Skip to content

build: update dependency ejs to v6#3704

Open
angular-robot wants to merge 1 commit into
angular:mainfrom
angular-robot:ng-renovate/ejs-6-x
Open

build: update dependency ejs to v6#3704
angular-robot wants to merge 1 commit into
angular:mainfrom
angular-robot:ng-renovate/ejs-6-x

Conversation

@angular-robot
Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
ejs 5.0.26.0.1 age adoption passing confidence

  • If you want to rebase/retry this PR, check this box

Release Notes

mde/ejs (ejs)

v6.0.1

Compare Source

Version 6.0.1

See associated pull request for more information.
@angular-robot angular-robot added action: merge The PR is ready for merge by the caretaker area: build & ci Related the build and CI infrastructure of the project target: automation This PR is targeted to only merge into the branch defined in Github [bot use only] labels May 27, 2026
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the ejs dependency from version 5.0.2 to 6.0.1 in package.json and the lockfile. However, a critical security review points out that the official ejs package has only been released up to version 3.1.x. Using versions 5.x or 6.x is highly likely to be a supply chain attack or typosquatting attempt. It is strongly recommended to revert this change and downgrade to a stable, official version such as 3.1.10.

Comment thread ng-dev/package.json
"conventional-commits-filter": "5.0.0",
"conventional-commits-parser": "6.4.0",
"ejs": "5.0.2",
"ejs": "6.0.1",
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-critical critical

Critical Security Warning: The official ejs package (https://github.com/mde/ejs) has only been released up to version 3.1.x. There are no official 5.x or 6.x versions of ejs on the public npm registry. Using ejs version 6.0.1 (or the previous 5.0.2) is highly likely to be a supply chain attack, dependency confusion, or typosquatting attempt. Please revert this change immediately and verify the authenticity of the package source. It is recommended to downgrade to the latest stable and official version of ejs (e.g., 3.1.10).

Suggested change
"ejs": "6.0.1",
"ejs": "3.1.10",

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

action: merge The PR is ready for merge by the caretaker area: build & ci Related the build and CI infrastructure of the project target: automation This PR is targeted to only merge into the branch defined in Github [bot use only]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant