Skip to content

deps: bump the production-compatible group with 5 updates - #9

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-compatible-7997bfaf9a
Open

deps: bump the production-compatible group with 5 updates#9
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-compatible-7997bfaf9a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown

Bumps the production-compatible group with 5 updates:

Package From To
reflect-metadata 0.1.10 0.2.2
rxjs 5.0.3 5.5.12
systemjs 0.19.47 0.21.6
typescript 2.4.2 2.9.2
zone.js 0.7.8 0.16.2

Updates reflect-metadata from 0.1.10 to 0.2.2

Release notes

Sourced from reflect-metadata's releases.

v0.2.1

What's Changed

Full Changelog: microsoft/reflect-metadata@v0.2.0...v0.2.1

reflect-metadata 0.2.0

What's Changed

Full Changelog: microsoft/reflect-metadata@v0.1.14...v0.2.0

reflect-metadata 0.2.0-pre.0

What's Changed

Full Changelog: microsoft/reflect-metadata@v0.1.14...v0.2.0-pre.0

reflect-metadata 0.1.14

What's Changed

New Contributors

Full Changelog: microsoft/reflect-metadata@v0.1.13...v0.1.14

reflect-metadata 0.1.13

Full Changelog: microsoft/reflect-metadata@v0.1.12...v0.1.13

reflect-metadata v0.1.12

This release contains some bug fixes and test improvements. It addresses the following issues:

  • #80 - metadata seemingly erased when using multiple files with karma,mocha,webpack
  • #78 - Error when working with another polyfill, like core-js/reflect
  • #45 - When installed redundantly, Metadata could be erased

This release also fixes a critical issue in 0.1.11 that prevents the library from loading.

reflect-metadata v0.1.11 (deprecated)

This release contains some bug fixes and test improvements. It addresses the following issues:

  • #80 - metadata seemingly erased when using multiple files with karma,mocha,webpack
  • #78 - Error when working with another polyfill, like core-js/reflect
  • #45 - When installed redundantly, Metadata could be erased

... (truncated)

Commits

Updates rxjs from 5.0.3 to 5.5.12

Changelog

Sourced from rxjs's changelog.

5.5.12 (2018-08-30)

Bug Fixes

  • AjaxObservable: switch to encodeURIComponent to properly encode body form data (#3832) (09e4359), closes #3824
  • make TS type def of VirtualAction compatible with TS 2.9 (#3813) (d56e6c6)

5.5.11 (2018-05-22)

Bug Fixes

5.5.10 (2018-04-12)

Bug Fixes

5.5.9 (2018-04-11)

Bug Fixes

  • Node: multiple copies now compatible with each other in Node and TS (#3546) (bcc85ba)

5.5.8 (2018-03-27)

Bug Fixes

  • node: no more silent failure for many copies of rxjs (#3477) (92dcd44), closes #3475
  • repeatWhen: support synchronous notifier (8fe004c)

... (truncated)

Commits
  • ef88ded chore(publish): 5.5.12
  • 972bc67 Fix link to cdn (#4014)
  • d56e6c6 fix: make TS type def of VirtualAction compatible with TS 2.9 (#3813)
  • 09e4359 fix(AjaxObservable): switch to encodeURIComponent to properly encode body for...
  • 1ed8563 Merge pull request #3843 from kwonoj/disable-danger-size
  • bbd56da chore(danger): disable size checker
  • b5ed59d chore(publish): 5.5.11
  • 6b08b13 Merge pull request #3667 from cartant/issue-3605-stable
  • 9d1ba14 fix(delay): fix memory leak (#3605)
  • 21a59a7 fix: fix a typing mismatch in FromEventObservable (#3536)
  • Additional commits viewable in compare view

Updates systemjs from 0.19.47 to 0.21.6

Release notes

Sourced from systemjs's releases.

SystemJS 0.21.5

SystemJS 0.21.4

Upgrades to ES Module Loader 2.3.0:

  • Support for top-level await variant B through a promise return from System.register execute
  • Support for real ES module returns in instantiate through Symbol.toStringTag detection (allowing bridging between native loader)

SystemJS 0.21.3

Fixes a Rollup build bug resulting in rewriting of indirect eval.

SystemJS 0.21.2

Production Loader

Dev Loader

SystemJS 0.21.1

Updates SystemJS production loader to support System.config({ wasm: true }) with WebAssembly.compileStreaming.

SystemJS 0.21.0

This release represents a new build of the 6KB SystemJS production loader with the following changes:

  • Support for loading modules as AMD falling back to global detection (systemjs/systemjs#1778)
  • AMD modules are treated as having the shape { default: module } through System.import instead of returning the default directly (this will ensure dynamic import workflows work out correctly) (systemjs/systemjs#1786)

Now that Rollup supports the system module format and code splitting, this will allow easy production workflows against chunking and CDN externals.

