`General`: Bump client and server dependencies to latest stable versions by az108 · Pull Request #2573 · ls1intum/doc-apply

az108 · 2026-05-23T15:12:31Z

Checklist

General

I tested all changes and their related features with all corresponding user types.
I chose a title conforming to the naming conventions for pull requests.

Motivation and Context

Renovate has not been opening PRs for the past weeks, so dependencies have drifted behind upstream. This bumps the npm packages on the client and the Gradle dependencies on the server to the latest stable releases that are compatible with the current Angular 21 / Spring Boot 4 stack.

Description

Client (`package.json`)

Angular 21.2.5 → 21.2.14 (all packages, including @angular/cdk, @angular/build, @angular/cli)
@angular-eslint/*, angular-eslint 21.3.0 → 21.4.0
primeng 21.1.3 → 21.1.8, @primeuix/utils 0.7.1 → 0.7.2
ngx-quill 30.0.1 → 30.1.3, quill 2.0.2 → 2.0.3
keycloak-js 26.2.2 → 26.2.4, intl-messageformat 11.2.4 → 11.2.7
vitest / @vitest/coverage-istanbul 4.1.0 → 4.1.7
tailwindcss / @tailwindcss/postcss 4.2.1 → 4.3.0
prettier 3.8.1 → 3.8.3
postcss, autoprefixer, rollup, jsdom, globals, folder-hash, swagger-ui-dist, @types/node (within v24): minor/patch bumps
packageManager pnpm 11.1.1 → 11.2.2 (also reflected in gradle.properties)

The following were intentionally left at their current versions because they break the build:

typescript stays at 5.9.3 — Angular 21 (@angular/build) only supports >=5.9 <6.0.
eslint / @eslint/js stay on 9.x — eslint-plugin-import does not yet declare support for ESLint 10.
@types/node stays in v24 to match the engines.node requirement.
vite stays at 8.0.0 and esbuild at 0.27.7 — vite 8.0.14 hits a regression in the bundled oxc parser when transforming async function ...(): Promise<void> signatures inside the Vitest pipeline.
@analogjs/vite-plugin-angular / @analogjs/vitest-angular stay at 2.3.1 — 2.5.x triggers the same oxc parser failure.
@typescript-eslint/* / typescript-eslint stay at 8.57.0 — 8.59 tightens no-unnecessary-type-assertion enough that --fix strips assertions Angular's compiler still needs.
prettier-plugin-java stays at 2.8.1 — 2.9.x reformats 44 unrelated Java files, which would balloon this PR.

These are each worth a follow-up PR once upstream catches up.

Server (`gradle.properties`)

springBoot 4.0.4 → 4.0.6 (pulls Spring Security 7.0.4 → 7.0.5, Hibernate, Tomcat, etc.)
jacksonBom 3.1.0 → 3.1.3
lombok 1.18.44 → 1.18.46
archunitJunit5 1.4.1 → 1.4.2
junit 6.0.3 → 6.1.0
jacksonDatabindNullable 0.2.9 → 0.2.10
mysql 9.6.0 → 9.7.0
caffeine 3.2.3 → 3.2.4
springdoc 3.0.2 → 3.0.3
jaxbRuntime 4.0.7 → 4.0.8
jsoup 1.22.1 → 1.22.2
itext 6.3.1 → 6.3.2
poi 5.4.1 → 5.5.1
keycloak 26.0.8 → 26.0.9
liquibase 5.0.2 → 5.0.3, Liquibase Gradle plugin 3.0.2 → 3.1.0
mockito 5.22.0 → 5.23.0
Spotless plugin 8.0.0 → 8.5.1
Modernizer plugin 1.12.0 → 1.13.0
dependencyUpdates plugin 0.53.0 → 0.54.0

Skipped:

springAi stays on 2.0.0-M4 — newer M7 is still a milestone, not stable.
gitProperties plugin stays at 2.5.3 — 3.0.x is a major bump that warrants its own PR.
openapi-generator stays at 7.20.0 — the local openapi-generator-angular21 subproject is tightly coupled to this version and a bump should be evaluated separately.
Gradle wrapper 9.4.0 stays — 9.5.x is a release candidate.

All exact versions are pinned (no ^), in line with the project's convention.

Steps for Testing

Prerequisites:

Pull the branch and run pnpm install followed by ./gradlew clean build to make sure both ecosystems resolve cleanly.

