Repository navigation
chore(deps): October bumps — Angular 21.2.25, SDKs, dotenv 18 - #117
Merged
Merged
Conversation
Folds Dependabot #100, #101 and #102 into one change. Angular moves to 21.2.25 as a whole (21.2.24 left animations behind and npm refused the mixed peer set). Versions younger than the 7-day cooldown were held at the last older release, transitive ones included. openai-go stays at 3.68.0: 3.69.0 refuses plain HTTP for requests that carry a key, which breaks the Ollama provider (#116). Dependabot ignores >= 3.69.0 until that is fixed.
Address review of #117: the hand-held lockfile was internally invalid (express 5.2.1 with a nested content-type 2.x). Regenerated from main's lockfile with a release-date cutoff instead, so every pinned version is consistent; npm ls --all --package-lock-only is clean. source-map-js moves to 1.2.2 (GHSA-68fv-2mgg-jv7q). The openai-go ignore drops its version range: an explicit range would also block security updates, a bare name does not.
# Conflicts: # docs/roadmap.md # frontend/package-lock.json # frontend/package.json # go.mod # go.sum
This was referenced Oct 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Folds Dependabot #100, #101 and #102 into one PR (their branches predate the CI apt fix #103 and #102 conflicted; a rebase request went unanswered).
@angular/animations,build,clibehind; npm refused the mixed peer setconfig({ path })in playwright.config.ts unchangedCooldown this round is 5 days, not 7. The lockfile was regenerated from main's with
npm install --before=2026-10-05T12:00Z. The cutoff is set to include the Angular CLI family 21.2.25 (published 2026-10-05): main's@angular/build21.2.24 pinspiscina5.2.0, a critical prototype-pollution RCE (GHSA-67c8-pqhq-4rmx); 21.2.25 moves to piscina 5.3.2. Dev toolchain only, but worth not waiting two more days for. Everything else in the change is older than the cutoff.npm ls --all --package-lock-onlyis clean.Remaining
npm audit: 3 high, all held deliberately —http-cache-semantics(fix is inside the cooldown) and@modelcontextprotocol/sdk(pinned exactly by@angular/cli).Behaviour notes from the review
Retry-Afterup to 2 min (was capped at 8 s). WithsdkMaxRetries=1this stays inside the 120 s Fix deadline; matches anthropic-sdk-go. Not a defect, noted in bug(llm): SDK retry after a stalled response body can overrun the Fix budget #118.Tests
npm run buildclean,npm test351/351go build,go test ./internal/...greenSupersedes #100, #101, #102.