Vite security issue CVE-2026-53571
envgap__angular__angular-cli-33407-pr33410
01 / FAILURE SIGNATURE
As reported upstream
### Exception or Error
Not a benchmark task.
- In a clean container the reported failure did not reproduce, or the known fix did not make the project run.
02 / ENVIRONMENT RECIPE
- Base commit
0eddea898d3bf4da8c9c5c27ec2ee79916e8be87- Manifest
packages/angular/build/package.json- Reproduce
Awaiting issue-specific recipe- Run under trace
Awaiting a meaningful runtime command
03 / ORIGINAL ISSUE TEXT
angular/angular-cli #33407 · read the original issue
### Command build ### Is this a regression? - [ ] Yes, this behavior used to work in the previous version ### The previous version in which this bug was not present was _No response_ ### Description The current `vite` requirement for Angular 21.2.16 and 22.0.2 is `7.3.2`. `npm audit` reports an `high` vulnerability for versions `>= 7.0.0, <= 7.3.4` that is patched in `7.3.5` - https://github.com/advisories/GHSA-fx2h-pf6j-xcff is there a chance to update `vite` to `7.3.5`? ### Minimal Reproduction npm audit fix ### Exception or Error ```text ``` ### Your Environment ```text Angular CLI : 21.2.15 Angular : 21.2.17 Node.js : 22.22.2 Package Manager : npm 10.9.7 Operating System : linux x64 ┌───────────────────────────────────┬───────────────────┬───────────────────┐ │ Package │ Installed Version │ Requested Version │ ├───────────────────────────────────┼───────────────────┼───────────────────┤ │ @angular-devkit/build-angular │ 21.2.16 │ ^21.2.16 │ │ @angular/animations │ 21.2.17 │ ^21.2.17 │ │ @angular/cdk │ 21.2.14 │ ^21.2.14 │ │ @angular/cli │ 21.2.15 │ ^21.2.15 │ │ @angular/common │ 21.2.17 │ ^21.2.17 │ │ @angular/compiler │ 21.2.17 │ ^21.2.17 │ │ @angular/compiler-cli │ 21.2.17 │ ^21.2.17 │ │ @angular/core │ 21.2.17 │ ^21.2.17 │ │ @angular/elements │ 21.2.17 │ ^21.2.17 │ │ @angular/forms │ 21.2.17 │ ^21.2.17 │ │ @angular/material │ 21.2.14 │ ^21.2.14 │ │ @angular/platform-browser │ 21.2.17 │ ^21.2.17 │ │ @angular/platform-browser-dynamic │ 21.2.17 │ ^21.2.17 │ │ @angular/router │ 21.2.17 │ ^21.2.17 │ │ rxjs │ 7.8.2 │ ^7.8.2 │ │ typescript │ 5.9.3 │ 5.9.3 │ │ zone.js │ 0.15.1 │ ~0.15.1 │ └───────────────────────────────────┴───────────────────┴───────────────────┘ ``` ### Anything else relevant? _No response_
04 / LABELS
Labels from the report text only; not yet run
No supported category has been assigned.
Label rules and the text that matched
[]