chore(deps): bump all @angular/* framework packages from 21.2.4 to 21.2.7 by dependabot[bot] · Pull Request #1450 · jaypatrick/adblock-compiler

dependabot · 2026-03-30T14:17:42Z

Description

Bumps all Angular framework packages from mixed versions (21.2.4/21.2.5/21.2.6) to a consistent ^21.2.7 to satisfy Angular's exact patch peer dependency requirements. Previously only @angular/core was bumped (to 21.2.6), leaving other framework packages on older patch versions and causing unmet peer dependency warnings. Also fixes a test that was broken by the consistent Angular version resolution.

Changes

Bump @angular/animations, @angular/common, @angular/compiler, @angular/core, @angular/forms, @angular/platform-browser, @angular/platform-browser-dynamic, @angular/platform-server, @angular/router, and @angular/service-worker in frontend/package.json to ^21.2.7
Bump @angular/compiler-cli (devDependency) in frontend/package.json to ^21.2.7
Regenerate pnpm-lock.yaml so all Angular framework packages consistently resolve to 21.2.7, eliminating unmet peer dependency warnings
Fix app.component.spec.ts: move the should render menu button with aria-label test into a new AppComponent (mobile viewport) describe block that mocks BreakpointObserver to return matches: true, since the menu button is only rendered inside @if (isMobile()) in the template; add an explicit desktop-viewport negative test asserting the button is correctly absent when isMobile() is false

Testing

Unit tests added/updated
Manual testing performed
CI passes

Zero Trust Architecture Checklist

Required for every PR touching worker/ or frontend/.
Check each item that applies. If an item doesn't apply, check it and note "N/A".

Worker / Backend

Every handler verifies auth before executing business logic — N/A
CORS origin allowlist enforced (not *) on write/authenticated endpoints — N/A
All secrets accessed via Worker Secret bindings (not [vars]) — N/A
All external inputs Zod-validated before use — N/A
All D1 queries use parameterized .prepare().bind() (no string interpolation) — N/A
Security events emitted to Analytics Engine on auth failures — N/A

Frontend / Angular

Protected routes have functional CanActivateFn auth guards — N/A
Auth tokens managed via Clerk SDK (not localStorage) — N/A
HTTP interceptor attaches ****** (no manual token passing) — N/A
API responses validated with Zod schemas before consumption — N/A

Dependency version bump with test fix — no application logic or security-relevant code changed.

Bumps [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) from 21.2.4 to 21.2.6. - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/core) --- updated-dependencies: - dependency-name: "@angular/core" dependency-version: 21.2.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-03-30T14:18:51Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	License
@angular/platform-browser-dynamic@21.2.5 ⏵ 21.2.7
@angular/core@21.2.4 ⏵ 21.2.7		⁺¹
@angular/platform-server@21.2.5 ⏵ 21.2.7		⁺³	^-19
@angular/compiler@21.2.4 ⏵ 21.2.7
@angular/platform-browser@21.2.4 ⏵ 21.2.7
@angular/service-worker@21.2.4 ⏵ 21.2.7	⁺¹
@angular/animations@21.2.4 ⏵ 21.2.7
@angular/compiler-cli@21.2.4 ⏵ 21.2.7	⁺¹	⁺¹
@angular/forms@21.2.4 ⏵ 21.2.7
@angular/router@21.2.4 ⏵ 21.2.7	⁺¹	⁺¹
@angular/common@21.2.4 ⏵ 21.2.7		⁺¹

View full report

socket-security · 2026-03-31T14:25:15Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

Copilot

Pull request overview

Updates the frontend’s Angular dependency set by bumping @angular/core from 21.2.4 to 21.2.6 (Dependabot-driven), along with the corresponding pnpm-lock.yaml refresh.

Changes:

Bump @angular/core version range in frontend/package.json to ^21.2.6.
Update pnpm-lock.yaml to resolve @angular/core@21.2.6 and refresh related transitive package resolutions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`frontend/package.json`	Updates the declared `@angular/core` version range to `^21.2.6`.
`pnpm-lock.yaml`	Updates lockfile resolutions for `@angular/core@21.2.6` and several transitive packages.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

frontend/package.json

pnpm-lock.yaml

jaypatrick · 2026-04-06T00:55:40Z

@copilot apply changes based on the comments in this thread

…sistent peer deps Agent-Logs-Url: https://github.com/jaypatrick/adblock-compiler/sessions/51b9e04a-2130-40d9-9236-895f96158bb3 Co-authored-by: jaypatrick <1800595+jaypatrick@users.noreply.github.com>

Copilot · 2026-04-06T01:00:58Z

@copilot apply changes based on the comments in this thread

Done in commit 13aa524. Updated all Angular framework packages (@angular/animations, @angular/common, @angular/compiler, @angular/core, @angular/forms, @angular/platform-browser, @angular/platform-browser-dynamic, @angular/platform-server, @angular/router, @angular/service-worker, and @angular/compiler-cli) to ^21.2.7 (the current latest consistent patch across all packages) and regenerated the lockfile. All framework packages now resolve uniformly to 21.2.7, eliminating the unmet peer dependency warnings.

