[Snyk] Upgrade @angular/forms from 12.0.4 to 12.2.17

[nejidevelops]

Snyk has created this PR to upgrade @angular/forms from 12.0.4 to 12.2.17.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 36 versions ahead of your current version.

• The recommended version was released 3 years ago.

Release notes

Package name: @angular/forms

• 12.2.17 - 2022-11-22
• 12.2.16 - 2022-01-27
• 12.2.15 - 2021-12-15
• 12.2.14 - 2021-12-01
• 12.2.13 - 2021-11-03
• 12.2.12 - 2021-10-27
• 12.2.11 - 2021-10-20
• 12.2.10 - 2021-10-13
• 12.2.9 - 2021-10-06
• 12.2.8 - 2021-09-30
• 12.2.7 - 2021-09-22
• 12.2.6 - 2021-09-15
• 12.2.5 - 2021-09-08
• 12.2.4 - 2021-09-01
• 12.2.3 - 2021-08-25
• 12.2.2 - 2021-08-18
• 12.2.1 - 2021-08-11
• 12.2.0 - 2021-08-04
• 12.2.0-rc.0 - 2021-07-28
• 12.2.0-next.3 - 2021-07-21
• 12.2.0-next.2 - 2021-07-14
• 12.2.0-next.1 - 2021-06-30
• 12.2.0-next.0 - 2021-06-24
• 12.1.5 - 2021-08-04
• 12.1.4 - 2021-07-28
• 12.1.3 - 2021-07-21
• 12.1.2 - 2021-07-14
• 12.1.1 - 2021-06-30
• 12.1.0 - 2021-06-24
• 12.1.0-next.6 - 2021-06-16
• 12.1.0-next.5 - 2021-06-09
• 12.1.0-next.4 - 2021-06-02
• 12.1.0-next.3 - 2021-05-26
• 12.1.0-next.2 - 2021-05-19
• 12.1.0-next.1 - 2021-05-05
• 12.0.5 - 2021-06-16
• 12.0.4 - 2021-06-09

from @angular/forms GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[gemini-code-assist]

Hello @nejidevelops, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

Summary of Changes

Hello team, Gemini here, providing a summary of this pull request. This PR was automatically generated by Snyk with the stated intent of upgrading the @angular/forms dependency from version 12.0.4 to 12.2.17. However, upon inspecting the patch, the actual change applied is modifying the version constraint for @angular/forms in angular-app/package.json from ^15.0.0 to ^12.2.17. This appears to be a change to a specific version within the 12.x range, rather than an upgrade from 12.0.4 to the latest 12.2.17, and notably changes it from a 15.x version constraint. Reviewers should verify if this version change is intended and compatible with other Angular 15 dependencies.

Highlights

• Dependency Version Change: The primary change in this PR is the modification of the @angular/forms dependency version in the angular-app/package.json file. The version constraint has been changed from ^15.0.0 to ^12.2.17.

Changelog

• angular-app/package.json
  • Updated the version of the @angular/forms dependency from ^15.0.0 to ^12.2.17.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

---

Dependencies shift,
From fifteen down to twelve point two,
Check the lock file now.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request, automatically generated by Snyk, proposes to change the version of @angular/forms from ^15.0.0 to ^12.2.17. This is a significant downgrade and is highly problematic because other core Angular packages in your project (like @angular/core, @angular/common, etc.) are at version ^15.0.0 (resolved to 15.2.10 in the package-lock.json).

Mixing major versions of Angular packages (v15 for core/common/etc. and v12 for forms) will almost certainly lead to build failures, runtime errors, and peer dependency conflicts. Angular packages are designed to be used together at the same major version level.

The Snyk PR description and title seem to be based on an incorrect assumption that the current version of @angular/forms is 12.0.4. The diff clearly shows it's ^15.0.0.

This change should not be merged as is. It's crucial to investigate why Snyk is proposing this downgrade and to ensure that any updates to @angular/forms are compatible with your existing Angular 15 setup. If there's a specific vulnerability Snyk is trying to address, the fix should involve upgrading to a patched version within the Angular 15 ecosystem or a compatible higher version, not downgrading to an older major version.

Summary of Findings

• Critical: Angular Package Version Mismatch (Downgrade): The PR changes @angular/forms from ^15.0.0 to ^12.2.17. This is a major version downgrade and is incompatible with other @angular/* packages which are at version ^15.0.0. This will likely break the application build and/or runtime due to peer dependency conflicts and API incompatibilities.
• Snyk Baseline Discrepancy: Snyk's PR description indicates it's upgrading from @angular/[email protected]. However, the codebase shows the version was ^15.0.0 before this change. This discrepancy needs to be understood to prevent incorrect automated PRs.

Merge Readiness

This pull request should not be merged in its current state. The proposed downgrade of @angular/forms to version 12.2.17 while other core Angular packages remain at version 15.x.x is a critical issue that will very likely break the application.

It is recommended to:

1. Revert the version change for @angular/forms in package.json.
2. Investigate why Snyk generated this PR with an incorrect baseline version. There might be a configuration issue with Snyk or an outdated state in its analysis.
3. If an update to @angular/forms is genuinely required for security or other reasons, ensure the target version is compatible with Angular 15.

I am unable to approve this pull request. Please ensure these critical issues are addressed and further reviewed before considering a merge.

[gemini-code-assist]

This change downgrades @angular/forms from ^15.0.0 to ^12.2.17. This is a critical issue because other Angular packages in this package.json (e.g., @angular/core, @angular/common) are specified as ^15.0.0.

Angular packages are tightly coupled and generally require all @angular/* packages to be on the same major version for compatibility. Downgrading @angular/forms to v12 while other core packages remain on v15 will likely cause:

• Build Failures: The Angular compiler (which is at v15) may not be ableto process v12 forms metadata correctly.
• Runtime Errors: API incompatibilities between v12 forms and v15 core/common modules are highly probable.
• Peer Dependency Conflicts: npm install or yarn install will likely report peer dependency warnings or errors because @angular/[email protected] expects @angular/[email protected], but your project has @angular/core@^15.0.0 (resolved to 15.2.10 in the lock file).

This change should be reverted. If an update to @angular/forms is needed (e.g., for a security patch, though the PR description indicates no vulnerabilities are being fixed by this specific change: vulns: []), it should be to a version compatible with Angular 15 (e.g., a later patch or minor version of @angular/forms@^15.x.x).

Could you please investigate why Snyk is proposing this downgrade? It seems to be based on an incorrect baseline version of 12.0.4 for @angular/forms as per the PR description, while the actual version in the codebase before this change was ^15.0.0.

    "@angular/forms": "^15.0.0",