← All tasks
javascriptangular/angular-cli #33407Not a task: not reproduced

Vite security issue CVE-2026-53571

envgap__angular__angular-cli-33407-pr33410

01 / FAILURE SIGNATURE

As reported upstream

### Exception or Error
Not a benchmark task.
  • In a clean container the reported failure did not reproduce, or the known fix did not make the project run.

02 / ENVIRONMENT RECIPE

Base commit
0eddea898d3bf4da8c9c5c27ec2ee79916e8be87
Manifest
packages/angular/build/package.json
Reproduce
Awaiting issue-specific recipe
Run under trace
Awaiting a meaningful runtime command

03 / ORIGINAL ISSUE TEXT

angular/angular-cli #33407 · read the original issue
### Command

build

### Is this a regression?

- [ ] Yes, this behavior used to work in the previous version

### The previous version in which this bug was not present was

_No response_

### Description

The current `vite` requirement for Angular 21.2.16 and 22.0.2 is `7.3.2`. `npm audit` reports an `high` vulnerability for versions `>= 7.0.0, <= 7.3.4` that is patched in `7.3.5` - https://github.com/advisories/GHSA-fx2h-pf6j-xcff

is there a chance to update `vite` to `7.3.5`?

### Minimal Reproduction

npm audit fix

### Exception or Error

```text

```

### Your Environment

```text
Angular CLI       : 21.2.15
Angular           : 21.2.17
Node.js           : 22.22.2
Package Manager   : npm 10.9.7
Operating System  : linux x64

┌───────────────────────────────────┬───────────────────┬───────────────────┐
│ Package                           │ Installed Version │ Requested Version │
├───────────────────────────────────┼───────────────────┼───────────────────┤
│ @angular-devkit/build-angular     │ 21.2.16           │ ^21.2.16          │
│ @angular/animations               │ 21.2.17           │ ^21.2.17          │
│ @angular/cdk                      │ 21.2.14           │ ^21.2.14          │
│ @angular/cli                      │ 21.2.15           │ ^21.2.15          │
│ @angular/common                   │ 21.2.17           │ ^21.2.17          │
│ @angular/compiler                 │ 21.2.17           │ ^21.2.17          │
│ @angular/compiler-cli             │ 21.2.17           │ ^21.2.17          │
│ @angular/core                     │ 21.2.17           │ ^21.2.17          │
│ @angular/elements                 │ 21.2.17           │ ^21.2.17          │
│ @angular/forms                    │ 21.2.17           │ ^21.2.17          │
│ @angular/material                 │ 21.2.14           │ ^21.2.14          │
│ @angular/platform-browser         │ 21.2.17           │ ^21.2.17          │
│ @angular/platform-browser-dynamic │ 21.2.17           │ ^21.2.17          │
│ @angular/router                   │ 21.2.17           │ ^21.2.17          │
│ rxjs                              │ 7.8.2             │ ^7.8.2            │
│ typescript                        │ 5.9.3             │ 5.9.3             │
│ zone.js                           │ 0.15.1            │ ~0.15.1           │
└───────────────────────────────────┴───────────────────┴───────────────────┘
```

### Anything else relevant?

_No response_
Continue on GitHub ↗

04 / LABELS

Labels from the report text only; not yet run

No supported category has been assigned.

Label rules and the text that matched
[]