Bump sigstore and @angular/cli by dependabot[bot] · Pull Request #179 · capitalone/acronym-decoder

dependabot · 2026-07-02T11:42:12Z

Removes sigstore. It's no longer used after updating ancestor dependency @angular/cli. These dependencies need to be updated together.

Removes sigstore

Updates @angular/cli from 19.2.19 to 22.2.3

Release notes

Sourced from @angular/cli's releases.

22.2.3

@schematics/angular

Commit Description

keep the workspace build version in the use-application-builder migration

@angular/cli

Commit Description

accept multi-digit array indices in ng config

keep ng version working when the package manager is not installed

resolve package name in npm workspace members

@angular-devkit/schematics

Commit Description

avoid stack overflow when chaining many rules

@angular/build

Commit Description

add CSP nonce to stylesheet and modulepreload link elements

always use AOT when extracting i18n messages

coalesce external watcher directories to avoid macOS FSEvents limit

disable Vitest fsModuleCache in unit-test builder

ensure Sass importers return global Promise instances

keep Vite server file watcher disabled in Vitest watch mode

sort discovered unit-test files for deterministic builds

use module.registerHooks() for in-memory ESM loader

avoid invalidating Angular diagnostic cache on stylesheet change

resolve asset patterns concurrently with bounded concurrency

@angular/ssr

Commit Description

preserve preload metadata for nested empty-path routes

preserve query parameters on relative route redirects

resolve relative redirects against the parent route

22.2.2

@angular-devkit/build-angular

Commit Description

preserve Host header when proxying in ssr-dev-server

@angular/build

Commit Description

keep the order of glob entries in the proxy configuration

support a string context in array-form proxy configurations

22.2.1

@angular-devkit/schematics-cli

Commit Description

... (truncated)

Changelog

Sourced from @angular/cli's changelog.

22.2.3 (2026-10-15)

@angular/cli

Commit Type Description

3158e865f fix accept multi-digit array indices in ng config

bcff0e76a fix keep ng version working when the package manager is not installed

5570c91d2 fix resolve package name in npm workspace members

@schematics/angular

Commit Type Description

881865f36 fix keep the workspace build version in the use-application-builder migration

@angular-devkit/schematics

Commit Type Description

cf1f3b9d4 fix avoid stack overflow when chaining many rules

@angular/build

Commit Type Description

1d477d6bc fix add CSP nonce to stylesheet and modulepreload link elements

fbe208f83 fix always use AOT when extracting i18n messages

c1c4216a6 fix coalesce external watcher directories to avoid macOS FSEvents limit

792990bc2 fix disable Vitest fsModuleCache in unit-test builder

82439399c fix ensure Sass importers return global Promise instances

a818de415 fix keep Vite server file watcher disabled in Vitest watch mode

91bad469e fix sort discovered unit-test files for deterministic builds

e84db4af7 fix use module.registerHooks() for in-memory ESM loader

a428021b7 perf avoid invalidating Angular diagnostic cache on stylesheet change

b0ac394a0 perf resolve asset patterns concurrently with bounded concurrency

@angular/ssr

Commit Type Description

bd09b98fc fix preserve preload metadata for nested empty-path routes

a92546892 fix preserve query parameters on relative route redirects

a2b86cc94 fix resolve relative redirects against the parent route

21.2.27 (2026-10-14)

... (truncated)

Commits

afa3814 release: cut the v22.2.3 release
cc05ecf build: update pnpm to v12.11.2
c1c4216 fix(@angular/build): coalesce external watcher directories to avoid macOS FSE...
116cb93 build: update cross-repo angular dependencies
e84db4a fix(@angular/build): use module.registerHooks() for in-memory ESM loader
cf1f3b9 fix(@angular-devkit/schematics): avoid stack overflow when chaining many rules
91bad46 fix(@angular/build): sort discovered unit-test files for deterministic builds
bd09b98 fix(@angular/ssr): preserve preload metadata for nested empty-path routes
9313776 build: lock file maintenance
c0b6659 build: update dependency zod to v4.6.6
Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

CLAassistant · 2026-07-02T11:42:22Z

All committers have signed the CLA.

sonarqubecloud · 2026-07-02T11:42:36Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

socket-security · 2026-07-02T11:42:49Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@angular/cli@19.2.19 ⏵ 22.2.3	⁺¹³		⁺¹	⁺¹

