[Snyk] Fix for 4 vulnerabilities

[snyk-io]

Snyk has created this PR to fix 4 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

• examples/angular/rxjs/package.json

⚠️ Warning

Failed to update the pnpm-lock.yaml, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Use of Weak Hash SNYK-JS-ANGULARCOMMON-17356555
	Modification of Assumed-Immutable Data SNYK-JS-ANGULARCORE-17353317
	Denial of Service (DoS) SNYK-JS-PACOTE-8225084
	Directory Traversal SNYK-JS-VITE-17353904

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Use of Weak Hash
🦉 Denial of Service (DoS)
🦉 Directory Traversal

[snyk-io]

This is a set of patch version upgrades for Angular packages. According to Angular's semantic versioning policy, patch releases are for bug fixes and do not contain breaking changes.

• @angular/build, @angular/cli, @angular/common, @angular/core: The updates from 20.3.x to a later 20.3.y version consist of minor bug fixes and security patches. The official changelog indicates that recent patches in this version range primarily contain fixes and deprecations, without any API removals or modifications that would require developer action.

No breaking changes are expected for this upgrade.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-open-in-v0-0w	Error		Jun 27, 2026 9:09pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
query-auto-refetching	Skipped		Jun 27, 2026 9:09pm

[changeset-bot]

⚠️ No Changeset found

Latest commit: b39d794

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

• examples/angular/rxjs/package.json

---

_{Reviewed by step-3.7-flash-20260528 · Input: 117.9K · Output: 7.5K · Cached: 101.2K}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

While this PR successfully targets four security vulnerabilities and meets automated quality standards, it introduces a critical instability in the Angular framework configuration. The partial update of only @angular/core and @angular/common to a newer minor version, while leaving other core dependencies like the compiler and forms at version 20.0.0, will lead to AOT compilation failures and runtime dependency injection errors. Additionally, the build environment is currently inconsistent because the manifest changes are not reflected in the lockfile. These architectural and build-system issues should be resolved before merging to avoid breaking the project.

About this PR

• The pnpm-lock.yaml file failed to update during this PR creation. This results in a mismatch between the package.json requirements and the actual resolved dependencies, which will likely cause CI/CD failures or non-deterministic builds.
• The PR introduces a version mismatch across the Angular ecosystem packages within this module. Maintaining inconsistent versions between core framework libraries is not supported and typically results in runtime errors.

Test suggestions

• Verify that the 'examples/angular/rxjs' project builds successfully with the specific combination of updated and non-updated @angular packages

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the 'examples/angular/rxjs' project builds successfully with the specific combination of updated and non-updated @angular packages

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

Updating only a subset of Angular core framework packages while leaving others at a different minor version creates a critical integration risk. Libraries such as core, common, compiler, forms, and platform-browser are designed to work together on the same version. This partial update will likely result in AOT compilation failures or runtime errors due to internal framework incompatibilities.