`General`: Bump client and server dependencies to latest stable versions by az108 · Pull Request #2573 · ls1intum/doc-apply

az108 · 2026-05-23T15:12:31Z

Checklist

General

I tested all changes and their related features with all corresponding user types.
I chose a title conforming to the naming conventions for pull requests.

Motivation and Context

Renovate has not been opening PRs for the past weeks, so dependencies have drifted behind upstream. This bumps the npm packages on the client and the Gradle dependencies on the server to the latest stable releases that are compatible with the current Angular 21 / Spring Boot 4 stack.

Description

Client (`package.json`)

Angular 21.2.5 → 21.2.14 (all packages, including @angular/cdk, @angular/build, @angular/cli)
@angular-eslint/*, angular-eslint 21.3.0 → 21.4.0
primeng 21.1.3 → 21.1.8, @primeuix/utils 0.7.1 → 0.7.2
ngx-quill 30.0.1 → 30.1.3, quill 2.0.2 → 2.0.3
keycloak-js 26.2.2 → 26.2.4, intl-messageformat 11.2.4 → 11.2.7
vitest / @vitest/coverage-istanbul 4.1.0 → 4.1.7
tailwindcss / @tailwindcss/postcss 4.2.1 → 4.3.0
prettier 3.8.1 → 3.8.3
postcss, autoprefixer, rollup, jsdom, globals, folder-hash, swagger-ui-dist, @types/node (within v24): minor/patch bumps
packageManager pnpm 11.1.1 → 11.2.2 (also reflected in gradle.properties)

The following were intentionally left at their current versions because they break the build:

typescript stays at 5.9.3 — Angular 21 (@angular/build) only supports >=5.9 <6.0.
eslint / @eslint/js stay on 9.x — eslint-plugin-import does not yet declare support for ESLint 10.
@types/node stays in v24 to match the engines.node requirement.
vite stays at 8.0.0 and esbuild at 0.27.7 — vite 8.0.14 hits a regression in the bundled oxc parser when transforming async function ...(): Promise<void> signatures inside the Vitest pipeline.
@analogjs/vite-plugin-angular / @analogjs/vitest-angular stay at 2.3.1 — 2.5.x triggers the same oxc parser failure.
@typescript-eslint/* / typescript-eslint stay at 8.57.0 — 8.59 tightens no-unnecessary-type-assertion enough that --fix strips assertions Angular's compiler still needs.
prettier-plugin-java stays at 2.8.1 — 2.9.x reformats 44 unrelated Java files, which would balloon this PR.

These are each worth a follow-up PR once upstream catches up.

Server (`gradle.properties`)

springBoot 4.0.4 → 4.0.6 (pulls Spring Security 7.0.4 → 7.0.5, Hibernate, Tomcat, etc.)
jacksonBom 3.1.0 → 3.1.3
lombok 1.18.44 → 1.18.46
archunitJunit5 1.4.1 → 1.4.2
junit 6.0.3 → 6.1.0
jacksonDatabindNullable 0.2.9 → 0.2.10
mysql 9.6.0 → 9.7.0
caffeine 3.2.3 → 3.2.4
springdoc 3.0.2 → 3.0.3
jaxbRuntime 4.0.7 → 4.0.8
jsoup 1.22.1 → 1.22.2
itext 6.3.1 → 6.3.2
poi 5.4.1 → 5.5.1
keycloak 26.0.8 → 26.0.9
liquibase 5.0.2 → 5.0.3, Liquibase Gradle plugin 3.0.2 → 3.1.0
mockito 5.22.0 → 5.23.0
Spotless plugin 8.0.0 → 8.5.1
Modernizer plugin 1.12.0 → 1.13.0
dependencyUpdates plugin 0.53.0 → 0.54.0

Skipped:

springAi stays on 2.0.0-M4 — newer M7 is still a milestone, not stable.
gitProperties plugin stays at 2.5.3 — 3.0.x is a major bump that warrants its own PR.
openapi-generator stays at 7.20.0 — the local openapi-generator-angular21 subproject is tightly coupled to this version and a bump should be evaluated separately.
Gradle wrapper 9.4.0 stays — 9.5.x is a release candidate.

All exact versions are pinned (no ^), in line with the project's convention.

Steps for Testing

Prerequisites:

Pull the branch and run pnpm install followed by ./gradlew clean build to make sure both ecosystems resolve cleanly.

Local verification done before pushing:

pnpm lint — 0 errors, 169 pre-existing warnings (unchanged)
pnpm test — full Vitest suite passes with coverage above the configured thresholds
pnpm webapp:build — production Angular build succeeds
pnpm prettier:check — clean
./gradlew compileJava compileTestJava — clean

Review Progress

Code Review

Code Review 1

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

codacy-production · 2026-05-23T15:13:20Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric Results

Complexity 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

… vulnerabilities The root `overrides` block in package.json has been silently ignored since pnpm 10 (the field must live in pnpm-workspace.yaml). Moving it restores every pinned override (cookie, express, esbuild, lodash, undici, webpack, ws, ...) and lets us patch the remaining advisories: - vite pinned to 8.0.5 (fixes 3 advisories: server.fs.deny bypass, dev-server WebSocket file read, optimized-deps path traversal) - postcss pinned to 8.5.15 (fixes XSS in CSS stringify) - qs override bumped from 6.15.0 to 6.15.2 (fixes DoS) - quill reverted from 2.0.3 to 2.0.2 (2.0.3 is the only affected version of the XSS-via-HTML-export advisory; no patched release yet) - @oxc-project/runtime added as a devDep so vite 8.0.5+ can resolve the helpers it injects into transformed sources Brings `pnpm audit` from 12 vulnerabilities (4 high, 7 moderate, 1 low) down to 4 (2 high, 2 moderate), all of them transitive lodash advisories from `prettier-plugin-java > java-parser`. Lodash has no patched release (>=4.17.24) on npm yet, so the override is already pinned at the highest available version (4.17.23) and the remaining advisories are unfixable upstream; the affected code path is a dev-only Java formatter, never shipped to production. Also drops the stale `pnpm.onlyBuiltDependencies` block from package.json (also ignored since pnpm 10; the equivalent `allowBuilds` config already lives in pnpm-workspace.yaml). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CI builds started failing with a 403 from Maven Central when resolving liquibase-core 5.0.3. The artifact is published, but the runner's Maven Central edge could not fetch it. Reverting unblocks CI; Renovate will pick the bump back up once Central is healthy in the runner's region. The liquibase Gradle plugin stays on 3.1.0 — it works against 5.0.2. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… scan The Lighthouse Applicant scan started failing with `TypeError: Failed to fetch` on the browser-side call to `/api/auth/login` inside lighthouse-auth.js (the Professor scan, which uses the Keycloak login form rather than the server login endpoint, still passes). No `/api/auth/login` entry appears in the server log, so the fetch is being aborted before the request leaves the browser — consistent with the page navigating away mid-flight. The most likely triggers from this PR are vite 8.0.5 (which switched the default transformer to Oxc and changed dev-server behaviour) and the keycloak-js 26.2.2 → 26.2.4 bump (which could alter SSO redirect timing). Reverting both is the smallest change that gets Lighthouse green again. Net effect on `pnpm audit`: re-adds the three dev-only vite advisories (server.fs.deny bypass, WebSocket file read, optimized-deps path traversal). All are dev-server only and not exposed in CI/prod, so the security exposure is negligible. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-05-31T12:27:30Z