Skip to content

Bump the npm_and_yarn group across 2 directories with 17 updates#32

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-5bb5c9e562
Open

Bump the npm_and_yarn group across 2 directories with 17 updates#32
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-5bb5c9e562

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 10, 2026

Bumps the npm_and_yarn group with 2 updates in the / directory: @babel/runtime and lodash.
Bumps the npm_and_yarn group with 9 updates in the /app directory:

Package From To
@babel/runtime 7.9.6 7.26.10
lodash 4.17.23 4.18.1
@angular/common 18.2.13 21.2.8
@angular/compiler 18.2.13 21.2.8
@angular/core 18.2.13 21.2.8
minimatch 3.1.2 3.1.5
flatted 3.3.2 3.4.2
qs 6.14.1 6.14.2
tar 6.2.1 7.5.13

Updates @babel/runtime from 7.26.7 to 7.29.2

Release notes

Sourced from @​babel/runtime's releases.

v7.29.2 (2026-03-16)

👓 Spec Compliance

  • babel-parser

🐛 Bug Fix

  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-preset-env, babel-runtime-corejs3
  • babel-preset-env
    • #17789 [7.x backport] preset-env include/exclude should accept bugfix plugins (@​JLHwung)

🏠 Internal

Committers: 2

v7.29.1 (2026-02-04)

🐛 Bug Fix

Committers: 2

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

  • babel-types
  • babel-standalone

🐛 Bug Fix

  • babel-parser
  • babel-traverse
    • #17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
  • babel-plugin-transform-block-scoping, babel-traverse
    • #17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​babel/runtime since your current version.


Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates @babel/runtime from 7.9.6 to 7.26.10

Release notes

Sourced from @​babel/runtime's releases.

v7.29.2 (2026-03-16)

👓 Spec Compliance

  • babel-parser

🐛 Bug Fix

  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-preset-env, babel-runtime-corejs3
  • babel-preset-env
    • #17789 [7.x backport] preset-env include/exclude should accept bugfix plugins (@​JLHwung)

🏠 Internal

Committers: 2

v7.29.1 (2026-02-04)

🐛 Bug Fix

Committers: 2

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

  • babel-types
  • babel-standalone

🐛 Bug Fix

  • babel-parser
  • babel-traverse
    • #17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
  • babel-plugin-transform-block-scoping, babel-traverse
    • #17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​babel/runtime since your current version.


Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates @angular/common from 18.2.13 to 21.2.8

Release notes

Sourced from @​angular/common's releases.

21.2.8

compiler

Commit Description
fix - e40d378f3e handle nested brackets in host object bindings

compiler-cli

Commit Description
fix - 2c6781071f error for type parameter declarations

core

Commit Description
fix - 82192deda9 handle missing serialized container hydration data
fix - 057cc6d09d remove obsolete iOS cursor pointer hack in event delegation

language-service

Commit Description
fix - 7797671257 get quick info at local var location to align with TS semantics and support type narrowing

21.2.7

compiler

Commit Description
fix - fea25d1a60 register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit Description
fix - bba5ed8e64 prevent recursive scope checks for invalid NgModule imports

core

Commit Description
fix - d04ddd73df prevent binding unsafe attributes on SVG animation elements (#67797)
fix - 8fd896e99a resolve component import by exact specifier in route lazy-loading schematic
fix - b682c62873 treat object[data] as resource URL context (#67797)

localize

Commit Description
fix - 3c41e74fdd validate locale in getOutputPathFn to prevent path traversal

router

Commit Description
fix - 0960592d3d pass outlet context to split to fix empty path named outlets

21.2.6

common

Commit Description
fix - b4ab6ba2e8 avoid redundant image fetch on destroy with auto sizes

compiler

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

21.2.8 (2026-04-08)

compiler

Commit Type Description
e40d378f3e fix handle nested brackets in host object bindings

compiler-cli

Commit Type Description
2c6781071f fix error for type parameter declarations

core

Commit Type Description
82192deda9 fix handle missing serialized container hydration data
057cc6d09d fix remove obsolete iOS cursor pointer hack in event delegation

language-service

Commit Type Description
7797671257 fix get quick info at local var location to align with TS semantics and support type narrowing

22.0.0-next.6 (2026-04-01)

compiler

Commit Type Description
08d36599d7 fix register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit Type Description
fcd0bb0db8 fix prevent recursive scope checks for invalid NgModule imports

core

Commit Type Description
e84e35cdd6 fix prevent binding unsafe attributes on SVG animation elements (#67797)
8fa6617352 fix resolve component import by exact specifier in route lazy-loading schematic
028e1d3ce0 fix treat object[data] as resource URL context (#67797)

localize

Commit Type Description
7871093822 fix validate locale in getOutputPathFn to prevent path traversal

migrations

Commit Type Description
682aaf943f feat add strictTemplates to tsconfig during ng update

router

Commit Type Description
daa9b2a9d6 fix pass outlet context to split to fix empty path named outlets

... (truncated)