Local verification done before pushing:

pnpm lint — 0 errors, 169 pre-existing warnings (unchanged)
pnpm test — full Vitest suite passes with coverage above the configured thresholds
pnpm webapp:build — production Angular build succeeds
pnpm prettier:check — clean
./gradlew compileJava compileTestJava — clean

Review Progress

Code Review

Code Review 1

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

codacy-production · 2026-05-23T15:13:20Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric Results

Complexity 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

… vulnerabilities The root `overrides` block in package.json has been silently ignored since pnpm 10 (the field must live in pnpm-workspace.yaml). Moving it restores every pinned override (cookie, express, esbuild, lodash, undici, webpack, ws, ...) and lets us patch the remaining advisories: - vite pinned to 8.0.5 (fixes 3 advisories: server.fs.deny bypass, dev-server WebSocket file read, optimized-deps path traversal) - postcss pinned to 8.5.15 (fixes XSS in CSS stringify) - qs override bumped from 6.15.0 to 6.15.2 (fixes DoS) - quill reverted from 2.0.3 to 2.0.2 (2.0.3 is the only affected version of the XSS-via-HTML-export advisory; no patched release yet) - @oxc-project/runtime added as a devDep so vite 8.0.5+ can resolve the helpers it injects into transformed sources Brings `pnpm audit` from 12 vulnerabilities (4 high, 7 moderate, 1 low) down to 4 (2 high, 2 moderate), all of them transitive lodash advisories from `prettier-plugin-java > java-parser`. Lodash has no patched release (>=4.17.24) on npm yet, so the override is already pinned at the highest available version (4.17.23) and the remaining advisories are unfixable upstream; the affected code path is a dev-only Java formatter, never shipped to production. Also drops the stale `pnpm.onlyBuiltDependencies` block from package.json (also ignored since pnpm 10; the equivalent `allowBuilds` config already lives in pnpm-workspace.yaml). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CI builds started failing with a 403 from Maven Central when resolving liquibase-core 5.0.3. The artifact is published, but the runner's Maven Central edge could not fetch it. Reverting unblocks CI; Renovate will pick the bump back up once Central is healthy in the runner's region. The liquibase Gradle plugin stays on 3.1.0 — it works against 5.0.2. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… scan The Lighthouse Applicant scan started failing with `TypeError: Failed to fetch` on the browser-side call to `/api/auth/login` inside lighthouse-auth.js (the Professor scan, which uses the Keycloak login form rather than the server login endpoint, still passes). No `/api/auth/login` entry appears in the server log, so the fetch is being aborted before the request leaves the browser — consistent with the page navigating away mid-flight. The most likely triggers from this PR are vite 8.0.5 (which switched the default transformer to Oxc and changed dev-server behaviour) and the keycloak-js 26.2.2 → 26.2.4 bump (which could alter SSO redirect timing). Reverting both is the smallest change that gets Lighthouse green again. Net effect on `pnpm audit`: re-adds the three dev-only vite advisories (server.fs.deny bypass, WebSocket file read, optimized-deps path traversal). All are dev-server only and not exposed in CI/prod, so the security exposure is negligible. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-05-31T12:27:30Z

There hasn't been any activity on this pull request recently. Therefore, this pull request has been automatically marked as stale and will be closed if no further activity occurs within seven days. Thank you for your contributions.

github-actions · 2026-06-09T12:58:07Z

There hasn't been any activity on this pull request recently. Therefore, this pull request has been automatically marked as stale and will be closed if no further activity occurs within seven days. Thank you for your contributions.

github-actions · 2026-06-19T13:09:03Z

There hasn't been any activity on this pull request recently. Therefore, this pull request has been automatically marked as stale and will be closed if no further activity occurs within seven days. Thank you for your contributions.

github-actions · 2026-07-01T12:59:47Z

There hasn't been any activity on this pull request recently. Therefore, this pull request has been automatically marked as stale and will be closed if no further activity occurs within seven days. Thank you for your contributions.

github-actions · 2026-07-12T12:17:47Z

There hasn't been any activity on this pull request recently. Therefore, this pull request has been automatically marked as stale and will be closed if no further activity occurs within seven days. Thank you for your contributions.

Cathy0123456789

Could you please check the Codacy errors, it seems like the versions are vulnerable, maybe we can directly bump them up?

