chore(deps): update dependency ng-packagr to v10 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ng-packagr	5.1.0 → 10.1.1

---

OS Command Injection in ng-packagr

CVE-2020-7735 / GHSA-qm28-7hqv-wg5j

More information

Details

The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.

Severity

• CVSS Score: 6.6 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-7735
• https://github.com/ng-packagr/ng-packagr/commit/bda0fff3443301f252930a73fdc8fb9502de596d
• https://snyk.io/vuln/SNYK-JS-NGPACKAGR-1012427
• https://github.com/advisories/GHSA-qm28-7hqv-wg5j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ng-packagr/ng-packagr (ng-packagr)

v10.1.1

Compare Source

v10.1.0

Compare Source

v10.0.4

Compare Source

v10.0.3

Compare Source

v10.0.2

Compare Source

v10.0.1

Compare Source

v10.0.0

Compare Source

Features

• improve progress reporting (3a9827f)

Bug Fixes

• update @​rollup/plugin-commonjs to version ^16.0.0 (75e5d51)
• update @​rollup/plugin-node-resolve to version ^10.0.0 (e76b97b)

v9.1.5

Compare Source

Bug Fixes

• remove tslib from peerDependencies when adding it to dependencies (593f861)

v9.1.4

Compare Source

Bug Fixes

• auto add tslib as direct dependency (298fbc4)

9.1.3 (2020-05-06)

v9.1.3

Compare Source

Bug Fixes

• update browserslist and autoprefixer (8293497), closes #​1611
• update rollup-plugin-sourcemaps to version ^0.6.0 (f8c3459)

v9.1.2

Compare Source

v9.1.1

Compare Source

19.1.1 (2025-01-24)

Bug Fixes

• disable TypeScript removeComments option (f0415dd)

v9.1.0

Compare Source

19.1.1 (2025-01-24)

Bug Fixes

• disable TypeScript removeComments option (f0415dd)

v9.0.3

Compare Source

v9.0.2

Compare Source

v9.0.1

Compare Source

Features

• support TypeScript 5.7 (af70d03)

19.0.1 (2024-11-22)

Bug Fixes

• correctly show stylesheet processing errors (4d66246)

v9.0.0

Compare Source

Features

• support TypeScript 5.7 (af70d03)

19.0.1 (2024-11-22)

Bug Fixes

• correctly show stylesheet processing errors (4d66246)

v5.7.1

Compare Source

v5.7.0

Compare Source

v5.6.1

Compare Source

v5.6.0

Compare Source

v5.5.1

Compare Source

v5.5.0: 5.5.0

Compare Source

Bug Fixes

• disable treeshaking when generating bundles (34b26fc)
• update commander to version ^3.0.0 (dcd4853)

Features

• disable Ivy in default tsconfig (f50dd2f)
• show error when trying to publish ivy packages (c3122d6)

v5.4.3

Compare Source

v5.4.2

Compare Source

v5.4.1

Compare Source

v5.4.0

Compare Source

v5.3.0

Compare Source

v5.2.0

Compare Source

⚠ BREAKING CHANGES

• Node.js v14 support has been removed

Node.js v14 is planned to be End-of-Life on 2023-04-30. Angular will stop supporting Node.js v14 in Angular v16. Angular v16 will continue to officially support Node.js versions v16 and v18.

• NGCC integration has been removed and as a result Angular View Engine libraries will no longer work.

Features

• remove NGCC integration (d9fdc89)

Bug Fixes

• always set destination directory (4e89bcf)

• remove Node.js v14 support (a091d82)

15.2.1 (2023-02-22)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.