← All tasks
javascriptangular/angular-cli #33388Not a task: not reproduced

Request for fix of CVE-2026-6402 in Angular devkit v21 -> webpack-dev-server v5.2.4+

envgap__angular__angular-cli-33388

01 / FAILURE SIGNATURE

As reported upstream

### Exception or Error
Not a benchmark task.
  • In a clean container the reported failure did not reproduce, or the known fix did not make the project run.

02 / ENVIRONMENT RECIPE

Base commit
5f7c0328c3fe1a003ade44861d9aac98f485f014
Manifest
packages/angular_devkit/build_angular/package.json
Reproduce
Awaiting issue-specific recipe
Run under trace
Awaiting a meaningful runtime command

03 / ORIGINAL ISSUE TEXT

angular/angular-cli #33388 · read the original issue
### Command

other

### Is this a regression?

- [ ] Yes, this behavior used to work in the previous version

### The previous version in which this bug was not present was

_No response_

### Description

Would it be possible please to update the version of webpack-dev-server to at least 5.2.4 in Angular v21 to fix the Medium vulnerability [CVE-2026-6402](https://github.com/advisories/GHSA-79cf-xcqc-c78w) ? (already fixed in Angular v22)

Thank you.

### Minimal Reproduction

- create or update Angular devkit dependencies to the latest v21.2.15
- Audit the vulnerabilities

### Exception or Error

```text

```

### Your Environment

```text
ng version

     _                      _                 ____ _     ___
    / \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|
   / △ \ | '_ \ / _` | | | | |/ _` | '__|   | |   | |    | |
  / ___ \| | | | (_| | |_| | | (_| | |      | |___| |___ | |
 /_/   \_\_| |_|\__, |\__,_|_|\__,_|_|       \____|_____|___|
                |___/
    

Angular CLI       : 21.2.15
Angular           : 21.2.17
Node.js           : 24.16.0
Package Manager   : yarn 1.22.21+sha1.1959a18351b811cdeedbd484a8f86c3cc3bbaf72
Operating System  : win32 x64

┌────────────────────────────┬───────────────────┬───────────────────┐
│ Package                    │ Installed Version │ Requested Version │
├────────────────────────────┼───────────────────┼───────────────────┤
│ @angular-devkit/core       │ 21.2.15           │ ^21.2.7           │
│ @angular-devkit/schematics │ 21.2.15           │ ^21.2.14          │
│ @angular/build             │ 21.2.15           │ ^21.2.14          │
│ @angular/cdk               │ 21.2.14           │ ^21.2.14          │
│ @angular/cli               │ 21.2.15           │ ^21.2.14          │
│ @angular/common            │ 21.2.17           │ ^21.2.16          │
│ @angular/compiler          │ 21.2.17           │ ^21.2.16          │
│ @angular/compiler-cli      │ 21.2.17           │ ^21.2.16          │
│ @angular/core              │ 21.2.17           │ ^21.2.16          │
│ @angular/forms             │ 21.2.17           │ ^21.2.16          │
│ @angular/platform-browser  │ 21.2.17           │ ^21.2.16          │
│ @angular/router            │ 21.2.17           │ ^21.2.16          │
│ ng-packagr                 │ 21.2.5            │ ^21.2.5           │
│ rxjs                       │ 7.8.2             │ ~7.8.2            │
│ typescript                 │ 5.9.3             │ ~5.9.3            │
│ vitest                     │ 4.1.9             │ ^4.1.8            │
└────────────────────────────┴───────────────────┴───────────────────┘
```

### Anything else relevant?

_No response_
Continue on GitHub ↗

04 / LABELS

Labels from the report text only; not yet run

No supported category has been assigned.

Label rules and the text that matched
[]