chore(deps-dev): bump websocket-driver from 0.7.4 to 0.7.5 in /angular8-ivy

[dependabot]

Bumps websocket-driver from 0.7.4 to 0.7.5.

Changelog

Sourced from websocket-driver's changelog.

0.7.5 / 2026-06-04

• Close a draft-75/76 connection if a length header grows to exceed the configured max length
• Fail the connection if a message is larger than the configured max length after extension processing

Commits

• 5d6a9aa Bump version to 0.7.5
• c55679a Fail the connection if a message is larger than the configured max length aft...
• 5b197ca Close a draft-75/76 connection if a length header grows to exceed the configu...
• fc93a48 Test on Node v22, v24, and v26
• 2e82d34 Test on recent versions of Node
• e4962db Switch from Travis CI to GitHub Actions
• 3f2f9b7 Travis update: cache npm modules, remove sudo, run on Node 15
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[semgrep-code-auth0-samples]

Semgrep found 2 ssc-9e16049c-d627-4ef3-9759-3139101c4fa9 findings:

• angular8-ivy/package-lock.json
  • L2372 - Triage
  • L4046 - Triage

Risk: Affected versions of @babel/helpers, @babel/runtime, @babel/runtime-corejs2, and @babel/runtime-corejs3 are vulnerable to Inefficient Regular Expression Complexity. Babel generates a polyfill (the wrapRegExp helper) for String.prototype.replace on regular expressions with named capturing groups that has quadratic (ReDoS) complexity when an untrusted replacement string containing the substring $< is processed. The vulnerable code is generated polyfill code rather than a symbol you call directly, so any project transpiling named capturing groups against affected browser targets is at risk. Upgrade to a patched version and recompile your code to remediate.

Fix: Upgrade this library to at least version 7.26.10 at angular2-jwt-samples/angular8-ivy/package-lock.json:4046.

Reference(s): GHSA-968p-4wvh-cqc8, CVE-2025-27789

Semgrep found 1 ssc-90df8fd1-2d4f-4e7b-a8aa-dfa15f51f5bf finding:

• angular8-ivy/package-lock.json
  • L363 - Triage

Risk: Affected versions of esbuild are vulnerable to Origin Validation Error. esbuild's development server responds to every request, including Server-Sent Events connections, with Access-Control-Allow-Origin: *. Any website a developer visits can therefore make cross-origin requests to the local dev server and read the responses, leaking bundled source code, source maps, and served file paths. Starting the dev server via serve() reaches the vulnerable code path.

Manual Review Advice: A vulnerability from this advisory is reachable if you run esbuild with the --serve flag to start the development server

Fix: Upgrade this library to at least version 0.25.0 at angular2-jwt-samples/angular8-ivy/package-lock.json:363.

Reference(s): GHSA-67mh-4wv8-2f99

Semgrep found 1 ssc-ace67ff4-0843-40f4-a8d3-13e050943589 finding:

• angular8-ivy/package-lock.json
  • L11398 - Triage

Risk: Affected versions of js-yaml are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). js-yaml is vulnerable to prototype pollution through its YAML merge key (<<) handling. When parsing untrusted YAML with load, loadAll, safeLoad, or safeLoadAll, a crafted document containing a __proto__ key inside a merged mapping can modify the prototype of the resulting object, leading to integrity violations in the application.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using js-yaml on the CLI

Fix: Upgrade this library to at least version 3.14.2 at angular2-jwt-samples/angular8-ivy/package-lock.json:11398.

Reference(s): GHSA-mh29-5h37-fv8m, CVE-2025-64718

Semgrep found 1 ssc-484bb776-a960-4899-8ddd-675885fe6a95 finding:

• angular8-ivy/package-lock.json
  • L18510 - Triage

Risk: Affected versions of webpack-dev-server are vulnerable to Exposed Dangerous Method or Function. webpack-dev-server serves bundled assets without rejecting cross-origin classic script requests. Because such <script src> requests bypass the same-origin policy, a malicious website visited by a developer running the dev server can load the application bundle cross-origin and, via prototype pollution of the webpack runtime, extract the application source code.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using webpack dev server CLI setup

Fix: Upgrade this library to at least version 5.2.1 at angular2-jwt-samples/angular8-ivy/package-lock.json:18510.

Reference(s): GHSA-4v9v-hfq4-rm2v, CVE-2025-30359

Semgrep found 1 ssc-013ecbde-4597-4af3-bcc3-06920828d5cc finding:

• angular8-ivy/package-lock.json
  • L18510 - Triage

Risk: Affected versions of webpack-dev-server are vulnerable to Origin Validation Error. webpack-dev-server improperly validates the WebSocket connection Origin header, unconditionally accepting any IP-address-based Origin. A malicious website can perform a cross-site WebSocket hijack against a running dev server and exfiltrate the developer source code carried in Hot Module Reloading (HMR) messages. The insecure origin check is the package default and is reached on every WebSocket connection, so any project running an affected version is vulnerable.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using webpack dev server CLI setup and access untrusted web site with non-Chromium based browser

Fix: Upgrade this library to at least version 5.2.1 at angular2-jwt-samples/angular8-ivy/package-lock.json:18510.

