directive of jetstream, kubernetes, kubernetes/auth and monocular.
aws-iam-authenticator 0.7.22 needs Go 1.27.2, and four go.mod files now say so; the .tool-versions pin still said 1.27.1. CI is unaffected (GO_VERSION '1.27' takes the latest patch). 1.27.3 is the current release.
The security fixes (launch-editor and vite in the devkit, klauspost/compress in cfapppush) and the routine bumps from this branch, plus cloudfoundry#6037's docs-site group, which merged without a fragment.
nabramovitz
pushed a commit
to nabramovitz/stratos
that referenced
this pull request
Oct 23, 2026
lint-nested-pins.mjs now also fails when a root package family names more than one version: angular-eslint and every root @angular-eslint/* package must match. That split caused the 22 false label warnings after cloudfoundry#6039, and nothing reported it as a split. The script now runs first in lint, so the split is reported before ESLint prints the misleading warnings it causes. Reverse-tested: angular-eslint set back to 22.5.0 makes bun run lint exit 1 with the family message first.
norman-abramovitz
added a commit
that referenced
this pull request
Oct 23, 2026
The October sweep (#6039) moved @angular-eslint/* to 22.6.0 but left the angular-eslint meta package, the one eslint.config.mjs imports, at 22.5.0. bun then nested a separate template parser and template plugin under the meta package, each with its own bundled Angular compiler. label-has-associated-control finds a control inside a label with an instanceof check, which fails across the two copies, so every label that wraps its control was reported: 22 false warnings in 14 templates. No template was missing a label. lockdiff: no new packages; the nested 22.5.0 family and two stale @typescript-eslint 8.70 copies are removed.
norman-abramovitz
added a commit
that referenced
this pull request
Oct 23, 2026
lint-nested-pins.mjs now also fails when a root package family names more than one version: angular-eslint and every root @angular-eslint/* package must match. That split caused the 22 false label warnings after #6039, and nothing reported it as a split. The script now runs first in lint, so the split is reported before ESLint prints the misleading warnings it causes. Reverse-tested: angular-eslint set back to 22.5.0 makes bun run lint exit 1 with the family message first.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Nine Dependabot PRs were open against develop. Four of them failed CI, and one that passed (#6010) would have left three security alerts open. This PR makes all of their updates in one branch, with the fixes each one needed, and clears the seven open Dependabot security alerts.
src/frontend/packages/repeat Angular's version. Nothing installs from them, butscripts/lint-nested-pins.mjsfails lint when they disagree with the rootpackage.json, and Dependabot only edited the root. This commit updates both.src/frontend/packages/core/package.jsonalso declares marked.bun.lockchanges once instead of three times. jsdom is 30.1.3, released after #6014 was opened.replacedirectives, so a version change in one changes what the others resolve. Dependabot updated four of them and leftplugins/monocularneedinggo mod tidy, which fails lint and the backend tests.When this merges, Dependabot should close the seven PRs it replaces on its own.
Security
src/frontend/packages/devkit/package-lock.json), 2.14.1 → 2.14.2, which chore(deps): bump the angular-devkit group across 1 directory with 4 updates #6010's update brings in. vite 8.3.0–8.3.2 bundles the same launch-editor code, so the same three advisories are also reported against vite.@angular/build22.2.3 requires vite at exactly 8.3.0, so updating Angular cannot clear them. The devkit'spackage.jsongets an npm override,"vite": "^8.3.3"(it resolves to 8.3.5); the rootpackage.jsonalready overrides vite the same way. The application build is not affected: the root override resolves vite 8.2.1, below the vulnerable range. The devkit override can go once@angular/buildrequires vite 8.3.3 or later.src/jetstream/plugins/cfapppush/go.moddeclared 1.18.0; it now declares 1.20.1, the version the other modules use after the Go updates. The backend binary was not exposed: the build resolves one version across all seven modules, and that was already 1.19.1.Notes
scripts/lockdiff.mjs, which lists the packages each change adds or removes. Two things beyond the version bumps:bun.lockkept a second, older @types/node (26.6.4) just for happy-dom. That entry is removed so happy-dom uses 26.6.5 like everything else, which is also what chore(deps-dev): bump @types/node from 26.6.4 to 26.6.5 #6012 produced.npm dedupewas not run because it pulled in unrelated babel updates.go.modfiles now declarego 1.27.2, and the Go version in.tool-versionsmoves from 1.27.1 to 1.27.3, the current release. CI is unaffected: itsGO_VERSION: '1.27'already installs the latest 1.27 release.go mod tidywas run across all seven modules until it made no further changes in any of them.Tests
make check gate: passed.npm ci --dry-runon the devkit lockfile: clean.angular-eslint 22.6.0 reports 22
label-has-associated-controlwarnings across 14 templates: labels that are not linked to a form control. develop, on 22.5.0, reports none. They are warnings, so the gate still passes. They are left unchanged here; the label fixes will come in a separate accessibility PR.Release note:
changelog.d/0018-dependency-updates.md. It also lists the docs-site updates from #6037, which merged without a release note.AI disclosure (RFC-0047): prepared with AI coding assistance; reviewed by the author.