Commits
  • 8102331 test(http): disable XSRF and mock location in HttpClient tests to avoid Domin...
  • 13f050d test: construct local Date objects to fix timezone flakiness
  • d0cf299 test: remove unsupported timezone from formatDate tests
  • b4ab6ba fix(common): avoid redundant image fetch on destroy with auto sizes
  • adda6c5 build: update aspect_rules_js to 3.0.2
  • 93c6dc6 Revert "refactor(http): Improves base64 encoding/decoding with feature detect...
  • 76431ed Revert "fix(http): correctly cache blob responses in transfer cache (#67002)"
  • 277ade9 fix(http): correctly cache blob responses in transfer cache (#67002)
  • aeb9b81 refactor(http): Improves base64 encoding/decoding with feature detection (#67...
  • ecf0bb4 test(http): refactors HTTP client tests to use TestBed and providers
  • Additional commits viewable in compare view

Updates @angular/compiler from 18.2.13 to 21.2.8

Release notes

Sourced from @​angular/compiler's releases.

21.2.8

compiler

Commit Description
fix - e40d378f3e handle nested brackets in host object bindings

compiler-cli

Commit Description
fix - 2c6781071f error for type parameter declarations

core

Commit Description
fix - 82192deda9 handle missing serialized container hydration data
fix - 057cc6d09d remove obsolete iOS cursor pointer hack in event delegation

language-service

Commit Description
fix - 7797671257 get quick info at local var location to align with TS semantics and support type narrowing

21.2.7

compiler

Commit Description
fix - fea25d1a60 register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit Description
fix - bba5ed8e64 prevent recursive scope checks for invalid NgModule imports

core

Commit Description
fix - d04ddd73df prevent binding unsafe attributes on SVG animation elements (#67797)
fix - 8fd896e99a resolve component import by exact specifier in route lazy-loading schematic
fix - b682c62873 treat object[data] as resource URL context (#67797)

localize

Commit Description
fix - 3c41e74fdd validate locale in getOutputPathFn to prevent path traversal

router

Commit Description
fix - 0960592d3d pass outlet context to split to fix empty path named outlets

21.2.6

common

Commit Description
fix - b4ab6ba2e8 avoid redundant image fetch on destroy with auto sizes

compiler

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

21.2.8 (2026-04-08)

compiler

Commit Type Description
e40d378f3e fix handle nested brackets in host object bindings

compiler-cli

Commit Type Description
2c6781071f fix error for type parameter declarations

core

Commit Type Description
82192deda9 fix handle missing serialized container hydration data
057cc6d09d fix remove obsolete iOS cursor pointer hack in event delegation

language-service

Commit Type Description
7797671257 fix get quick info at local var location to align with TS semantics and support type narrowing

22.0.0-next.6 (2026-04-01)

compiler

Commit Type Description
08d36599d7 fix register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit Type Description
fcd0bb0db8 fix prevent recursive scope checks for invalid NgModule imports

core

Commit Type Description
e84e35cdd6 fix prevent binding unsafe attributes on SVG animation elements (#67797)
8fa6617352 fix resolve component import by exact specifier in route lazy-loading schematic
028e1d3ce0 fix treat object[data] as resource URL context (#67797)

localize

Commit Type Description
7871093822 fix validate locale in getOutputPathFn to prevent path traversal

migrations

Commit Type Description
682aaf943f feat add strictTemplates to tsconfig during ng update

router

Commit Type Description
daa9b2a9d6 fix pass outlet context to split to fix empty path named outlets

... (truncated)

Commits
  • a4f3120 refactor(compiler): require a reference in DirectiveMeta
  • de533fe refactor(compiler-cli): move ClassPropertyMapping into compiler
  • ea1e34c refactor(compiler): move matchSource into base metadata
  • e40d378 fix(compiler): handle nested brackets in host object bindings
  • d04ddd7 fix(core): prevent binding unsafe attributes on SVG animation elements (#67797)
  • fea25d1 fix(compiler): register SVG animation attributes in URL security context (#67...
  • 880a57d fix(compiler): prevent shimCssText from adding extra blank lines per CSS comment
  • 23ea431 fix(compiler): parse named HTML entities containing digits
  • 334ae10 fix(compiler): ensure generated code compiles
  • ed2d324 fix(compiler): disallow translations of iframe src
  • Additional commits viewable in compare view

Updates @angular/core from 18.2.13 to 21.2.8

Release notes

Sourced from @​angular/core's releases.

21.2.8

compiler

Commit Description
fix - e40d378f3e handle nested brackets in host object bindings

compiler-cli

Commit Description
fix - 2c6781071f error for type parameter declarations

core

Commit Description
fix - 82192deda9 handle missing serialized container hydration data
fix - 057cc6d09d remove obsolete iOS cursor pointer hack in event delegation

language-service

Commit Description
fix - 7797671257 get quick info at local var location to align with TS semantics and support type narrowing

21.2.7

compiler

Commit Description
fix - fea25d1a60 register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit Description
fix - bba5ed8e64 prevent recursive scope checks for invalid NgModule imports

core

Commit Description
fix - d04ddd73df prevent binding unsafe attributes on SVG animation elements (#67797)
fix - 8fd896e99a resolve component import by exact specifier in route lazy-loading schematic
fix - b682c62873 treat object[data] as resource URL context (#67797)

localize

Commit Description
fix - 3c41e74fdd validate locale in getOutputPathFn to prevent path traversal

router

Commit Description
fix - 0960592d3d pass outlet context to split to fix empty path named outlets