SystemJS 0.20.19

SystemJS 0.20.18

Bug Fixes

SystemJS 0.20.17

Fixes released minified build comment removal.

SystemJS 0.20.16

Fixes a metadata plugin configuration bug affecting default extension handling through base-level meta (systemjs/systemjs#1708 thanks to @​AlbertWillemsen-Centric)

SystemJS 0.20.15

... (truncated)

Commits
Install script changes

This version adds prepublish script that runs during installation. Review the package contents before updating.


Updates typescript from 2.4.2 to 2.9.2

Commits

Updates zone.js from 0.7.8 to 0.16.2

Changelog

Sourced from zone.js's changelog.

0.16.2 (2026-05-06)

0.16.1 (2026-02-18)

  • fix(zone.js): support passthrough of Promise.try API (fc557f0), closes #67057

0.16.0 (2025-11-19)

BREAKING CHANGE

  • IE/Non-Chromium Edge are not supported anymore.

0.15.1 (2025-05-22)

Bug Fixes

  • zone.js: classes that extend Error should retain cause property (#61599) (ad8931c)
  • zone.js: more robust check for promise-like objects (#57388) (e608e6c), closes #57385
  • zone.js: remove abort listener once fetch is settled (#57882) (6976349)

0.15.0 (2024-08-15)

Bug Fixes

  • zone.js: Add support for addition jest functions. (#57280) (e1240c6), closes #57277
  • zone.js: Update the default behavior of fakeAsync to flush after the test (#57240) (70e8b40)

BREAKING CHANGES

  • zone.js: fakeAsync will now flush pending timers at the end of the given function by default. To opt-out of this, you can use {flush: false} in options parameter of fakeAsync

0.14.10 (2024-08-05)

Features

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for zone.js since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the production-compatible group with 5 updates
89d423a 
Bumps the production-compatible group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [reflect-metadata](https://github.com/rbuckton/reflect-metadata) | `0.1.10` | `0.2.2` |
| [rxjs](https://github.com/reactivex/rxjs) | `5.0.3` | `5.5.12` |
| [systemjs](https://github.com/systemjs/systemjs) | `0.19.47` | `0.21.6` |
| [typescript](https://github.com/microsoft/TypeScript) | `2.4.2` | `2.9.2` |
| [zone.js](https://github.com/angular/angular/tree/HEAD/packages/zone.js) | `0.7.8` | `0.16.2` |


Updates `reflect-metadata` from 0.1.10 to 0.2.2
- [Release notes](https://github.com/rbuckton/reflect-metadata/releases)
- [Commits](https://github.com/rbuckton/reflect-metadata/commits)

Updates `rxjs` from 5.0.3 to 5.5.12
- [Release notes](https://github.com/reactivex/rxjs/releases)
- [Changelog](https://github.com/ReactiveX/rxjs/blob/5.5.12/CHANGELOG.md)
- [Commits](ReactiveX/rxjs@5.0.3...5.5.12)

Updates `systemjs` from 0.19.47 to 0.21.6
- [Release notes](https://github.com/systemjs/systemjs/releases)
- [Changelog](https://github.com/systemjs/systemjs/blob/main/CHANGELOG.md)
- [Commits](systemjs/systemjs@0.19.47...0.21.6)

Updates `typescript` from 2.4.2 to 2.9.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v2.4.2...v2.9.2)

Updates `zone.js` from 0.7.8 to 0.16.2
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/packages/zone.js/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/zone.js-0.16.2/packages/zone.js)

---
updated-dependencies:
- dependency-name: reflect-metadata
  dependency-version: 0.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-compatible
- dependency-name: rxjs
  dependency-version: 5.5.12
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-compatible
- dependency-name: systemjs
  dependency-version: 0.21.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-compatible
- dependency-name: typescript
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-compatible
- dependency-name: zone.js
  dependency-version: 0.16.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-compatible
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
@socket-security

socket-security Bot commented Sep 1, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedreflect-metadata@​0.1.10 ⏵ 0.2.2100 +11001008080
Updatedtypescript@​2.4.2 ⏵ 2.9.2100100100 +1100 +580
Updatedsystemjs@​0.19.47 ⏵ 0.21.699 +210010082100
Updatedrxjs@​5.0.3 ⏵ 5.5.1288 -1110010083100
Updatedzone.js@​0.7.8 ⏵ 0.16.2100 +1100100 +1284 -1100

View full report

@socket-security

socket-security Bot commented Sep 1, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm rxjs is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/rxjs@5.5.12

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rxjs@5.5.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants