{"id":"6ade567a68b16dcfee2308f3","title":"2026 10 25 Issue 434","path":"how-to/committee/release-notes/2026-10-25-issue-434","contentMarkdown":"# 25-Oct-2026 — apply the vulnerability sweep on client and server [#434](https://github.com/nbarrett/ngx-ramblers/issues/434)\n\n## [build 1019](https://github.com/nbarrett/ngx-ramblers/actions/runs/40224568418) — [commit 5f6df4b](https://github.com/nbarrett/ngx-ramblers/commit/5f6df4b46bcb8ccd58ca226afa27c2dcc1c5e530)\n\n_____\n\n## What's new\n\n- Client and server packages are updated together so both sides stay on the same patched versions of shared libraries such as CSV parsing, dates and Mongo.\n- Angular stays on the 21.2 line, with the CLI and build tools on the latest 21.2 patch that clears the current high-severity advisories.\n- Mail sending, ZIP handling and image conversion on the server move to patched releases. Word document image conversion still works with the stricter image library.\n- Dependabot PRs are not used for this pass. Fixes are applied in the lockfiles here. Remaining KaTeX warnings in markdown diagrams need a later Angular 22 upgrade.","contentHtml":"<h1>25-Oct-2026 — apply the vulnerability sweep on client and server <a href=\"https://github.com/nbarrett/ngx-ramblers/issues/434\">#434</a></h1>\n<h2><a href=\"https://github.com/nbarrett/ngx-ramblers/actions/runs/40224568418\">build 1019</a> — <a href=\"https://github.com/nbarrett/ngx-ramblers/commit/5f6df4b46bcb8ccd58ca226afa27c2dcc1c5e530\">commit 5f6df4b</a></h2>\n<hr>\n<h2>What&#39;s new</h2>\n<ul>\n<li>Client and server packages are updated together so both sides stay on the same patched versions of shared libraries such as CSV parsing, dates and Mongo.</li>\n<li>Angular stays on the 21.2 line, with the CLI and build tools on the latest 21.2 patch that clears the current high-severity advisories.</li>\n<li>Mail sending, ZIP handling and image conversion on the server move to patched releases. Word document image conversion still works with the stricter image library.</li>\n<li>Dependabot PRs are not used for this pass. Fixes are applied in the lockfiles here. Remaining KaTeX warnings in markdown diagrams need a later Angular 22 upgrade.</li>\n</ul>\n"}