21.2.6

common

Commit Description
fix - b4ab6ba2e8 avoid redundant image fetch on destroy with auto sizes

compiler

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

21.2.8 (2026-04-08)

compiler

Commit Type Description
e40d378f3e fix handle nested brackets in host object bindings

compiler-cli

Commit Type Description
2c6781071f fix error for type parameter declarations

core

Commit Type Description
82192deda9 fix handle missing serialized container hydration data
057cc6d09d fix remove obsolete iOS cursor pointer hack in event delegation

language-service

Commit Type Description
7797671257 fix get quick info at local var location to align with TS semantics and support type narrowing

22.0.0-next.6 (2026-04-01)

compiler

Commit Type Description
08d36599d7 fix register SVG animation attributes in URL security context (#67797)

compiler-cli

Commit Type Description
fcd0bb0db8 fix prevent recursive scope checks for invalid NgModule imports

core

Commit Type Description
e84e35cdd6 fix prevent binding unsafe attributes on SVG animation elements (#67797)
8fa6617352 fix resolve component import by exact specifier in route lazy-loading schematic
028e1d3ce0 fix treat object[data] as resource URL context (#67797)

localize

Commit Type Description
7871093822 fix validate locale in getOutputPathFn to prevent path traversal

migrations

Commit Type Description
682aaf943f feat add strictTemplates to tsconfig during ng update

router

Commit Type Description
daa9b2a9d6 fix pass outlet context to split to fix empty path named outlets

... (truncated)

Commits
  • d4c8a9a refactor(...

    Description has been truncated

@dependabot
Bump the npm_and_yarn group across 2 directories with 17 updates
d023dbf 
Bumps the npm_and_yarn group with 2 updates in the / directory: [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) and [lodash](https://github.com/lodash/lodash).
Bumps the npm_and_yarn group with 9 updates in the /app directory:

| Package | From | To |
| --- | --- | --- |
| [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `7.9.6` | `7.26.10` |
| [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` |
| [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `18.2.13` | `21.2.8` |
| [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `18.2.13` | `21.2.8` |
| [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `18.2.13` | `21.2.8` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.2` | `3.4.2` |
| [qs](https://github.com/ljharb/qs) | `6.14.1` | `6.14.2` |
| [tar](https://github.com/isaacs/node-tar) | `6.2.1` | `7.5.13` |



Updates `@babel/runtime` from 7.26.7 to 7.29.2
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.2/packages/babel-runtime)

Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `@babel/runtime` from 7.9.6 to 7.26.10
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.2/packages/babel-runtime)

Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `@angular/common` from 18.2.13 to 21.2.8
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.8/packages/common)

Updates `@angular/compiler` from 18.2.13 to 21.2.8
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.8/packages/compiler)

Updates `@angular/core` from 18.2.13 to 21.2.8
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.8/packages/core)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `ws` from 8.16.0 to 8.17.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.16.0...8.17.1)

Updates `esbuild` from 0.21.5 to 0.27.3
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.21.5...v0.27.3)

Updates `flatted` from 3.3.2 to 3.4.2
- [Commits](WebReflection/flatted@v3.3.2...v3.4.2)

Updates `immutable` from 4.3.7 to 5.1.5
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v4.3.7...v5.1.5)

Updates `qs` from 6.14.1 to 6.14.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.1...v6.14.2)

Updates `rollup` from 4.22.4 to 4.60.1
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.22.4...v4.60.1)

Updates `serialize-javascript` from 6.0.2 to 7.0.5
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v6.0.2...v7.0.5)

Updates `tar` from 6.2.1 to 7.5.13
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.2.1...v7.5.13)

Updates `vite` from 5.4.21 to 7.3.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite)

Updates `webpack` from 5.94.0 to 5.105.2
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.94.0...v5.105.2)

Updates `webpack-dev-server` from 5.0.4 to 5.2.3
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v5.0.4...v5.2.3)

---
updated-dependencies:
- dependency-name: "@babel/runtime"
  dependency-version: 7.29.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@babel/runtime"
  dependency-version: 7.26.10
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@angular/common"
  dependency-version: 21.2.8
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@angular/compiler"
  dependency-version: 21.2.8
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@angular/core"
  dependency-version: 21.2.8
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.17.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.27.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 5.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.60.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serialize-javascript
  dependency-version: 7.0.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 7.5.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack
  dependency-version: 5.105.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-server
  dependency-version: 5.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 10, 2026
@dependabot dependabot Bot mentioned this pull request Apr 10, 2026
Closed
@netlify
Copy link
Copy Markdown

netlify Bot commented Apr 10, 2026 •
edited
Loading

❌ Deploy Preview for feined-todo failed.

Name Link
🔨 Latest commit d023dbf
🔍 Latest deploy log https://app.netlify.com/projects/feined-todo/deploys/69d8763890fe430009b3eb44

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants