Update @angular/cli@21 dependency @modelcontextprotocol/sdk to 1.30.0 to mitigate GHSA-frvp-7c67-39w9
envgap__angular__angular-cli-33787
01 / FAILURE SIGNATURE
As reported upstream
### Exception or Error
Not a benchmark task.
- In a clean container the reported failure did not reproduce, or the known fix did not make the project run.
02 / ENVIRONMENT RECIPE
- Base commit
1bd120b310821f2794b8089936d8238e0468b65c- Manifest
packages/angular/cli/package.json- Reproduce
Awaiting issue-specific recipe- Run under trace
Awaiting a meaningful runtime command
03 / ORIGINAL ISSUE TEXT
angular/angular-cli #33787 · read the original issue
### Command
other
### Is this a regression?
- [ ] Yes, this behavior used to work in the previous version
### The previous version in which this bug was not present was
_No response_
### Description
Excerpt from @angular/cli@21 dependency tree looks like:
```
@angular/cli@21.2.20
└─┬ @modelcontextprotocol/sdk@1.26.0
└── @hono/node-server@1.19.17
```
Now, @hono/node-server < 2.0.5 is vulnerable to GHSA-frvp-7c67-39w9. The first @modelcontextprotocol/sdk version allowing @hono/node-server@2.0.5 is v1.30.0. So, the probably easiest solution would be to update @modelcontextprotocol/sdk to that version, which is currently fixed to v1.26.0.
### Minimal Reproduction
- Install @angular/cli ^21
- run `npm audit`
### Exception or Error
```text
Transitive dependency @hono/node-server vulnerable to GHSA-frvp-7c67-39w9
```
### Your Environment
```text
_ _ ____ _ ___
/ \ _ __ __ _ _ _| | __ _ _ __ / ___| | |_ _|
/ △ \ | '_ \ / _` | | | | |/ _` | '__| | | | | | |
/ ___ \| | | | (_| | |_| | | (_| | | | |___| |___ | |
/_/ \_\_| |_|\__, |\__,_|_|\__,_|_| \____|_____|___|
|___/
Angular CLI : 21.2.19
Angular : 21.2.19
Node.js : 24.19.0
Package Manager : npm 11.19.0
Operating System : linux x64
┌───────────────────────────────────┬───────────────────┬───────────────────┐
│ Package │ Installed Version │ Requested Version │
├───────────────────────────────────┼───────────────────┼───────────────────┤
│ @angular/build │ 21.2.19 │ ^21.2.19 │
│ @angular/cdk │ 21.2.14 │ ^21.2.14 │
│ @angular/cli │ 21.2.19 │ ^21.2.19 │
│ @angular/common │ 21.2.19 │ ^21.2.19 │
│ @angular/compiler │ 21.2.19 │ ^21.2.19 │
│ @angular/compiler-cli │ 21.2.19 │ ^21.2.19 │
│ @angular/core │ 21.2.19 │ ^21.2.19 │
│ @angular/elements │ 21.2.19 │ ^21.2.19 │
│ @angular/forms │ 21.2.19 │ ^21.2.19 │
│ @angular/platform-browser │ 21.2.19 │ ^21.2.19 │
│ @angular/platform-browser-dynamic │ 21.2.19 │ ^21.2.19 │
│ @angular/router │ 21.2.19 │ ^21.2.19 │
│ @angular/service-worker │ 21.2.19 │ ^21.2.19 │
│ ng-packagr │ 21.2.6 │ ^21.2 │
│ rxjs │ 7.8.2 │ ^7.8.2 │
│ typescript │ 5.9.3 │ ^5.9.3 || ^6 │
│ vitest │ 4.1.10 │ ^4.1.7 │
│ zone.js │ 0.16.2 │ ^0.15 || ^0.16 │
└───────────────────────────────────┴───────────────────┴───────────────────┘
```
### Anything else relevant?
_No response_04 / LABELS
Labels from the report text only; not yet run
No supported category has been assigned.
Label rules and the text that matched
[]