build: lock file maintenance (21.2.x)#32947
build: lock file maintenance (21.2.x)#32947angular-robot wants to merge 1 commit intoangular:21.2.xfrom
Conversation
There was a problem hiding this comment.
Code Review
This pull request updates a wide range of dependencies in the pnpm-lock.yaml file, including minor and patch version bumps for packages such as @types/node, browserslist, hono, and lru-cache. However, several critical issues were identified in the feedback. Specifically, the removal of the deprecation notice for @xmldom/xmldom@0.8.12 is a security concern as that version contains known vulnerabilities. Additionally, the update to lodash@4.18.1 is highly suspicious because it exceeds the official stable versioning, indicating a potential supply chain risk. Finally, the inclusion of resolve@2.0.0-next.6 introduces an unstable pre-release version that could lead to unpredictable module resolution behavior.
See associated pull request for more information.
c41550a to
00c5798
Compare
This PR contains the following updates:
🔧 This Pull Request updates lock files to use the latest dependency versions.