Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

@angular/build@21 depends on [email protected] which is vulnerable to multiple CVEs

Aperta
  • Qualcosa non va?
#34,518 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@florimond-collette ci sta già lavorando.

Dal 25/10/2026.

  • #34521 di @florimond-collette — aperta

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
30/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
node.js, typescript
Ambito
build-system

Direzione di ricerca

Two open pull requests (#34521, #34522) already target this bump, so the fix is effectively claimed. If picking it up anyway, look at the undici dependency of @angular/build in the package.json / lockfile for the v21 branch, bump it to v7.30.1, and verify with npm audit that the CVEs are resolved.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Command

other

Is this a regression?
  • Yes, this behavior used to work in the previous version
The previous version in which this bug was not present was

No response

Description

@angular/build v21 depends on undici v7.29.1 which is vulnerable to CVE-2026-109924, CVE-2026-109841 and CVE-2026-109869. Fixed version is v7.30.1.
As far as I can tell, @angular/build v20 and v22 do not depend on undici at all and are therefore not affected.

Minimal Reproduction
  1. npm install @angular/build@21
  2. npm audit
Exception or Error
Your Environment
Angular CLI       : 21.2.27
Angular           : 21.2.25
Node.js           : 24.22.1
Package Manager   : npm 11.19.0
Operating System  : linux x64

┌───────────────────────────┬───────────────────┬───────────────────┐
│ Package                   │ Installed Version │ Requested Version │
├───────────────────────────┼───────────────────┼───────────────────┤
│ @angular/build            │ 21.2.27           │ ^21.2.27          │
│ @angular/cdk              │ 21.2.14           │ ^21.2.14          │
│ @angular/cli              │ 21.2.27           │ ^21.2.21          │
│ @angular/common           │ 21.2.25           │ ^21.2.20          │
│ @angular/compiler         │ 21.2.25           │ ^21.2.25          │
│ @angular/compiler-cli     │ 21.2.25           │ ^21.2.25          │
│ @angular/core             │ 21.2.25           │ ^21.2.25          │
│ @angular/elements         │ 21.2.25           │ ^21.2.20          │
│ @angular/forms            │ 21.2.25           │ ^21.2.20          │
│ @angular/platform-browser │ 21.2.25           │ ^21.2.20          │
│ @angular/router           │ 21.2.25           │ ^21.2.25          │
│ @angular/service-worker   │ 21.2.25           │ ^21.2.20          │
│ ng-packagr                │ 21.2.7            │ ^21.2             │
│ rxjs                      │ 7.8.2             │ ^7.8.2            │
│ typescript                │ 5.9.3             │ ^5.9.3 || ^6      │
│ vitest                    │ 4.1.12            │ ^4.1.7            │
│ zone.js                   │ 0.16.3            │ ^0.15 || ^0.16    │
└───────────────────────────┴───────────────────┴───────────────────┘
Anything else relevant?

Since I open issues to update vulnerable dependencies fairly often now, I want to ask a few questions:

  1. What is the reason for pinning versions in package.json? In this case doing a ~7.29.1 would not help, I know, but in many other cases it would.
  2. Should there be some kind of security scanner, a scheduled GitHub action running npm audit or something similar? This would probably detect vulnerable dependencies way faster than I do.
  3. The time to fix those vulnerable dependencies measured from release of the fix for the dependency until release of @angular/xxx is sometimes very long (> 1 week), which in my opinion is too much nowadays. This is my general concern and the first two questions already try to find solutions to this. Any other ideas?
Lingua principale
TypeScript
Stelle
27k
Fork
11.8k
Merge medio
1g 1h
PR unite (30g)
223

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di angular/angular-cli

Tutte le issue di angular/angular-cli

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.