Skip to content

deps: bump the production-compatible group across 1 directory with 5 updates - #8

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-compatible-7997bfaf9a
Closed

deps: bump the production-compatible group across 1 directory with 5 updates#8
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-compatible-7997bfaf9a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production-compatible group with 5 updates in the / directory:

Package From To
reflect-metadata 0.1.10 0.2.2
rxjs 5.0.3 5.5.12
systemjs 0.19.47 0.21.6
typescript 2.4.2 2.9.2
zone.js 0.7.8 0.16.2

Updates reflect-metadata from 0.1.10 to 0.2.2

Release notes

Sourced from reflect-metadata's releases.

v0.2.1

What's Changed

Full Changelog: microsoft/reflect-metadata@v0.2.0...v0.2.1

reflect-metadata 0.2.0

What's Changed

Full Changelog: microsoft/reflect-metadata@v0.1.14...v0.2.0

reflect-metadata 0.2.0-pre.0

What's Changed

Full Changelog: microsoft/reflect-metadata@v0.1.14...v0.2.0-pre.0

reflect-metadata 0.1.14

What's Changed

New Contributors

Full Changelog: microsoft/reflect-metadata@v0.1.13...v0.1.14

reflect-metadata 0.1.13

Full Changelog: microsoft/reflect-metadata@v0.1.12...v0.1.13

reflect-metadata v0.1.12

This release contains some bug fixes and test improvements. It addresses the following issues:

  • #80 - metadata seemingly erased when using multiple files with karma,mocha,webpack
  • #78 - Error when working with another polyfill, like core-js/reflect
  • #45 - When installed redundantly, Metadata could be erased

This release also fixes a critical issue in 0.1.11 that prevents the library from loading.

reflect-metadata v0.1.11 (deprecated)

This release contains some bug fixes and test improvements. It addresses the following issues:

  • #80 - metadata seemingly erased when using multiple files with karma,mocha,webpack
  • #78 - Error when working with another polyfill, like core-js/reflect
  • #45 - When installed redundantly, Metadata could be erased

... (truncated)

Commits

Updates rxjs from 5.0.3 to 5.5.12

Changelog

Sourced from rxjs's changelog.

5.5.12 (2018-08-30)

Bug Fixes

  • AjaxObservable: switch to encodeURIComponent to properly encode body form data (#3832) (09e4359), closes #3824
  • make TS type def of VirtualAction compatible with TS 2.9 (#3813) (d56e6c6)

5.5.11 (2018-05-22)

Bug Fixes

5.5.10 (2018-04-12)

Bug Fixes

5.5.9 (2018-04-11)

Bug Fixes

  • Node: multiple copies now compatible with each other in Node and TS (#3546) (bcc85ba)

5.5.8 (2018-03-27)

Bug Fixes

  • node: no more silent failure for many copies of rxjs (#3477) (92dcd44), closes #3475
  • repeatWhen: support synchronous notifier (8fe004c)

... (truncated)

Commits
  • ef88ded chore(publish): 5.5.12
  • 972bc67 Fix link to cdn (#4014)
  • d56e6c6 fix: make TS type def of VirtualAction compatible with TS 2.9 (#3813)
  • 09e4359 fix(AjaxObservable): switch to encodeURIComponent to properly encode body for...
  • 1ed8563 Merge pull request #3843 from kwonoj/disable-danger-size
  • bbd56da chore(danger): disable size checker
  • b5ed59d chore(publish): 5.5.11
  • 6b08b13 Merge pull request #3667 from cartant/issue-3605-stable
  • 9d1ba14 fix(delay): fix memory leak (#3605)
  • 21a59a7 fix: fix a typing mismatch in FromEventObservable (#3536)
  • Additional commits viewable in compare view

Updates systemjs from 0.19.47 to 0.21.6

Release notes

Sourced from systemjs's releases.

SystemJS 0.21.5

SystemJS 0.21.4

Upgrades to ES Module Loader 2.3.0:

  • Support for top-level await variant B through a promise return from System.register execute
  • Support for real ES module returns in instantiate through Symbol.toStringTag detection (allowing bridging between native loader)

SystemJS 0.21.3

Fixes a Rollup build bug resulting in rewriting of indirect eval.

SystemJS 0.21.2

Production Loader

Dev Loader

SystemJS 0.21.1

Updates SystemJS production loader to support System.config({ wasm: true }) with WebAssembly.compileStreaming.

SystemJS 0.21.0

This release represents a new build of the 6KB SystemJS production loader with the following changes:

  • Support for loading modules as AMD falling back to global detection (systemjs/systemjs#1778)
  • AMD modules are treated as having the shape { default: module } through System.import instead of returning the default directly (this will ensure dynamic import workflows work out correctly) (systemjs/systemjs#1786)

Now that Rollup supports the system module format and code splitting, this will allow easy production workflows against chunking and CDN externals.

SystemJS 0.20.19

SystemJS 0.20.18

Bug Fixes

SystemJS 0.20.17

Fixes released minified build comment removal.

