[ajivanyandev]

Fixed

• zod GHSA-mrhx-c7xc-m3w5 (high):
  • @angular/forms path: lockfile update 4.6.1 → 4.6.7.
  • devextreme 26.1.4 pins zod 3.24.4 and there is no patched 3.x. Bumped devextreme and devextreme-angular to ^26.1.6, which depends on zod 4.6.7.
• fast-uri GHSA-w74x-v6f9-j3xg, GHSA-xhq7-xmqj-769h, GHSA-wjr9-j795-jxcr, GHSA-333x-w4r6-6crp: lockfile update 3.1.8 → 3.1.9.

Also updated (to keep the DevExtreme packages in sync)

• devextreme-themebuilder 26.1.4 → 26.1.6, with src/themes/generated/* regenerated.
• devextreme-cli 1.17.0 → 1.18.0.
• devextreme-schematics ^1.17.0 → ^1.18.0.

[Copilot]

🟢 Approval recommended

The targeted vulnerable versions are removed, and no blocking issues were identified in the lockfile changes.

Copilot wasn't able to review any files in this pull request.

1 file not reviewed

• pnpm-lock.yaml: Generated file

[Copilot]

🟢 Approval recommended

Dependency declarations and lockfile updates are consistent, and the reviewed theme changes have no identified blocking defects.

No open issues 🎉

1 file not reviewed

• pnpm-lock.yaml: Generated file

_{Review effort: Balanced}

[vorobey]

check pls if we need to remove anything from overrides after devextreme version up