Conversation
…nerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-TAR-15038581 - https://snyk.io/vuln/SNYK-JS-UNDICI-14943963
There was a problem hiding this comment.
Pull request overview
This is a Snyk-automated security fix PR that attempts to address 2 vulnerabilities (tar and undici) by upgrading two Angular development packages. However, the PR introduces a critical version incompatibility issue.
Changes:
- Upgraded
@angular-devkit/build-angularfrom ^17.3.1 to ^17.3.16 - Upgraded
@angular/clifrom ^17.3.1 to ^21.0.0
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "@angular-devkit/build-angular": "^17.3.16", | ||
| "@angular/animations": "^17.3.1", | ||
| "@angular/cli": "^17.3.1", | ||
| "@angular/cli": "^21.0.0", |
There was a problem hiding this comment.
The Angular CLI is being upgraded from version 17.3.1 to 21.0.0 (a jump of 4 major versions), while all other Angular framework packages remain at version 17.3.1. This creates a critical version mismatch that will likely cause build failures.
Angular CLI should match the major version of the Angular framework packages. When the CLI is at v21, the framework packages (like @angular/core, @angular/common, @angular/compiler, etc.) should also be at v21.
Either:
- Upgrade all Angular packages together to v21, or
- Keep the CLI at v17 and only upgrade @angular-devkit/build-angular to patch the security vulnerabilities without breaking compatibility.
The current configuration will result in incompatibility between the CLI tooling and the framework runtime.
| "@angular/cli": "^21.0.0", | |
| "@angular/cli": "^17.3.16", |
Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
frontend/package.jsonfrontend/package-lock.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-TAR-15038581
SNYK-JS-UNDICI-14943963
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Allocation of Resources Without Limits or Throttling