← All tasks
javascriptangular/angular-cli #33590Not a task: not reproduced

CLI 22.0.x branch should get update to use vite 7.3.6

envgap__angular__angular-cli-33590

01 / FAILURE SIGNATURE

As reported upstream

### Exception or Error
Not a benchmark task.
  • In a clean container the reported failure did not reproduce, or the known fix did not make the project run.

02 / ENVIRONMENT RECIPE

Base commit
1e556b30655fdb093555925e9750ab24e1dcf0d4
Manifest
packages/angular/build/package.json
Reproduce
Awaiting issue-specific recipe
Run under trace
Awaiting a meaningful runtime command

03 / ORIGINAL ISSUE TEXT

angular/angular-cli #33590 · read the original issue
### Command

serve

### Is this a regression?

- [ ] Yes, this behavior used to work in the previous version

### The previous version in which this bug was not present was

_No response_

### Description

Both versions 20.x and 21.x have had versions released that use vite 7.3.6 in order to allow versions of esbuild that do not contain its most recently identified vulnerabilities.  While the 22.1.x pre-release builds have an update to vite 8 that will remediate the vulnerabilities directly, and 22.1's real release is presumably coming soon and will render this largely moot, the 22.0.x branch currently flags esbuild as vulnerable in a standard "npm audit" as a result of targeting vite 7.3.5.

Can we get the same patch applied to 22.0.x to use 7.3.6 as well?

### Minimal Reproduction

Just create a new app on 22.0.x and run "npm audit" (or presumably the equivalent in other package managers).  You will see a low vulnerability flagged against esbuild that is getting included because of vite.

### Exception or Error

```text

```

### Your Environment

```text
_                      _                 ____ _     ___
    / \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|
   / △ \ | '_ \ / _` | | | | |/ _` | '__|   | |   | |    | |
  / ___ \| | | | (_| | |_| | | (_| | |      | |___| |___ | |
 /_/   \_\_| |_|\__, |\__,_|_|\__,_|_|       \____|_____|___|
                |___/
    

Angular CLI       : 22.0.7
Angular           : 22.0.7
Node.js           : 24.18.0
Package Manager   : npm 11.17.0
Operating System  : win32 x64

┌───────────────────────────┬───────────────────┬───────────────────┐
│ Package                   │ Installed Version │ Requested Version │
├───────────────────────────┼───────────────────┼───────────────────┤
│ @angular/build            │ 22.0.7            │ ^22.0.7           │
│ @angular/cdk              │ 22.0.5            │ ~22.0.5           │
│ @angular/cli              │ 22.0.7            │ ^22.0.7           │
│ @angular/common           │ 22.0.7            │ ^22.0.7           │
│ @angular/compiler         │ 22.0.7            │ ^22.0.7           │
│ @angular/compiler-cli     │ 22.0.7            │ ^22.0.7           │
│ @angular/core             │ 22.0.7            │ ^22.0.7           │
│ @angular/forms            │ 22.0.7            │ ^22.0.7           │
│ @angular/material         │ 22.0.5            │ ^22.0.5           │
│ @angular/platform-browser │ 22.0.7            │ ^22.0.7           │
│ @angular/router           │ 22.0.7            │ ^22.0.7           │
│ ng-packagr                │ 22.0.1            │ ^22.0.1           │
│ rxjs                      │ 7.8.2             │ ^7.8.2            │
│ typescript                │ 6.0.3             │ ~6.0.3            │
│ vitest                    │ 4.1.10            │ ^4.1.10           │
│ zone.js                   │ 0.16.2            │ ~0.16.2           │
└───────────────────────────┴───────────────────┴───────────────────┘
```

### Anything else relevant?

Easily worked around with:

```
overrides: {
  "esbuild": ">=0.28.1"
}
```
Continue on GitHub ↗

04 / LABELS

Labels from the report text only; not yet run

No supported category has been assigned.

Label rules and the text that matched
[]