[Snyk] Security upgrade @angular/common from 8.0.0 to 19.2.16 - #53
[Snyk] Security upgrade @angular/common from 8.0.0 to 19.2.16#53DaSchTour wants to merge 1 commit into
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-ANGULARCOMMON-14135651
There was a problem hiding this comment.
Pull request overview
This PR attempts to fix a high-severity security vulnerability (SNYK-JS-ANGULARCOMMON-14135651) by upgrading @angular/common from version 8.0.0 to 19.2.16. However, this approach will cause critical compatibility issues as it only upgrades a single Angular package while leaving all other Angular framework packages at version 8.
Key Changes
- Upgrades
@angular/commonfrom ~8.0.0 to ~19.2.16 (an 11 major version jump) - No changes to other Angular packages or dependencies
- Package-lock.json update failed (as noted in the PR warning)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "dependencies": { | ||
| "@angular/animations": "~8.0.0", | ||
| "@angular/common": "~8.0.0", | ||
| "@angular/common": "~19.2.16", |
There was a problem hiding this comment.
Upgrading only @angular/common to version 19.2.16 while keeping all other Angular packages at version 8.0.0 will cause severe peer dependency conflicts and application failure. Angular packages must be upgraded together as they have strict peer dependency requirements.
All Angular packages should be upgraded to the same major version:
@angular/animations: ~8.0.0@angular/compiler: ~8.0.0@angular/core: ~8.0.0@angular/forms: ~8.0.0@angular/platform-browser: ~8.0.0@angular/platform-browser-dynamic: ~8.0.0@angular/router: ~8.0.0
Additionally, devDependencies like @angular/cli, @angular/compiler-cli, and build tools must also be upgraded to match.
Consider using Angular's update guide (https://update.angular.io/) to perform a proper incremental upgrade from version 8 to 19, addressing breaking changes at each major version.
| "@angular/common": "~19.2.16", | |
| "@angular/common": "~8.0.0", |
Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-ANGULARCOMMON-14135651
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.