View full report

socket-security · 2026-07-02T11:42:51Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	License policy violation: npm `typescript` License: LicenseRef-CC-BY-4.0-0c618849 - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: package-lock.json → `npm/@angular/cli@22.2.3` → `npm/typescript@6.0.3` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typescript@6.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

amadib · 2026-10-19T12:45:37Z

@dependabot rebase

Removes [sigstore](https://github.com/sigstore/sigstore-js). It's no longer used after updating ancestor dependency [@angular/cli](https://github.com/angular/angular-cli). These dependencies need to be updated together. Removes `sigstore` Updates `@angular/cli` from 19.2.19 to 22.2.3 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@19.2.19...v22.2.3) --- updated-dependencies: - dependency-name: "@angular/cli" dependency-version: 22.0.5 dependency-type: direct:development - dependency-name: sigstore dependency-version: 4.1.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

sonarqubecloud · 2026-10-19T12:49:19Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 2, 2026

dependabot Bot requested a review from a team as a code owner July 2, 2026 11:42

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 2, 2026

github-actions Bot enabled auto-merge (squash) July 2, 2026 11:42

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-27a3df8e2d branch from 9421b18 to be49629 Compare October 19, 2026 12:46

dependabot Bot requested a review from a team as a code owner October 19, 2026 12:46

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-27a3df8e2d branch from be49629 to 58c37c8 Compare October 19, 2026 12:48

amadib mentioned this pull request Oct 20, 2026

Upgrade to Angular 21 #212

Open

2 tasks

Navigation Menu

Repository navigation

Bump sigstore and @angular/cli - #179

Bump sigstore and @angular/cli#179
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-27a3df8e2d

dependabot Bot commented on behalf of github Jul 2, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Jul 2, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Jul 2, 2026

Uh oh!

socket-security Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

amadib commented Oct 19, 2026

Uh oh!

sonarqubecloud Bot commented Oct 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Commit	Description
	accept multi-digit array indices in ng config
	keep ng version working when the package manager is not installed
	resolve package name in npm workspace members

Commit	Description
	add CSP nonce to stylesheet and modulepreload link elements
	always use AOT when extracting i18n messages
	coalesce external watcher directories to avoid macOS FSEvents limit
	disable Vitest fsModuleCache in unit-test builder
	ensure Sass importers return global Promise instances
	keep Vite server file watcher disabled in Vitest watch mode
	sort discovered unit-test files for deterministic builds
	use module.registerHooks() for in-memory ESM loader
	avoid invalidating Angular diagnostic cache on stylesheet change
	resolve asset patterns concurrently with bounded concurrency

Commit	Description
	preserve preload metadata for nested empty-path routes
	preserve query parameters on relative route redirects
	resolve relative redirects against the parent route

Commit	Description
	keep the order of glob entries in the proxy configuration
	support a string `context` in array-form proxy configurations

Commit	Type	Description
3158e865f	fix	accept multi-digit array indices in ng config
bcff0e76a	fix	keep ng version working when the package manager is not installed
5570c91d2	fix	resolve package name in npm workspace members

Commit	Type	Description
1d477d6bc	fix	add CSP nonce to stylesheet and modulepreload link elements
fbe208f83	fix	always use AOT when extracting i18n messages
c1c4216a6	fix	coalesce external watcher directories to avoid macOS FSEvents limit
792990bc2	fix	disable Vitest fsModuleCache in unit-test builder
82439399c	fix	ensure Sass importers return global Promise instances
a818de415	fix	keep Vite server file watcher disabled in Vitest watch mode
91bad469e	fix	sort discovered unit-test files for deterministic builds
e84db4af7	fix	use module.registerHooks() for in-memory ESM loader
a428021b7	perf	avoid invalidating Angular diagnostic cache on stylesheet change
b0ac394a0	perf	resolve asset patterns concurrently with bounded concurrency

Commit	Type	Description
bd09b98fc	fix	preserve preload metadata for nested empty-path routes
a92546892	fix	preserve query parameters on relative route redirects
a2b86cc94	fix	resolve relative redirects against the parent route

Conversation

dependabot Bot commented on behalf of github Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

22.2.3

@​schematics/angular

@​angular/cli

@​angular-devkit/schematics

@​angular/build

@​angular/ssr

22.2.2

@​angular-devkit/build-angular

@​angular/build

22.2.1

@​angular-devkit/schematics-cli

22.2.3 (2026-10-15)

@​angular/cli

@​schematics/angular

@​angular-devkit/schematics

@​angular/build

@​angular/ssr

21.2.27 (2026-10-14)

Uh oh!

CLAassistant commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jul 2, 2026

Quality Gate passed

Uh oh!

socket-security Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

amadib commented Oct 19, 2026

Uh oh!

sonarqubecloud Bot commented Oct 19, 2026

Quality Gate passed

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Jul 2, 2026 •

edited

Loading

`@schematics/angular`

`@angular/cli`

`@angular-devkit/schematics`

`@angular/build`

`@angular/ssr`

`@angular-devkit/build-angular`

`@angular/build`

`@angular-devkit/schematics-cli`

`@angular/cli`

`@schematics/angular`

`@angular-devkit/schematics`

`@angular/build`

`@angular/ssr`

CLAassistant commented Jul 2, 2026 •

edited

Loading

socket-security Bot commented Jul 2, 2026 •

edited

Loading

socket-security Bot commented Jul 2, 2026 •

edited

Loading