Copilot commented on code in PR #7307:
URL: https://github.com/apache/texera/pull/7307#discussion_r3710243327
##########
frontend/package.json:
##########
@@ -27,7 +27,7 @@
"@angular/cdk": "21.2.14",
"@angular/common": "21.2.17",
"@angular/compiler": "21.2.17",
- "@angular/core": "21.2.17",
+ "@angular/core": "21.2.19",
"@angular/forms": "21.2.17",
"@angular/localize": "21.2.17",
Review Comment:
`@angular/core` is bumped to 21.2.19 but the other tightly-coupled Angular
framework packages are still pinned to 21.2.17. This creates peer dependency
conflicts (e.g., `@angular/[email protected]` expects `@angular/[email protected]`) and
also likely fails to remediate CVE-2026-69151, which is fixed in the Angular
compiler pipeline (so `@angular/compiler` should be updated as well). Align the
Angular framework package patch versions to 21.2.19 (and regenerate `yarn.lock`
afterwards).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
