Bump xmldom and @angular/cli in /PerformanceTests/Speedometer2.1/resources/todomvc/architecture-examples/angular

[dependabot]

Removes xmldom. It's no longer used after updating ancestor dependency @angular/cli. These dependencies need to be updated together.

Removes xmldom

Updates @angular/cli from 1.0.0 to 1.7.4

Changelog

Sourced from @​angular/cli's changelog.

22.0.0-next.6 (2026-04-22)

@​angular/cli

Commit	Type	Description
cc30034da	fix	dynamically resolve project Angular CLI executable inside MCP tools
ead60d3d5	fix	ignore EBADF file system errors during MCP project scan
0d984cf1c	fix	use headless option in MCP test tool

@​schematics/angular

Commit	Type	Description
de630c2fc	feat	stabilize refactor-jasmine-vitest schematic

@​angular-devkit/build-angular

Commit	Type	Description
30d8332ed	fix	ensure route has leading slash in prerender builder
cf5b49ed7	fix	fix app-shell route format and

@​angular/build

Commit	Type	Description
0781f7498	feat	add quiet option to suppress build noise in unit tests
cd2ad3c19	feat	enable chunk optimization by default with heuristics
b85ec6798	fix	allow configuring Access-Control-Allow-Origin via headers option
59803b12b	fix	use rootDir for HMR component updates path resolution
74e7dbe56	fix	validate V8 coverage support for browsers in Vitest

20.3.24 (2026-04-15)

@​angular/build

Commit	Type	Description
10c09c77b	fix	update esbuild to 0.28.0

... (truncated)

Commits

• 0b291ab release: 1.7.4
• 6afa952 fix(@​angular/cli): Pass logger to allow schematics to log messages
• 40dfce9 release: 1.7.3
• f5e5d57 fix(@​ngtools/webpack): prevent relative request path mapping
• ffcc386 fix(@​ngtools/webpack): ensure webpack errors are actually an Error
• d5d1d9b fix(@​angular/cli): update clean-css to handle parsing edge cases
• 6a55af3 fix(@​angular/cli): workaround ES2015 minifier inlining defect
• fefd6c9 ci: don't install chrome on appveyor
• ae601a0 release: 1.7.2
• f1304b3 fix(@​angular/cli): prevent greedy CSS url function capture
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[semgrep-code-squarespace]

Semgrep found 1 ssc-81a24017-d446-4018-a477-3c5a65306f7e finding:

• PerformanceTests/Speedometer2.1/resources/todomvc/architecture-examples/angular/package-lock.json
  • L7658 - Triage

Risk: karma 6.x before 6.3.14 is vulnerable to improper neutralization of input during web page generation ('cross-site scripting'). Karma does not enforce the HTTP protocol on the return_url query parameter which leads to reflected cross-site scripting when providing a URL like https://$KARMA_ROOT/?return_url=javascript:alert(document.domain). Upgrade to karma 6.3.14.

Fix: Upgrade this library to at least version 6.3.14 at WebKit/PerformanceTests/Speedometer2.1/resources/todomvc/architecture-examples/angular/package-lock.json:7658.

Reference(s): GHSA-7x7c-qm48-pq9c, CVE-2022-0437

Semgrep found 1 ssc-7655e34f-47d3-43f6-b687-32e02f3c8005 finding:

• PerformanceTests/Speedometer2.1/resources/todomvc/architecture-examples/angular/package-lock.json
  • L7386 - Triage

Risk: Affected versions of handlebars are vulnerable to Improper Control of Generation of Code ('Code Injection') / Improper Encoding or Escaping of Output / Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The Handlebars CLI precompiler allows arbitrary JavaScript injection by embedding unescaped template filenames and CLI option values such as --namespace, --commonjs, and --handlebarPath directly into generated output. An attacker who can control these inputs can cause malicious code to execute when the precompiled bundle is loaded in Node.js or a browser.

