chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 14 open Dependabot security alerts by bumping vulnerable dependencies (lockfile-only bumps within existing semver ranges where possible, scoped npm overrides only where a vulnerable transitive version was pinned by a parent with no direct upgrade path)

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#264	undici	high	Override ^7.29.0 scoped to @angular/build
#263	undici	high	Override ^7.29.0 scoped to @angular/build
#262	undici	high	Override ^7.29.0 scoped to @angular/build
#261	undici	high	Override ^7.29.0 scoped to @angular/build
#260	undici	high	Override ^7.29.0 scoped to @angular/build
#232	@hono/node-server	high	Override ^2.1.0 scoped to @modelcontextprotocol/sdk
#179	uuid	high	Override ^11.1.1 scoped to @cucumber/messages and jest-cucumber
n/a	ip-address	moderate	Lockfile bump to 10.4.0
n/a	js-yaml	moderate	Lockfile bump to 4.3.1 (eslint copy)
n/a	postcss	moderate	Lockfile bump to 8.5.25
n/a	@angular/*	moderate	Bumped @angular/core, @angular/common, @angular/compiler, @angular/compiler-cli, @angular/animations, @angular/forms, @angular/platform-browser, @angular/platform-browser-dynamic, @angular/router to 21.2.19

Notes on the @hono/node-server override: version 2.0.5-2.0.9 carry a separate known memory-leak DoS advisory (GHSA-9mqv-5hh9-4cgg), so the override target was set to ^2.1.0 rather than the minimum patched version.

Verification

• npm ci succeeds cleanly from a fresh install
• npm run build passes
• npm run test:jest passes (35/35 suites, 612/612 tests)
• npm run test:angular passes (3/3 suites, 45/45 tests)
• npm audit shows only pre-existing findings unrelated to the 14 resolved alerts

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds npm package overrides for transitive dependencies (undici, hono/node-server, uuid) in the root package.json, and updates Angular framework package versions from ^21.2.17/^21.0.4 to ^21.2.19 in packages/angular/package.json and packages/angular/projects/angular-sdk/package.json.

Changes

Dependency version management

Layer / File(s)	Summary
Transitive dependency overrides package.json	Adds overrides entries pinning undici under @angular/build, @hono/node-server under @modelcontextprotocol/sdk, and uuid under @cucumber/messages and jest-cucumber.
Angular package version bumps packages/angular/package.json, packages/angular/projects/angular-sdk/package.json	Bumps @angular/animations, @angular/forms, @angular/platform-browser, @angular/platform-browser-dynamic, and @angular/router to ^21.2.19. Updates Angular common and core devDependencies to ^21.2.19 and reorders entries in the Angular SDK package.json.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• open-feature/js-sdk#1432: Both PRs update Angular dependency versions in packages/angular/package.json.

Suggested reviewers: toddbaert

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the dependency updates made to resolve open Dependabot security alerts.
Description check	✅ Passed	The description directly explains the dependency updates, resolved security alerts, scoped overrides, and verification results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/angular/package.json`:
- Around line 24-34: Update `@angular/common`, `@angular/compiler`,
`@angular/compiler-cli`, and `@angular/core` in packages/angular/package.json to
^21.2.19, then refresh the lockfile so the Angular dependency graph is aligned.
Also verify the sibling entries in
packages/angular/projects/angular-sdk/package.json at lines 28-31; no direct
change is needed there unless the lockfile refresh requires it.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 81ae27f7-ef7f-46cc-9a36-4728ace7119a

📥 Commits

Reviewing files that changed from the base of the PR and between 78964f7 and 8ec5055.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

• package.json
• packages/angular/package.json
• packages/angular/projects/angular-sdk/package.json

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Relevant package.json version entries:\n'
for f in packages/angular/package.json packages/angular/projects/angular-sdk/package.json; do
  echo "--- $f"
  python3 - <<'PY' "$f"
import json, sys
p=sys.argv[1]
with open(p) as fh:
    data=json.load(fh)
for sec in ('dependencies','devDependencies','peerDependencies','overrides','resolutions'):
    deps=data.get(sec)
    if deps:
        print(f'[{sec}]')
        for k,v in sorted(deps.items()):
            if k.startswith('`@angular/`'):
                print(f'{k}: {v}')
PY
done

printf '\nAll Angular package declaration sites:\n'
rg -n '"`@angular/`(animations|build|cli|common|compiler|compiler-cli|core|forms|platform-browser|platform-browser-dynamic|router|openfeature)"\s*:' -S .

Repository: open-feature/js-sdk

Length of output: 5191

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Angular package lock/installer files present:\n'
git ls-files | rg '(^|/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb|bun\.lock)$|packages/angular/(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb|bun\.lock)$' || true

printf '\nLockfile Angular version entries (top-level occurrences if present):\n'
for lock in package-lock.json pnpm-lock.yaml yarn.lock bun.lock; do
  if [ -f "$lock" ]; then
    echo "--- $lock"
    rg -n '`@angular/`(common|compiler|compiler-cli|core|form|platform-browser|router|animations|build|cli)',max-count=80 "$lock" || true
  fi
done

Repository: open-feature/js-sdk

Length of output: 313

---

Align Angular package versions to ^21.2.19. packages/angular/package.json still pins @angular/common, @angular/compiler, @angular/compiler-cli, and @angular/core to ^21.2.17, while sibling Angular packages in this package and the SDK dependency entries use ^21.2.19. Update those four ranges to ^21.2.19 and refresh the lockfile to keep the Angular graph aligned.

📍 Affects 2 files

• packages/angular/package.json#L24-L34 (this comment)
• packages/angular/projects/angular-sdk/package.json#L28-L31

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/angular/package.json` around lines 24 - 34, Update `@angular/common`,
`@angular/compiler`, `@angular/compiler-cli`, and `@angular/core` in
packages/angular/package.json to ^21.2.19, then refresh the lockfile so the
Angular dependency graph is aligned. Also verify the sibling entries in
packages/angular/projects/angular-sdk/package.json at lines 28-31; no direct
change is needed there unless the lockfile refresh requires it.