chore: resolve open dependabot security alerts#252
Conversation
- vitest ^2.1.9 -> ^4.1.0 to fix UI server arbitrary file read/exec (critical, GHSA-5xrq-8626-4rwp, alerts #40 #41) - @analogjs/vitest-angular ^1.11.0 -> ^2.6.0 for vitest 4 compatibility - add ws ^8.21.0 override to avoid reintroducing GHSA-58qx-3vcg-4xpx via jsdom Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request upgrades @analogjs/vitest-angular to ^2.6.0 and vitest to ^4.1.0 in the Angular integration test package, along with adding a ws override. However, these upgraded dependencies require a higher Node.js version than the currently specified >=18 in the engines field. It is recommended to update the minimum Node.js version requirement to at least >=20 to prevent installation warnings or runtime failures.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| "ws": "^8.21.0" | ||
| }, | ||
| "engines": { | ||
| "node": ">=18" |
There was a problem hiding this comment.
The upgraded vitest dependency (v4.1.8) requires Node.js ^20.0.0 || ^22.0.0 || >=24.0.0. Additionally, the transitive peer dependency @angular-devkit/schematics (v22.0.0) requires Node.js ^22.22.3 || ^24.15.0 || >=26.0.0. Keeping the engine requirement at >=18 will cause installation warnings or runtime failures on older Node.js versions. Please update the minimum Node.js version in the engines field to at least >=20 (or >=22 to fully satisfy the schematics peer dependency).
| "ws": "^8.21.0" | |
| }, | |
| "engines": { | |
| "node": ">=18" | |
| "ws": "^8.21.0" | |
| }, | |
| "engines": { | |
| "node": ">=20" |
Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
There was a problem hiding this comment.
Pull request overview
Updates the Angular integration-test workspace dependencies to address Dependabot security alerts, primarily by upgrading Vitest and related tooling and pinning a safe ws version via overrides.
Changes:
- Upgraded
vitestto^4.1.0and@analogjs/vitest-angularto^2.6.0in the Angular integration workspace. - Added a
wsoverride (^8.21.0) to avoid reintroducing a known vulnerable transitive version. - Raised the Angular integration workspace Node engine requirement from
>=18to>=22(per diff).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| test/angular-integration/package.json | Bumps Vitest + Angular Vitest adapter versions, adds ws override, and updates Node engine floor. |
| test/angular-integration/package-lock.json | Regenerates lockfile to reflect upgraded dependencies (Vitest 4.x tree, new transitive deps, updated engines). |
Files not reviewed (1)
- test/angular-integration/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "engines": { | ||
| "node": ">=18" | ||
| "node": ">=22" | ||
| } |
| "engines": { | ||
| "node": ">=18" | ||
| "node": ">=22" | ||
| } |
Summary
Resolves the open critical Dependabot alerts for
vitestin the Angular integration test workspace.vitest^2.1.9->^4.1.0to fix the critical Vitest UI server arbitrary file read/exec vulnerability (GHSA-5xrq-8626-4rwp / CVE-2026-47429, alerts fix: container copy command #40 and chore(main): release 0.1.5 #41). Resolves to 4.1.8.@analogjs/vitest-angular^1.11.0->^2.6.0since the 1.x line only supports vitest^1 || ^2; 2.6.0 supports vitest 4 and keeps Angular 19 / Vite 6 compatibility.ws^8.21.0override to avoid reintroducing GHSA-58qx-3vcg-4xpx via the refreshedjsdomtransitive tree (npm auditreports 0 vulnerabilities after).Verification
npm installclean,npm auditreports 0 vulnerabilities.openfeature generate angular).go build ./...andgo test ./...pass.