chore: Update dependencies

[Aukevanoost]

No description provided.

[Aukevanoost]

@manfredsteyer Small question, the interfaces appear to be identical, just typescript is not accepting using them intertwined. What's your take on this? Or anyone else? Which one should be used?

[Achilles1515]

@manfredsteyer Considering these changes, can we expect a new release of the @angular-architects/module-federation and @angular-architects/module-federation-runtime packages that include updating the @module-federation dependencies (similar to what was done here in this PR)?

Which should also address #911 -- I am also getting pinged by our DevOps group about needing to address this koa vulnerability.

And the reason why this vulnerability isn't just "fixing itself" is because these @module-federation packages have a 0 major version, essentially making the caret here act like a tilde, and these packages have long since jumped to new minor versions.

[Aukevanoost]

Hi @Achilles1515

I can see what I can do with the vulnerabilities.

And the reason why this vulnerability isn't just "fixing itself" is because these @module-federation packages have a 0 major version, essentially making the caret here act like a tilde, and these packages have long since jumped to new minor versions.

Could you help me a bit here? I struggle a bit to understand the first sentence, but ^ marks an acceptable range of minor and patch right? so it doesnt matter if there are no major releases.

[Aukevanoost]

Hi @Achilles1515

It took some tweaking and forcing certain versions but this should fix the CVE's you were encountering. Would you kindly check this build and see if it works fine for yous?

[Achilles1515]

@Aukevanoost

Could you help me a bit here? I struggle a bit to understand the first sentence, but ^ marks an acceptable range of minor and patch right? so it doesnt matter if there are no major releases.

That is the normal behavior of the caret, but the rules change when the major version is 0 (which is basically signifying the package is still in development). See here.

^0.2.3 := >=0.2.3 <0.3.0

So this package definition here:

"@module-federation/enhanced": "^0.9.0",

is only installing v0.9.1, even though 0.21.2 is available.

So those @module-federation/* entries in that mf-runtime/package.json file need to be updated, along with a new package version release for @angular-architects/module-federation-runtime and @angular-architects/module-federation.