Skip to content

Conversation

@colinscz
Copy link
Collaborator

@colinscz colinscz commented Nov 28, 2025

πŸ”— Linked issue

❓ Type of change

  • πŸ“– Documentation (updates to the documentation, readme or JSdoc annotations)
  • 🐞 Bug fix (a non-breaking change that fixes an issue)
  • πŸ‘Œ Enhancement (improving an existing functionality like performance)
  • ✨ New feature (a non-breaking change that adds functionality)
  • 🧹 Chore (updates to the build process or auxiliary tools and libraries)
  • ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

πŸ“š Description

  • Align used minimal Typescript version
  • Update Angular 20.x minor version used in demo app to latest to resolve vulnerability findings
  • Update React demo app dependencies
  • Update outdated dependencies

πŸ“ Checklist

  • I have linked an issue or discussion.
  • It's submitted to the main branch
  • When resolving a specific issue, it's referenced in the PR's title (e.g. fix #xxx[,#xxx], where "xxx" is the issue number)
  • I have updated the documentation accordingly.
  • All tests are passing
  • New/updated tests are included
  • I have updated the "upcoming" section inside docs/changelog.md explaining the changes I contributed

If adding a new feature, the PR's description includes:

  • A convincing reason for adding this feature (to avoid wasting your time, it's best to open a suggestion issue first and wait for approval before working on it)

Other information:

@colinscz colinscz requested a review from ibirrer November 28, 2025 14:26
@colinscz colinscz force-pushed the chore/fix-dependencies branch from 3a45999 to 5296c5e Compare December 1, 2025 11:13
stefanrufer
stefanrufer previously approved these changes Dec 2, 2025
@colinscz colinscz added this to the v5.3.0 milestone Dec 11, 2025
Copy link
Collaborator

@pennal pennal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In general. I think this is fine. What I am noticing though is that we havent yet decided on how we want to declare dependencies, whether we want to pinpoint them or we want to allow some freedom to the package manager.

"react": "^19.2.1",
"react-dom": "^19.2.1",
"react-router": "^7.10.1"
"react": "^19.1.0",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are you rolling these back? According to https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components we should be using >=19.1.3 or 19.2.2

"@types/react-dom": "^19",
"@vitejs/plugin-react": "^4.3.4",
"typescript": "5.8.3",
"@vitejs/plugin-react": "^4.7.0",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In both the react and vue packages you are not pinpointing versions, which you are doing in angular. Is there a reason for this?

@colinscz colinscz force-pushed the chore/fix-dependencies branch from f8be016 to 100dd72 Compare December 15, 2025 09:03
@colinscz colinscz modified the milestones: v5.3.0, v6.0.0 Dec 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants