Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Angular 19 depends on vulnerable version of Vite #29996

Closed
1 task
prajapatijay95 opened this issue Apr 2, 2025 · 0 comments · Fixed by #30003, #30002 or #30001
Closed
1 task

Angular 19 depends on vulnerable version of Vite #29996

prajapatijay95 opened this issue Apr 2, 2025 · 0 comments · Fixed by #30003, #30002 or #30001
Labels
area: @angular/build freq1: low Only reported by a handful of users who observe it rarely severity6: security type: bug/fix

Comments

@prajapatijay95
Copy link

Command

other

Is this a regression?

  • Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

The Angular CLI v19 depends on Vite version 6.2.3, which is vulnerable: GHSA-4r4m-qw57-chr8

It should be updated to v6.2.4

Minimal Reproduction

Generate a new error with ng new and run npm audit

Exception or Error


Your Environment

Angular CLI: 19.2.4
Node: 22.14.0
Package Manager: npm 11.2.0
OS: darwin arm64

Angular: 19.2.3
... animations, common, compiler, compiler-cli, core, forms
... platform-browser, platform-browser-dynamic, router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1902.4
@angular-devkit/build-angular   19.2.4
@angular-devkit/core            19.2.4
@angular-devkit/schematics      19.2.4
@angular/cdk                    19.2.6
@angular/cli                    19.2.4
@angular/material               19.2.6
@schematics/angular             19.2.4
rxjs                            7.8.2
typescript                      5.8.2
zone.js                         0.15.0

Anything else relevant?

No response

alan-agius4 added a commit to alan-agius4/angular-cli that referenced this issue Apr 2, 2025
alan-agius4 added a commit to alan-agius4/angular-cli that referenced this issue Apr 2, 2025
@alan-agius4 alan-agius4 added type: bug/fix freq1: low Only reported by a handful of users who observe it rarely severity6: security area: @angular/build labels Apr 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment