From a0bae020266325d6d64ee23a9fda6b6a5271dbd4 Mon Sep 17 00:00:00 2001 From: saubyk <39208279+saubyk@users.noreply.github.com> Date: Tue, 28 Jul 2026 20:44:46 -0700 Subject: [PATCH] Update project dependencies to resolve Dependabot security alerts Applies the fixes from the open Dependabot PRs (#1648, #1649, #1650) in a single pass on the release branch, regenerating the lockfile from scratch. axios 1.16.0 -> 1.18.1 was the only production exposure (10 advisories). Transitive deps moved to their fixed in-range versions (fast-uri 3.1.4, form-data, qs, tough-cookie, tar, del, globby); dev toolchain took safe bumps (nodemon 3.1.14, eslint 9.39.5, @typescript-eslint 8.65.0). Drops the unused protractor devDependency: no e2e directory, no config and no e2e target in angular.json, but 100 packages and the deprecated request stack behind it. That clears both critical advisories. npm audit: 50 (2 critical) -> 29 (0 critical); production deps 1 -> 0. Remaining findings are dev-only tooling needing an Angular 21 migration rather than a version bump. Verified: lint, 204 frontend specs, backend + frontend production builds, and 19 API checks against the docker regtest fixture covering LND, Core Lightning and Eclair (getinfo, channels, peers, invoices, payments and forwarding history). --- frontend/index.html | 2 +- frontend/main.483124dd4b12e339.js | 1 - frontend/main.e9ee29bba9a8412b.js | 1 + package-lock.json | 1602 +++++------------------- package.json | 11 +- release-notes/Release-notes-0.15.10.md | 36 + 6 files changed, 336 insertions(+), 1317 deletions(-) delete mode 100644 frontend/main.483124dd4b12e339.js create mode 100644 frontend/main.e9ee29bba9a8412b.js create mode 100644 release-notes/Release-notes-0.15.10.md diff --git a/frontend/index.html b/frontend/index.html index 7222bb90..d10dc2bb 100644 --- a/frontend/index.html +++ b/frontend/index.html @@ -15,5 +15,5 @@