@angular/core and @angular/compiler explicitly listed as dependencies in published package.json about codelyzer HOT 5 OPEN

This also leads to npm audit vulnerabilities that can't be resolved:

# npm audit report

@angular/core  <11.0.5
Severity: moderate
Cross site scripting in Angular - https://github.com/advisories/GHSA-c75v-2vq8-878f
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/codelyzer/node_modules/@angular/core
  codelyzer  >=1.0.0-beta.0
  Depends on vulnerable versions of @angular/core
  node_modules/codelyzer

2 moderate severity vulnerabilities

Running npm audit fix --force will result in codelyzer being downgraded to 0.0.28 which wouldn't be what we want, removing codelyzer from our solution for now.

from codelyzer.

Was upgrading our Angular app and had to upgrade Codelyzer for the support of v11. However, this will result in two different versions of @angular/compiler and @angular/core in my yarn.lock file: one version 11 (Angular itself) and one version 9 (Codelyzer).

This does not seem the desired behavior, so it means our upgrade is blocked because of this.

from codelyzer.

Bump. Any actions taken around this for the 2+ years the issue has been open?

With Codelyzer currently on 6.0.2, npm resolves it's dependency on vulnerability @angular/core <11.0.5
by downgrading to ^0.0.28.

I would be flattered by a response from the dev team, uninstalling such a fantastic package would be a shame.

54 Open PRs, some date back to 2019?
Apparently this has been abandoned 2 years ago min.

from codelyzer.

This error caused me to have to remove Codelyzer from our app. There is a work-around, but we have too many people installing to have to explain work-around to each.

Work-around is to:

1. installl angular core 9
2. install angular compiler 9 (this will have updated package.json)
3. run npm install (or whatever you use) for the rest
4. revert package.json
5. run npm install again (now with correct versions of angular)

Hope this is fixed soon.

from codelyzer.

Having these dependencies results in not being able to build our project that is within a monorepo, as Angular 9.0.0 is what gets installed in the root node_modules directory, as opposed to version ^14.0.0 that our project desires. Is there a chance these are going to be removed?

from codelyzer.