Merge pull request #15466 from vvlladd28/fix/secyrity/21-04-26

Fix multiple CVEs: 2026-39364, 2026-39363, 2026-4800

ui-ngx/package.json

@@ -13,20 +13,20 @@
   },
   "private": true,
   "dependencies": {
-    "@angular/animations": "20.3.18",
+    "@angular/animations": "20.3.19",
     "@angular/cdk": "20.2.14",
-    "@angular/common": "20.3.18",
-    "@angular/compiler": "20.3.18",
-    "@angular/core": "20.3.18",
-    "@angular/forms": "20.3.18",
+    "@angular/common": "20.3.19",
+    "@angular/compiler": "20.3.19",
+    "@angular/core": "20.3.19",
+    "@angular/forms": "20.3.19",
     "@angular/material": "20.2.14",
-    "@angular/platform-browser": "20.3.18",
-    "@angular/platform-browser-dynamic": "20.3.18",
-    "@angular/router": "20.3.18",
+    "@angular/platform-browser": "20.3.19",
+    "@angular/platform-browser-dynamic": "20.3.19",
+    "@angular/router": "20.3.19",
     "@auth0/angular-jwt": "^5.2.0",
     "@flowjs/flow.js": "^2.14.1",
     "@flowjs/ngx-flow": "20.0.2",
-    "@geoman-io/leaflet-geoman-free": "2.18.3",
+    "@geoman-io/leaflet-geoman-free": "2.19.3",
     "@iplab/ngx-color-picker": "^20.0.0",
     "@mat-datetimepicker/core": "~16.0.1",
     "@mdi/svg": "^7.4.47",
@@ -45,7 +45,7 @@
     "angular2-hotkeys": "^16.0.1",
     "canvas-gauges": "^2.1.7",
     "core-js": "^3.48.0",
-    "dayjs": "1.11.19",
+    "dayjs": "1.11.20",
     "echarts": "https://github.com/thingsboard/echarts/archive/5.5.2-TB.tar.gz",
     "flot": "https://github.com/thingsboard/flot.git#0.9-work",
     "flot.curvedlines": "https://github.com/MichaelZinsmaier/CurvedLines.git#master",
@@ -94,13 +94,13 @@
   },
   "devDependencies": {
     "@angular-builders/custom-esbuild": "20.0.0",
-    "@angular-devkit/build-angular": "20.3.22",
-    "@angular-devkit/core": "20.3.22",
-    "@angular-devkit/schematics": "20.3.22",
-    "@angular/build": "20.3.22",
-    "@angular/cli": "20.3.22",
-    "@angular/compiler-cli": "20.3.18",
-    "@angular/language-service": "20.3.18",
+    "@angular-devkit/build-angular": "20.3.24",
+    "@angular-devkit/core": "20.3.24",
+    "@angular-devkit/schematics": "20.3.24",
+    "@angular/build": "20.3.24",
+    "@angular/cli": "20.3.24",
+    "@angular/compiler-cli": "20.3.19",
+    "@angular/language-service": "20.3.19",
     "@types/ace-diff": "^2.1.4",
     "@types/canvas-gauges": "^2.1.8",
     "@types/flot": "^0.0.36",
@@ -139,7 +139,7 @@
     "ace-builds": "1.43.6",
     "tinymce": "6.8.6",
     "@babel/core": "7.28.3",
-    "esbuild": "0.25.9",
+    "esbuild": "0.28.0",
     "rollup": "4.59.0",
     "jquery.terminal/**/form-data": ">=4.0.4",
     "js-beautify/**/minimatch": "^9.0.7"

ui-ngx/patches/@angular+core+20.3.18.patch → ui-ngx/patches/@angular+core+20.3.19.patch

@@ -1,5 +1,5 @@
 diff --git a/node_modules/@angular/core/fesm2022/debug_node.mjs b/node_modules/@angular/core/fesm2022/debug_node.mjs
-index 35c61af..d89462b 100755
+index 4f7d936..4a98b2c 100755
 --- a/node_modules/@angular/core/fesm2022/debug_node.mjs
 +++ b/node_modules/@angular/core/fesm2022/debug_node.mjs
 @@ -9428,13 +9428,13 @@ function findDirectiveDefMatches(tView, tNode) {

ui-ngx/src/app/modules/home/components/widget/lib/maps-legacy/leaflet-map.ts

@@ -289,7 +289,7 @@ export default abstract class LeafletMap {
     }
 
     private toggleDrawMode(type: string) {
-      this.map.pm.Draw[type].toggle();
+      (this.map.pm.Draw[type] as any).toggle();
     }
 
     addEditControl() {
@@ -373,7 +373,7 @@ export default abstract class LeafletMap {
           },
           // @ts-ignore
           afterClick: (e, ctx) => {
-            this.map.pm.Draw[ctx.button._button.jsClass].toggle({
+            (this.map.pm.Draw[ctx.button._button.jsClass] as any).toggle({
               snappable: this.options.snappable,
               cursorMarker: true,
               allowSelfIntersection: false,