SystemJS 0.20.16

Fixes a metadata plugin configuration bug affecting default extension handling through base-level meta (systemjs/systemjs#1708 thanks to @​AlbertWillemsen-Centric)

SystemJS 0.20.15

... (truncated)

Commits
Install script changes

This version adds prepublish script that runs during installation. Review the package contents before updating.


Updates typescript from 2.4.2 to 2.9.2

Commits

Updates zone.js from 0.7.8 to 0.16.2

Changelog

Sourced from zone.js's changelog.

0.16.2 (2026-05-06)

0.16.1 (2026-02-18)

  • fix(zone.js): support passthrough of Promise.try API (fc557f0), closes #67057

0.16.0 (2025-11-19)

BREAKING CHANGE

  • IE/Non-Chromium Edge are not supported anymore.

0.15.1 (2025-05-22)

Bug Fixes

  • zone.js: classes that extend Error should retain cause property (#61599) (ad8931c)
  • zone.js: more robust check for promise-like objects (#57388) (e608e6c), closes #57385
  • zone.js: remove abort listener once fetch is settled (#57882) (6976349)

0.15.0 (2024-08-15)

Bug Fixes

  • zone.js: Add support for addition jest functions. (#57280) (e1240c6), closes #57277
  • zone.js: Update the default behavior of fakeAsync to flush after the test (#57240) (70e8b40)

BREAKING CHANGES

  • zone.js: fakeAsync will now flush pending timers at the end of the given function by default. To opt-out of this, you can use {flush: false} in options parameter of fakeAsync

0.14.10 (2024-08-05)

Features

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for zone.js since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 23, 2026
@socket-security

socket-security Bot commented Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedreflect-metadata@​0.1.10 ⏵ 0.2.2100 +11001008080
Updatedtypescript@​2.4.2 ⏵ 2.9.2100100100 +1100 +580
Updatedsystemjs@​0.19.47 ⏵ 0.21.699 +210010082100
Updatedrxjs@​5.0.3 ⏵ 5.5.1288 -1110010083100
Updatedzone.js@​0.7.8 ⏵ 0.16.2100 +1100100 +1284 -1100

View full report

@socket-security

socket-security Bot commented Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm rxjs is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/rxjs@5.5.12

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rxjs@5.5.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot
deps: bump the production-compatible group across 1 directory with 5 …
671e7bb 
…updates

Bumps the production-compatible group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [reflect-metadata](https://github.com/rbuckton/reflect-metadata) | `0.1.10` | `0.2.2` |
| [rxjs](https://github.com/reactivex/rxjs) | `5.0.3` | `5.5.12` |
| [systemjs](https://github.com/systemjs/systemjs) | `0.19.47` | `0.21.6` |
| [typescript](https://github.com/microsoft/TypeScript) | `2.4.2` | `2.9.2` |
| [zone.js](https://github.com/angular/angular/tree/HEAD/packages/zone.js) | `0.7.8` | `0.16.2` |



Updates `reflect-metadata` from 0.1.10 to 0.2.2
- [Release notes](https://github.com/rbuckton/reflect-metadata/releases)
- [Commits](https://github.com/rbuckton/reflect-metadata/commits)

Updates `rxjs` from 5.0.3 to 5.5.12
- [Release notes](https://github.com/reactivex/rxjs/releases)
- [Changelog](https://github.com/ReactiveX/rxjs/blob/5.5.12/CHANGELOG.md)
- [Commits](ReactiveX/rxjs@5.0.3...5.5.12)

Updates `systemjs` from 0.19.47 to 0.21.6
- [Release notes](https://github.com/systemjs/systemjs/releases)
- [Changelog](https://github.com/systemjs/systemjs/blob/main/CHANGELOG.md)
- [Commits](systemjs/systemjs@0.19.47...0.21.6)

Updates `typescript` from 2.4.2 to 2.9.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v2.4.2...v2.9.2)

Updates `zone.js` from 0.7.8 to 0.16.2
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/packages/zone.js/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/zone.js-0.16.2/packages/zone.js)

---
updated-dependencies:
- dependency-name: reflect-metadata
  dependency-version: 0.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-compatible
- dependency-name: rxjs
  dependency-version: 5.5.12
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-compatible
- dependency-name: systemjs
  dependency-version: 0.21.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-compatible
- dependency-name: typescript
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-compatible
- dependency-name: zone.js
  dependency-version: 0.16.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-compatible
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-compatible-7997bfaf9a branch from e14d00c to 671e7bb Compare August 23, 2026 06:05
@alexandroit

alexandroit commented Aug 23, 2026

Copy link
Copy Markdown
Owner

Closing because the compatibility CI fails: the grouped Zone.js 0.16, TypeScript 2.9, RxJS and SystemJS changes do not preserve the exact Angular 2 runtime contract. This playground intentionally pins a tested legacy combination; future updates must be evaluated individually.

@dependabot @github

dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-compatible-7997bfaf9a branch August 23, 2026 07:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@alexandroit