build: lock file maintenance (21.2.x)#32947
build: lock file maintenance (21.2.x)#32947angular-robot wants to merge 1 commit intoangular:21.2.xfrom
Conversation
There was a problem hiding this comment.
Code Review
This pull request updates a wide range of dependencies in the pnpm-lock.yaml file, including minor and patch version bumps for packages such as @types/node, browserslist, hono, and lru-cache. However, several critical issues were identified in the feedback. Specifically, the removal of the deprecation notice for @xmldom/xmldom@0.8.12 is a security concern as that version contains known vulnerabilities. Additionally, the update to lodash@4.18.1 is highly suspicious because it exceeds the official stable versioning, indicating a potential supply chain risk. Finally, the inclusion of resolve@2.0.0-next.6 introduces an unstable pre-release version that could lead to unpredictable module resolution behavior.
c41550a to
00c5798
Compare
See associated pull request for more information.
00c5798 to
97c56ca
Compare
This PR contains the following updates:
🔧 This Pull Request updates lock files to use the latest dependency versions.