mirror of
https://github.com/Ride-The-Lightning/RTL.git
synced 2026-08-13 12:33:07 +02:00
Applies the fixes from the open Dependabot PRs (#1648, #1649, #1650) in a single pass on the release branch, regenerating the lockfile from scratch. axios 1.16.0 -> 1.18.1 was the only production exposure (10 advisories). Transitive deps moved to their fixed in-range versions (fast-uri 3.1.4, form-data, qs, tough-cookie, tar, del, globby); dev toolchain took safe bumps (nodemon 3.1.14, eslint 9.39.5, @typescript-eslint 8.65.0). Drops the unused protractor devDependency: no e2e directory, no config and no e2e target in angular.json, but 100 packages and the deprecated request stack behind it. That clears both critical advisories. npm audit: 50 (2 critical) -> 29 (0 critical); production deps 1 -> 0. Remaining findings are dev-only tooling needing an Angular 21 migration rather than a version bump. Verified: lint, 204 frontend specs, backend + frontend production builds, and 19 API checks against the docker regtest fixture covering LND, Core Lightning and Eclair (getinfo, channels, peers, invoices, payments and forwarding history). |
||
|---|---|---|
| .. | ||
| Release-notes-0.15.9.md | ||
| Release-notes-0.15.10.md | ||