Copilot commented on code in PR #7378:
URL: https://github.com/apache/texera/pull/7378#discussion_r3732810035
##########
frontend/package.json:
##########
@@ -123,7 +123,7 @@
"eslint-plugin-rxjs-angular": "2.0.1",
"jsdom": "25.0.1",
"nodecat": "2.0.0",
- "nx": "23.0.1",
+ "nx": "23.0.2",
"playwright": "1.59.1",
"prettier": "3.2.5",
Review Comment:
`nx` was bumped to 23.0.2, but `@nx/angular` is still pinned to 23.0.1
elsewhere in this same file. As a result, `yarn.lock` still contains
`[email protected]` (in addition to `[email protected]`), which likely defeats the goal of
fully removing the vulnerable Nx version and can also lead to subtle
runtime/plugin mismatches. Consider upgrading `@nx/angular` (and any other
`@nx/*` packages) to 23.0.2 as well, then re-running `yarn install` so the
lockfile converges on a single Nx patch version.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
