← All tasks
javascriptangular/angular-cli #33787Not a task: not reproduced

Update @angular/cli@21 dependency @modelcontextprotocol/sdk to 1.30.0 to mitigate GHSA-frvp-7c67-39w9

envgap__angular__angular-cli-33787

01 / FAILURE SIGNATURE

As reported upstream

### Exception or Error
Not a benchmark task.
  • In a clean container the reported failure did not reproduce, or the known fix did not make the project run.

02 / ENVIRONMENT RECIPE

Base commit
1bd120b310821f2794b8089936d8238e0468b65c
Manifest
packages/angular/cli/package.json
Reproduce
Awaiting issue-specific recipe
Run under trace
Awaiting a meaningful runtime command

03 / ORIGINAL ISSUE TEXT

angular/angular-cli #33787 · read the original issue
### Command

other

### Is this a regression?

- [ ] Yes, this behavior used to work in the previous version

### The previous version in which this bug was not present was

_No response_

### Description

Excerpt from @angular/cli@21 dependency tree looks like:
```
@angular/cli@21.2.20
  └─┬ @modelcontextprotocol/sdk@1.26.0
    └── @hono/node-server@1.19.17
```
Now, @hono/node-server < 2.0.5 is vulnerable to GHSA-frvp-7c67-39w9. The first @modelcontextprotocol/sdk version allowing @hono/node-server@2.0.5 is v1.30.0. So, the probably easiest solution would be to update @modelcontextprotocol/sdk to that version, which is currently fixed to v1.26.0.

### Minimal Reproduction

- Install @angular/cli ^21
- run `npm audit`

### Exception or Error

```text
Transitive dependency @hono/node-server vulnerable to GHSA-frvp-7c67-39w9
```

### Your Environment

```text
     _                      _                 ____ _     ___
    / \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|
   / △ \ | '_ \ / _` | | | | |/ _` | '__|   | |   | |    | |
  / ___ \| | | | (_| | |_| | | (_| | |      | |___| |___ | |
 /_/   \_\_| |_|\__, |\__,_|_|\__,_|_|       \____|_____|___|
                |___/
    

Angular CLI       : 21.2.19
Angular           : 21.2.19
Node.js           : 24.19.0
Package Manager   : npm 11.19.0
Operating System  : linux x64

┌───────────────────────────────────┬───────────────────┬───────────────────┐
│ Package                           │ Installed Version │ Requested Version │
├───────────────────────────────────┼───────────────────┼───────────────────┤
│ @angular/build                    │ 21.2.19           │ ^21.2.19          │
│ @angular/cdk                      │ 21.2.14           │ ^21.2.14          │
│ @angular/cli                      │ 21.2.19           │ ^21.2.19          │
│ @angular/common                   │ 21.2.19           │ ^21.2.19          │
│ @angular/compiler                 │ 21.2.19           │ ^21.2.19          │
│ @angular/compiler-cli             │ 21.2.19           │ ^21.2.19          │
│ @angular/core                     │ 21.2.19           │ ^21.2.19          │
│ @angular/elements                 │ 21.2.19           │ ^21.2.19          │
│ @angular/forms                    │ 21.2.19           │ ^21.2.19          │
│ @angular/platform-browser         │ 21.2.19           │ ^21.2.19          │
│ @angular/platform-browser-dynamic │ 21.2.19           │ ^21.2.19          │
│ @angular/router                   │ 21.2.19           │ ^21.2.19          │
│ @angular/service-worker           │ 21.2.19           │ ^21.2.19          │
│ ng-packagr                        │ 21.2.6            │ ^21.2             │
│ rxjs                              │ 7.8.2             │ ^7.8.2            │
│ typescript                        │ 5.9.3             │ ^5.9.3 || ^6      │
│ vitest                            │ 4.1.10            │ ^4.1.7            │
│ zone.js                           │ 0.16.2            │ ^0.15 || ^0.16    │
└───────────────────────────────────┴───────────────────┴───────────────────┘
```

### Anything else relevant?

_No response_
Continue on GitHub ↗

04 / LABELS

Labels from the report text only; not yet run

No supported category has been assigned.

Label rules and the text that matched
[]