Note, this does not fix the vulnerability internally since [at]nx/angular is still dependent on v0.21.x. But for our consumers it should remove the vulnerability:

    "node_modules/@nx/module-federation": {
      "version": "22.5.4",
      "resolved": "https://registry.npmjs.org/@nx/module-federation/-/module-federation-22.5.4.tgz",
      "integrity": "sha512-.....",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@module-federation/enhanced": "^0.21.2",
        "@module-federation/node": "^2.7.21",
        "@module-federation/sdk": "^0.21.2",
        "@nx/devkit": "22.5.4",
        "@nx/js": "22.5.4",
        "@nx/web": "22.5.4",
        "@rspack/core": "1.6.8",
        "express": "^4.21.2",
        "http-proxy-middleware": "^3.0.5",
        "picocolors": "^1.1.0",
        "tslib": "^2.3.0",
        "webpack": "^5.101.3"
      }
    },

Hi @Aukevanoost ,

I noticed there is a change in the repository that seems to remove the dependency on koa, but I do not see a new release published on npm yet.

Could you confirm whether you are planning to publish a new npm release that includes this change? or do I need to override these dependencies?

So far, using the overrides entry in package.json, removes the koa dependency on our side

Hi @axell9641,

Indeed the mf plugin version 21.2.1 claimed to have removed the koa dependency but unfortunately it didn't. Therefore this PR aims to fix that by version bumping module federation to >v2. This PR is not merged yet so there is no release of it.