jaypatrick · 2026-04-06T21:23:37Z

@copilot ⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯

FAIL src/app/app.component.spec.ts > AppComponent > should render menu button with aria-label
AssertionError: expected null to be truthy

Expected:
true

Received:
null

❯ src/app/app.component.spec.ts:116:25
114| await fixture.whenStable();
115| const menuBtn = fixture.nativeElement.querySelector('button[ar…
116| expect(menuBtn).toBeTruthy();
| ^
117| });
118| });

⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/1]⎯

Test Files 1 failed | 63 passed (64)
Tests 1 failed | 951 passed (952)
Start at 21:21:25
Duration 36.59s (transform 4.46s, setup 20.62s, import 21.92s, tests 59.18s, environment 2.98s)

/home/runner/work/adblock-compiler/adblock-compiler/frontend:
ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL adblock-frontend@1.0.0 test: vitest run
Exit status 1
Error: Process completed with exit code 1.

Agent-Logs-Url: https://github.com/jaypatrick/adblock-compiler/sessions/6bc3002d-3ef6-464c-950a-c298c47dafd2 Co-authored-by: jaypatrick <1800595+jaypatrick@users.noreply.github.com>

Copilot · 2026-04-06T21:30:40Z

@copilot ⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯

FAIL src/app/app.component.spec.ts > AppComponent > should render menu button with aria-label
...

Fixed in commit 71e4386. The menu button is inside @if (isMobile()) in the template, so it's never rendered in jsdom's non-mobile environment. The fix moves the test into a new AppComponent (mobile viewport) describe block that mocks BreakpointObserver to return matches: true. Also added a companion desktop-viewport test that explicitly asserts the button is absent when isMobile() is false. All 953 tests pass.

dependabot bot added the dependencies External packages and dependencies label Mar 30, 2026

jaypatrick self-assigned this Mar 31, 2026

jaypatrick added this to the beta milestone Mar 31, 2026

Merge branch 'main' into dependabot/npm_and_yarn/angular/core-21.2.6

ec208b4

jaypatrick requested a review from Copilot April 5, 2026 22:35

Copilot started reviewing on behalf of jaypatrick April 5, 2026 22:36 View session

Copilot AI reviewed Apr 5, 2026

View reviewed changes

frontend/package.json Outdated Show resolved Hide resolved

pnpm-lock.yaml Outdated Show resolved Hide resolved

Copilot started work on behalf of jaypatrick April 6, 2026 00:55 View session

chore(deps): bump all @angular/* framework packages to 21.2.7 for con…

13aa524

…sistent peer deps Agent-Logs-Url: https://github.com/jaypatrick/adblock-compiler/sessions/51b9e04a-2130-40d9-9236-895f96158bb3 Co-authored-by: jaypatrick <1800595+jaypatrick@users.noreply.github.com>

Copilot AI changed the title ~~chore(deps): bump @angular/core from 21.2.4 to 21.2.6~~ chore(deps): bump all @angular/* framework packages from 21.2.4 to 21.2.7 Apr 6, 2026

Copilot finished work on behalf of jaypatrick April 6, 2026 01:01

Copilot AI requested a review from jaypatrick April 6, 2026 01:01

Merge branch 'main' into dependabot/npm_and_yarn/angular/core-21.2.6

bcc3de1

Copilot started work on behalf of jaypatrick April 6, 2026 21:23 View session

fix(test): fix failing app.component test by mocking mobile breakpoint

71e4386

Agent-Logs-Url: https://github.com/jaypatrick/adblock-compiler/sessions/6bc3002d-3ef6-464c-950a-c298c47dafd2 Co-authored-by: jaypatrick <1800595+jaypatrick@users.noreply.github.com>

Copilot finished work on behalf of jaypatrick April 6, 2026 21:31

jaypatrick merged commit d0bd14b into main Apr 6, 2026
27 checks passed

jaypatrick deleted the dependabot/npm_and_yarn/angular/core-21.2.6 branch April 6, 2026 21:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump all @angular/* framework packages from 21.2.4 to 21.2.7#1450

chore(deps): bump all @angular/* framework packages from 21.2.4 to 21.2.7#1450
jaypatrick merged 5 commits intomainfrom
dependabot/npm_and_yarn/angular/core-21.2.6

dependabot bot commented on behalf of github Mar 30, 2026 •

edited by Copilot AI

Loading

Uh oh!

socket-security bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

jaypatrick commented Apr 6, 2026

Uh oh!

Copilot AI commented Apr 6, 2026

Uh oh!

jaypatrick commented Apr 6, 2026

Uh oh!

Copilot AI commented Apr 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot bot commented on behalf of github Mar 30, 2026 • edited by Copilot AI Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Testing

Zero Trust Architecture Checklist

Worker / Backend

Frontend / Angular

Uh oh!

socket-security bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

jaypatrick commented Apr 6, 2026

Uh oh!

Copilot AI commented Apr 6, 2026

Uh oh!

jaypatrick commented Apr 6, 2026

Uh oh!

Copilot AI commented Apr 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot bot commented on behalf of github Mar 30, 2026 •

edited by Copilot AI

Loading

socket-security bot commented Mar 30, 2026 •

edited

Loading

socket-security bot commented Mar 31, 2026 •

edited

Loading