Reference(s): GHSA-9jgg-88mc-972h, CVE-2025-30360

Semgrep found 1 ssc-f748ff04-95cd-4e1a-8429-2525a723a048 finding:

• angular8-ivy/package-lock.json
  • L18419 - Triage

Risk: Affected versions of webpack are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). webpack's AutoPublicPathRuntimeModule emits runtime code that derives the asset public path from document.currentScript. Because document.currentScript can be DOM-clobbered by an injected scriptless element (e.g. ), an attacker who can inject markup into the page can redirect dynamic chunk/asset loading to an attacker-controlled origin, resulting in cross-site scripting (XSS).

Manual Review Advice: A vulnerability from this advisory is reachable if you build with output.publicPath unset

Fix: Upgrade this library to at least version 5.94.0 at angular2-jwt-samples/angular8-ivy/package-lock.json:18419.

Reference(s): GHSA-4vvj-4cpr-p986, CVE-2024-43788

Semgrep found 1 ssc-mal-11e0168e322a88b7a928c64b1f3ac77c0cab9fd6 finding:

• angular8-ivy/package-lock.json
  • L16142 - Triage

Risk: samples-bootstrap-theme contains malicious code. Remove it immediately.

Fix: There are no safe versions of this library available for upgrade. Library included at angular2-jwt-samples/angular8-ivy/package-lock.json:16142.

Reference(s): https://osv.dev/vulnerability/MAL-2022-5922

Semgrep found 1 ssc-1a0f4ed6-c2fe-47ec-b275-9bdc1073cf2e finding:

• angular8-ivy/package-lock.json
  • L3587 - Triage

Risk: Affected versions of @babel/plugin-transform-modules-systemjs are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') / Improper Control of Generation of Code ('Code Injection'). @babel/plugin-transform-modules-systemjs mishandles module string specifiers when compiling code into SystemJS module form. An attacker who can supply specially crafted source code to a Babel build that uses this plugin (directly, or transitively via @babel/preset-env configured with modules: "systemjs") can cause Babel to emit output that executes arbitrary JavaScript when the compiled bundle is loaded.

Manual Review Advice: A vulnerability from this advisory is reachable if you install @babel/plugin-transform-modules-systemjs plugin through cli, or use @babel/preset-env preset with modules set to "systemjs"

Fix: Upgrade this library to at least version 7.29.4 at angular2-jwt-samples/angular8-ivy/package-lock.json:3587.

Reference(s): GHSA-fv7c-fp4j-7gwp, CVE-2026-44728

Semgrep found 1 ssc-2427bad3-7619-448f-8f95-70806990606e finding:

• angular8-ivy/package-lock.json
  • L1044 - Triage

Risk: Affected versions of @angular/compiler are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). A stored XSS vulnerability in the Angular Template Compiler arises because its internal security schema doesn't classify certain URL‐ holding attributes (e.g. xlink:href, math|href, annotation|href) or the attributeName binding on SVG animation elements (<animate>, <set>, etc.) as requiring strict URL sanitization. An attacker who can supply untrusted input to template bindings like [attr.xlink:href] or <animate [attributeName]="'href'" [values]="maliciousURL"> can inject a javascript: URL payload. When the element is activated (e.g. clicked) or the animation runs, the malicious script executes in the application's origin, enabling session hijacking, data exfiltration, or unauthorized actions.

Manual Review Advice: A vulnerability from this advisory is reachable if you allow SVG/MathML attributes (e.g., xlink:href, href) or to the attributeName field of SVG animation tags (, , etc.) in HTML templates

Fix: Upgrade this library to at least version 19.2.17 at angular2-jwt-samples/angular8-ivy/package-lock.json:1044.

Reference(s): GHSA-v4hv-rgfq-gp49, CVE-2025-66412

Semgrep found 6 ssc-17eda294-146f-4ed3-91f7-5ef1b349d687 findings:

• angular8-ivy/package-lock.json
  • L1731 - Triage
  • L3790 - Triage
  • L3926 - Triage
  • L6208 - Triage
  • L6231 - Triage
  • L6244 - Triage

Risk: Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation.

Manual Review Advice: A vulnerability from this advisory is reachable if you use Babel to compile untrusted JavaScript

Fix: There are no safe versions of this library available for upgrade. Library included at angular2-jwt-samples/angular8-ivy/package-lock.json:6244.

Reference(s): GHSA-67hx-6x53-jw92, CVE-2023-45133