FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

fix: bump undici and @angular/build in /packages/bigframes/bigframes/display/table_widget_angular by dependabot[bot] · Pull Request #17986 · googleapis/google-cloud-python · GitHub

/ google-cloud-python Public

fix: bump undici and @angular/build in /packages/bigframes/bigframes/display/table_widget_angular - #17986

Merged
parthea merged 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/bigframes/bigframes/display/table_widget_angular/multi-086ee281ad
Aug 4, 2026
ConversationCommits (1)ChecksFiles changed
Merged

fix: bump undici and @angular/build in /packages/bigframes/bigframes/display/table_widget_angular#17986
parthea merged 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/bigframes/bigframes/display/table_widget_angular/multi-086ee281ad

Conversation

dependabot Bot commented on behalf of github Aug 4, 2026

Copy link
Copy Markdown
Contributor

Bumps undici to 6.28.0 and updates ancestor dependencies undici and @angular/build. These dependencies need to be updated together.

Updates undici from 6.27.0 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

Commits
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
  • cba3a52 fix(retry): reject partial content length mismatch
  • af74840 fix: harden cookie domain, path, and unparsed attribute validation
  • See full diff in compare view

Updates undici from 7.28.0 to 7.29.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

Commits
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
  • cba3a52 fix(retry): reject partial content length mismatch
  • af74840 fix: harden cookie domain, path, and unparsed attribute validation
  • See full diff in compare view

Updates @angular/build from 21.2.16 to 22.1.2

Release notes

Sourced from @​angular/build's releases.

22.1.2

@​angular/cli

Commit Description
add packages with built-in schematics to devDependencies only

@​angular/build

Commit Description
prevent IIFE wrapper interleaving for adjacent classes in minified files

22.1.1

@​angular/cli

Commit Description
support npm 12 metadata array and error formats

@​angular/build

Commit Description
rewrite paths from sandboxed execroots when running under Bazel

22.1.0

@​angular/cli

Commit Description
abort and guide manual mitigation when updating catalog packages
prevent Yarn registry environment variable override
remove algoliasearch dependency and support latest docs versions
resolve correct registry name when using npm alias syntax during update
respect client-side release age settings during update resolution
revert package.json changes if installation tasks fail during update
robustly parse npm manifest from array

@​schematics/angular

Commit Description
update ai-config to include Angular MCP server config
remove unused spec tsconfig outDir

@​angular-devkit/core

Commit Description
deprecate stringToFileBuffer and fileBufferToString

@​angular/build

Commit Description
add built-in SQLite cache store fallback
emit debug ids for stable subresource integrity hashes
enable chunk optimization for server builds
migrate advanced optimization Babel plugins to oxc-parser + magic-string
migrate i18n inliner to oxc-parser + magic-string
share persistent build cache across git worktrees
add bounded timeout to vitest executor disposal

... (truncated)

Changelog

Sourced from @​angular/build's changelog.

22.1.2 (2026-07-30)

@​angular/cli

Commit Type Description
57db27ea91 fix add packages with built-in schematics to devDependencies only

@​angular/build

Commit Type Description
baed978885 fix prevent IIFE wrapper interleaving for adjacent classes in minified files

22.1.1 (2026-07-30)

@​angular/cli

Commit Type Description
ab971a8543 fix support npm 12 metadata array and error formats

@​angular/build

Commit Type Description
db24220fb8 fix rewrite paths from sandboxed execroots when running under Bazel

22.2.0-next.0 (2026-07-30)

@​angular/cli

Commit Type Description
e148a8df93 fix support npm 12 metadata array and error formats

@​angular/build

Commit Type Description
6469b5f1f5 fix rewrite paths from sandboxed execroots when running under Bazel

... (truncated)

Commits
  • bccc749 release: cut the v22.1.2 release
  • 57db27e fix(@​angular/cli): add packages with built-in schematics to devDependencies only
  • baed978 fix(@​angular/build): prevent IIFE wrapper interleaving for adjacent classes i...
  • dde9aed build: update cross-repo angular dependencies
  • 51efbd8 build: update github/codeql-action action to v4.37.4
  • 6c15ac8 ci: add branch tracking comments to dev-infra GitHub actions
  • 5d92c65 release: cut the v22.1.1 release
  • e30e18a build: update dependency webpack to v5.109.2
  • 46d42d8 build: update dependency oxc-parser to v0.142.0
  • 9ccb475 build: update bazel dependencies
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

fix: bump undici and @angular/build
62d8150 
Bumps [undici](https://github.com/nodejs/undici) to 6.28.0 and updates ancestor dependencies [undici](https://github.com/nodejs/undici) and [@angular/build](https://github.com/angular/angular-cli). These dependencies need to be updated together.


