Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

@angular/build@21 depends on [email protected] which is vulnerable to multiple CVEs

已关闭
  • 哪里不对？
#34,518 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

已经有一个关联 PR 被合并了。

  • #34521 来自 @florimond-collette —— 已合并

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
30/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
node.js, typescript
领域
build-system

调研方向

Two open pull requests (#34521, #34522) already target this bump, so the fix is effectively claimed. If picking it up anyway, look at the undici dependency of @angular/build in the package.json / lockfile for the v21 branch, bump it to v7.30.1, and verify with npm audit that the CVEs are resolved.

由索引模型根据 Issue 内容生成。

描述

Command

other

Is this a regression?
  • Yes, this behavior used to work in the previous version
The previous version in which this bug was not present was

No response

Description

@angular/build v21 depends on undici v7.29.1 which is vulnerable to CVE-2026-109924, CVE-2026-109841 and CVE-2026-109869. Fixed version is v7.30.1.
As far as I can tell, @angular/build v20 and v22 do not depend on undici at all and are therefore not affected.

Minimal Reproduction
  1. npm install @angular/build@21
  2. npm audit
Exception or Error
Your Environment
Angular CLI       : 21.2.27
Angular           : 21.2.25
Node.js           : 24.22.1
Package Manager   : npm 11.19.0
Operating System  : linux x64

┌───────────────────────────┬───────────────────┬───────────────────┐
│ Package                   │ Installed Version │ Requested Version │
├───────────────────────────┼───────────────────┼───────────────────┤
│ @angular/build            │ 21.2.27           │ ^21.2.27          │
│ @angular/cdk              │ 21.2.14           │ ^21.2.14          │
│ @angular/cli              │ 21.2.27           │ ^21.2.21          │
│ @angular/common           │ 21.2.25           │ ^21.2.20          │
│ @angular/compiler         │ 21.2.25           │ ^21.2.25          │
│ @angular/compiler-cli     │ 21.2.25           │ ^21.2.25          │
│ @angular/core             │ 21.2.25           │ ^21.2.25          │
│ @angular/elements         │ 21.2.25           │ ^21.2.20          │
│ @angular/forms            │ 21.2.25           │ ^21.2.20          │
│ @angular/platform-browser │ 21.2.25           │ ^21.2.20          │
│ @angular/router           │ 21.2.25           │ ^21.2.25          │
│ @angular/service-worker   │ 21.2.25           │ ^21.2.20          │
│ ng-packagr                │ 21.2.7            │ ^21.2             │
│ rxjs                      │ 7.8.2             │ ^7.8.2            │
│ typescript                │ 5.9.3             │ ^5.9.3 || ^6      │
│ vitest                    │ 4.1.12            │ ^4.1.7            │
│ zone.js                   │ 0.16.3            │ ^0.15 || ^0.16    │
└───────────────────────────┴───────────────────┴───────────────────┘
Anything else relevant?

Since I open issues to update vulnerable dependencies fairly often now, I want to ask a few questions:

  1. What is the reason for pinning versions in package.json? In this case doing a ~7.29.1 would not help, I know, but in many other cases it would.
  2. Should there be some kind of security scanner, a scheduled GitHub action running npm audit or something similar? This would probably detect vulnerable dependencies way faster than I do.
  3. The time to fix those vulnerable dependencies measured from release of the fix for the dependency until release of @angular/xxx is sometimes very long (> 1 week), which in my opinion is too much nowadays. This is my general concern and the first two questions already try to find solutions to this. Any other ideas?
主要语言
TypeScript
星标
27k
派生
11.8k
平均合并
1 天 2 小时
30 天内合并 PR
241

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

angular/angular-cli 的其他 Issue

查看 angular/angular-cli 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。