Manual Review Advice: A vulnerability from this advisory is reachable if you execute templates through the Handlebars CLI precompiler

Fix: Upgrade this library to at least version 4.7.9 at WebKit/PerformanceTests/Speedometer2.1/resources/todomvc/architecture-examples/angular/package-lock.json:7386.

Reference(s): GHSA-xjpj-3mr7-gcpf, CVE-2026-33941

Semgrep found 1 ssc-2427bad3-7619-448f-8f95-70806990606e finding:

• PerformanceTests/Speedometer2.1/resources/todomvc/architecture-examples/angular/package-lock.json
  • L318 - Triage

Risk: Affected versions of @angular/compiler are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). A stored XSS vulnerability in the Angular Template Compiler arises because its internal security schema doesn't classify certain URL‐ holding attributes (e.g. xlink:href, math|href, annotation|href) or the attributeName binding on SVG animation elements (<animate>, <set>, etc.) as requiring strict URL sanitization. An attacker who can supply untrusted input to template bindings like [attr.xlink:href] or <animate [attributeName]="'href'" [values]="maliciousURL"> can inject a javascript: URL payload. When the element is activated (e.g. clicked) or the animation runs, the malicious script executes in the application's origin, enabling session hijacking, data exfiltration, or unauthorized actions.

Manual Review Advice: A vulnerability from this advisory is reachable if you allow SVG/MathML attributes (e.g., xlink:href, href) or to the attributeName field of SVG animation tags (, , etc.) in HTML templates

Fix: Upgrade this library to at least version 19.2.17 at WebKit/PerformanceTests/Speedometer2.1/resources/todomvc/architecture-examples/angular/package-lock.json:318.

Reference(s): GHSA-v4hv-rgfq-gp49, CVE-2025-66412

Semgrep found 1 ssc-c5a69759-0cfc-41b4-aa6c-ae584bd301a6 finding:

• PerformanceTests/Speedometer2.1/resources/todomvc/architecture-examples/angular/package-lock.json
  • L14346 - Triage

Risk: Affected versions of webpack-dev-server are vulnerable to Improper Input Validation. Missing origin validation on webpack-dev-server's Hot Module Replacement websocket allows any webpage to connect to the dev server's socket, access in‐memory compiled assets and source code, and exfiltrate a developer's source files.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using webpack-dev-server with Hot Module Replacement enabled (i.e. using the --hot argument)

Fix: Upgrade this library to at least version 3.1.11 at WebKit/PerformanceTests/Speedometer2.1/resources/todomvc/architecture-examples/angular/package-lock.json:14346.

Reference(s): GHSA-cf66-xwfp-gvc4, CVE-2018-14732

Semgrep found 1 ssc-17eda294-146f-4ed3-91f7-5ef1b349d687 finding:

• PerformanceTests/Speedometer2.1/resources/todomvc/architecture-examples/angular/package-lock.json
  • L1216 - Triage

Risk: Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation.

Manual Review Advice: A vulnerability from this advisory is reachable if you use Babel to compile untrusted JavaScript

Fix: There are no safe versions of this library available for upgrade. Library included at WebKit/PerformanceTests/Speedometer2.1/resources/todomvc/architecture-examples/angular/package-lock.json:1216.

Reference(s): GHSA-67hx-6x53-jw92, CVE-2023-45133

Semgrep found 1 ssc-1606921e-eb4c-4a25-bcec-3cbfbc985ee1 finding:

• PerformanceTests/Speedometer2.1/resources/todomvc/architecture-examples/angular/package-lock.json
  • L3239 - Triage

Risk: Affected version of deep-extend is vulnerable to Prototype Pollution. Malicious input passed to deep-extend allows an attacker to overwrite the prototype of Object, polluting all JavaScript objects with arbitrary properties. This can lead to Denial of Service or even Remote Code Execution.

Fix: Upgrade this library to at least version 0.5.1 at WebKit/PerformanceTests/Speedometer2.1/resources/todomvc/architecture-examples/angular/package-lock.json:3239.

Reference(s): GHSA-hr2v-3952-633q, CVE-2018-3750