Updates `undici` from 6.27.0 to 6.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.27.0...v6.28.0)

Updates `undici` from 7.28.0 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.27.0...v6.28.0)

Updates `@angular/build` from 21.2.16 to 22.1.2
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](angular/angular-cli@v21.2.16...v22.1.2)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: indirect
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: indirect
- dependency-name: "@angular/build"
  dependency-version: 22.1.2
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 4, 2026
dependabot Bot requested review from a team as code owners August 4, 2026 04:00
dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 4, 2026
dependabot Bot requested review from shuoweil and removed request for a team August 4, 2026 04:00
dependabot Bot added the javascript Pull requests that update javascript code label Aug 4, 2026
trusted-contributions-gcf Bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Aug 4, 2026
yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Aug 4, 2026
parthea merged commit 6938061 into main Aug 4, 2026
42 of 43 checks passed
parthea deleted the dependabot/npm_and_yarn/packages/bigframes/bigframes/display/table_widget_angular/multi-086ee281ad branch August 4, 2026 14:39
release-please Bot mentioned this pull request Aug 4, 2026
Merged
shuoweil pushed a commit that referenced this pull request Aug 12, 2026
chore(main): release bigframes 2.48.0 (#17982)
102c940 
🤖 I have created a release *beep* *boop*
---


##
[2.48.0](bigframes-v2.47.0...bigframes-v2.48.0)
(2026-08-12)


### Features

* **bigframes:** Transpiler supports more string ops
([#17693](#17693))
([7d2bc21](7d2bc21))


### Bug Fixes

* **bigframes:** fix field name typos for ai.generate* functions
([#17983](#17983))
([1b5c48b](1b5c48b))
* **bigframes:** resolve session-scoped API method logging
([#18076](#18076))
([ace618b](ace618b))
* **bigframes:** update GeminiTextGenerator default model to
gemini-2.5-flash
([#18060](#18060))
([5770ff6](5770ff6))
* bump @angular/compiler, @angular/common, @angular/core,
@angular/forms, @angular/platform-browser, @angular/router and
@angular/compiler-cli in
/packages/bigframes/bigframes/display/table_widget_angular
([#17992](#17992))
([346aaab](346aaab))
* bump fast-uri from 3.1.4 to 3.1.5 in
/packages/bigframes/bigframes/display/table_widget_angular
([#17989](#17989))
([3b3f3f4](3b3f3f4))
* bump hono from 4.12.31 to 4.13.1 in
/packages/bigframes/bigframes/display/table_widget_angular
([#18032](#18032))
([cddf35b](cddf35b))
* bump ip-address and express-rate-limit in
/packages/bigframes/bigframes/display/table_widget_angular
([#17985](#17985))
([02ed656](02ed656))
* bump undici and @angular/build in
/packages/bigframes/bigframes/display/table_widget_angular
([#17986](#17986))
([6938061](6938061))
* bump undici from 7.25.0 to 7.29.0 in /packages/bigframes/tests/js
([#17987](#17987))
([65a3571](65a3571))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
copybara-service Bot pushed a commit to google/bigframes that referenced this pull request Aug 12, 2026
chore(main): release bigframes 2.48.0 (#17982)
7dd5232 
🤖 I have created a release *beep* *boop*
---

##
[2.48.0](googleapis/google-cloud-python@bigframes-v2.47.0...bigframes-v2.48.0)
(2026-08-12)

### Features

* **bigframes:** Transpiler supports more string ops
([#17693](googleapis/google-cloud-python#17693))
([7d2bc21](googleapis/google-cloud-python@7d2bc21))

### Bug Fixes

* **bigframes:** fix field name typos for ai.generate* functions
([#17983](googleapis/google-cloud-python#17983))
([1b5c48b](googleapis/google-cloud-python@1b5c48b))
* **bigframes:** resolve session-scoped API method logging
([#18076](googleapis/google-cloud-python#18076))
([ace618b](googleapis/google-cloud-python@ace618b))
* **bigframes:** update GeminiTextGenerator default model to
gemini-2.5-flash
([#18060](googleapis/google-cloud-python#18060))
([5770ff6](googleapis/google-cloud-python@5770ff6))
* bump @angular/compiler, @angular/common, @angular/core,
@angular/forms, @angular/platform-browser, @angular/router and
@angular/compiler-cli in
/packages/bigframes/bigframes/display/table_widget_angular
([#17992](googleapis/google-cloud-python#17992))
([346aaab](googleapis/google-cloud-python@346aaab))
* bump fast-uri from 3.1.4 to 3.1.5 in
/packages/bigframes/bigframes/display/table_widget_angular
([#17989](googleapis/google-cloud-python#17989))
([3b3f3f4](googleapis/google-cloud-python@3b3f3f4))
* bump hono from 4.12.31 to 4.13.1 in
/packages/bigframes/bigframes/display/table_widget_angular
([#18032](googleapis/google-cloud-python#18032))
([cddf35b](googleapis/google-cloud-python@cddf35b))
* bump ip-address and express-rate-limit in
/packages/bigframes/bigframes/display/table_widget_angular
([#17985](googleapis/google-cloud-python#17985))
([02ed656](googleapis/google-cloud-python@02ed656))
* bump undici and @angular/build in
/packages/bigframes/bigframes/display/table_widget_angular
([#17986](googleapis/google-cloud-python#17986))
([6938061](googleapis/google-cloud-python@6938061))
* bump undici from 7.25.0 to 7.29.0 in /packages/bigframes/tests/js
([#17987](googleapis/google-cloud-python#17987))
([65a3571](googleapis/google-cloud-python@65a3571))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
GitOrigin-RevId: 102c940183ac1cf5670b46c17a47f559926634de
Change-Id: Ia15429511df3ebed77f5b4ad45779f8c6be0316d
hebaalazzeh pushed a commit that referenced this pull request Aug 13, 2026
chore(main): release bigframes 2.48.0 (#17982)
647bd6b 
🤖 I have created a release *beep* *boop*
---


##
[2.48.0](bigframes-v2.47.0...bigframes-v2.48.0)
(2026-08-12)


### Features

* **bigframes:** Transpiler supports more string ops
([#17693](#17693))
([7d2bc21](7d2bc21))


### Bug Fixes

* **bigframes:** fix field name typos for ai.generate* functions
([#17983](#17983))
([1b5c48b](1b5c48b))
* **bigframes:** resolve session-scoped API method logging
([#18076](#18076))
([ace618b](ace618b))
* **bigframes:** update GeminiTextGenerator default model to
gemini-2.5-flash
([#18060](#18060))
([5770ff6](5770ff6))
* bump @angular/compiler, @angular/common, @angular/core,
@angular/forms, @angular/platform-browser, @angular/router and
@angular/compiler-cli in
/packages/bigframes/bigframes/display/table_widget_angular
([#17992](#17992))
([346aaab](346aaab))
* bump fast-uri from 3.1.4 to 3.1.5 in
/packages/bigframes/bigframes/display/table_widget_angular
([#17989](#17989))
([3b3f3f4](3b3f3f4))
* bump hono from 4.12.31 to 4.13.1 in
/packages/bigframes/bigframes/display/table_widget_angular
([#18032](#18032))
([cddf35b](cddf35b))
* bump ip-address and express-rate-limit in
/packages/bigframes/bigframes/display/table_widget_angular
([#17985](#17985))
([02ed656](02ed656))
* bump undici and @angular/build in
/packages/bigframes/bigframes/display/table_widget_angular
([#17986](#17986))
([6938061](6938061))
* bump undici from 7.25.0 to 7.29.0 in /packages/bigframes/tests/js
([#17987](#17987))
([65a3571](65a3571))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

parthea parthea approved these changes
shuoweil Awaiting requested review from shuoweil shuoweil was automatically assigned from googleapis/bigquery-dataframe-team

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

Back | FazBrowse Home | New Git URL