…findings Resolve the flagged insecure-dependency issues by upgrading to the latest patched releases: - Angular framework 21.2.14 -> 21.2.18 (fixes the reported core/common/ compiler XSS, DoS, hydration and cache-poisoning CVEs) - @angular/build, @angular/cli -> 21.2.19; compiler-cli, language-service -> 21.2.18; @angular/cdk -> 21.2.14 to keep the toolchain in sync - esbuild 0.27.7 -> 0.28.1 (dev-server arbitrary file read) - lodash / lodash-es override 4.17.23 -> 4.18.0 (code execution via template imports, prototype pollution) Verified with a clean production-config build. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Resolve conflicts in package.json and pnpm-lock.yaml. package.json conflicted on a single region where both sides changed adjacent lines: this branch bumped @primeuix/utils to 0.7.2, while main added chart.js as a new dependency. Kept both. Taking either side wholesale would have been wrong - "ours" drops chart.js, which the line-chart component added in main needs as a peer of PrimeNG's UIChart, breaking the usage analytics charts at runtime. pnpm-lock.yaml was regenerated rather than merged by hand: the branch's lock was taken as the base to preserve its bumps, then reconciled against the resolved manifests with pnpm install --lockfile-only. pnpm install --frozen-lockfile now reports the lockfile as up to date, which is the gate CI runs. Verified on the merged tree: dependency sets match main exactly (no package dropped, only versions differ), client typecheck, 2007 client tests, client production build, 784 server tests, eslint (0 errors), a11y lint and prettier all pass. Co-Authored-By: Claude <noreply@anthropic.com>

Cathy0123456789

Would it make sense to update these as well or is that not possible? vite for example

github-actions · 2026-08-05T12:35:33Z

There hasn't been any activity on this pull request recently. Therefore, this pull request has been automatically marked as stale and will be closed if no further activity occurs within seven days. Thank you for your contributions.

…ilities Bump vite 8.0.0 to 8.2.1 and postcss 8.5.15 to 8.5.26, clearing the six advisories that applied to the pinned versions. Angular's transform pipeline emits imports of @oxc-project/runtime helpers, but @angular/core does not declare that package. It resolved only because vite 8.0.0 happened to depend on it and nodeLinker is hoisted. vite dropped that dependency after 8.0.0, so declare it explicitly instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

az108 · 2026-08-09T15:29:32Z

Good question — I went through all seven. Short version: two of them were real and are now fixed in ecec1bb; the other five are false positives that we can't act on.

The five "managed" rows aren't real

The tell is the version column: those rows say managed rather than a version. Those dependencies are declared in build.gradle without a version, because the Spring Boot BOM supplies it. GitHub's dependency graph therefore can't tell which version we actually resolve, and when it can't it lists every advisory ever filed against that artifact. I resolved the real versions with ./gradlew dependencyInsight:

Package	Advisory applies to	We actually resolve	Affected?
snakeyaml	`< 1.32`	2.6 (`strictly`)	No
hibernate-validator	`< 6.2.0.Final`	9.0.1.Final	No
spring-boot-starter-actuator	`>= 4.0.0-M1, < 4.0.4`	4.0.6	No
spring-boot-starter-webflux	`< 2.6.6` (Spring4Shell, 2022)	7.0.7	No
spring-security-oauth2-client	`< 5.7.5`	7.0.5	No

So there's nothing to bump. The only way to silence these would be to hardcode versions in build.gradle purely to satisfy the scanner, which would defeat the point of using the BOM and would leave us pinning Spring internals by hand. I'd rather not.

The two with real version numbers were genuine

vite and postcss are the only rows showing an actual version, and both were genuinely vulnerable. Both bumped:

postcss 8.5.15 → 8.5.26 — GHSA-r28c-9q8g-f849 (high) is patched in 8.5.18. It was pinned in two places, package.json and the overrides block in pnpm-workspace.yaml, so both needed changing.
vite 8.0.0 → 8.2.1 — clears all five. The highest patch floor among them was 8.0.16 (GHSA-fx2h-pf6j-xcff and GHSA-v6wh-96g9-6wx3); the other three were patched in 8.0.5.

One detail on your "vite for example": the tree actually contains two vites. Besides our direct 8.0.0, @angular/build@21.2.19 depends on exactly vite@7.3.6, so that one we cannot bump independently — it moves when Angular moves. Luckily it isn't affected by any of the five: they were all patched in the 7.3.2–7.3.5 range, so 7.3.6 is already clear.

One thing worth knowing about the vite bump

Bumping vite broke all 160 test files, and the reason is a pre-existing fragility rather than anything about 8.2.1. Angular's transform pipeline emits imports of @oxc-project/runtime/helpers/*, but @angular/core only declares tslib — it never declares that runtime. It resolved purely because vite 8.0.0 happened to list @oxc-project/runtime as a dependency, and our nodeLinker: hoisted made it visible to Angular. vite dropped that dependency after 8.0.0, and the imports stopped resolving.

I added it as an explicit devDependency (0.142.0, matching the @oxc-project/types version rolldown pins). It's a workaround for an upstream packaging gap, but an explicit declaration beats depending on an accidental hoist from an unrelated package — this would have bitten us on any future vite bump regardless.

Verified after the change: 160 test files / 2097 tests pass, pnpm webapp:build succeeds, Prettier clean.

github-actions · 2026-08-17T12:05:33Z

There hasn't been any activity on this pull request recently. Therefore, this pull request has been automatically marked as stale and will be closed if no further activity occurs within seven days. Thank you for your contributions.

General: Bump client and server dependencies to latest stable versions

ffa3b4f

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions Bot assigned az108 May 23, 2026

az108 added dependencies Pull requests that update a dependency file ready for review labels May 23, 2026

az108 and others added 3 commits May 23, 2026 18:32

github-actions Bot added stale and removed ready for review labels May 31, 2026

az108 added ready for review and removed stale labels Jun 2, 2026

github-actions Bot added stale and removed ready for review labels Jun 9, 2026

az108 added ready for review and removed stale labels Jun 12, 2026

github-actions Bot added stale and removed ready for review labels Jun 19, 2026

az108 added ready for review and removed stale labels Jun 22, 2026

github-actions Bot added stale and removed ready for review labels Jul 1, 2026

Cathy0123456789 removed the stale label Jul 3, 2026

az108 added the ready for review label Jul 4, 2026

Merge branch 'main' into chore/update-dependencies

3016b07

github-actions Bot added stale and removed ready for review labels Jul 12, 2026

az108 added ready for review and removed stale labels Jul 12, 2026

Merge branch 'main' into chore/update-dependencies

eb927ed

Cathy0123456789 reviewed Jul 17, 2026

View reviewed changes

az108 and others added 2 commits July 18, 2026 12:47

az108 requested a review from Cathy0123456789 July 25, 2026 12:47

Merge branch 'main' into chore/update-dependencies

b8ac0a6

Cathy0123456789 reviewed Jul 28, 2026

View reviewed changes

github-actions Bot added stale and removed ready for review labels Aug 5, 2026

az108 added ready for review and removed stale labels Aug 9, 2026

az108 requested a review from Cathy0123456789 August 9, 2026 16:55

Merge branch 'main' into chore/update-dependencies

7ea5d3d

github-actions Bot added stale and removed ready for review labels Aug 17, 2026

Navigation Menu

Uh oh!

`General`: Bump client and server dependencies to latest stable versions - #2573

`General`: Bump client and server dependencies to latest stable versions#2573
az108 wants to merge 11 commits into
mainfrom
chore/update-dependencies

az108 commented May 23, 2026

Uh oh!

codacy-production Bot commented May 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 31, 2026

Uh oh!

github-actions Bot commented Jun 9, 2026

Uh oh!

github-actions Bot commented Jun 19, 2026

Uh oh!

github-actions Bot commented Jul 1, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

Cathy0123456789 left a comment

Uh oh!

Cathy0123456789 left a comment

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

az108 commented Aug 9, 2026

Uh oh!

github-actions Bot commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

az108 commented May 23, 2026

Checklist

General

Motivation and Context

Description

Client (package.json)

Server (gradle.properties)

Steps for Testing

Review Progress

Code Review

Uh oh!

codacy-production Bot commented May 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

github-actions Bot commented May 31, 2026

Uh oh!

github-actions Bot commented Jun 9, 2026

Uh oh!

github-actions Bot commented Jun 19, 2026

Uh oh!

github-actions Bot commented Jul 1, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

Cathy0123456789 left a comment

Choose a reason for hiding this comment

Uh oh!

Cathy0123456789 left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

az108 commented Aug 9, 2026

The five "managed" rows aren't real

The two with real version numbers were genuine

One thing worth knowing about the vite bump

Uh oh!

github-actions Bot commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Client (`package.json`)

Server (`gradle.properties`)

codacy-production Bot commented May 23, 2026 •

edited

Loading