Skip to content

@angular-devkit/build-angular depends on vulnerable version of esbuild #30161

Closed as duplicate of#29708
@JainDhaval

Description

@JainDhaval

Command

new

Is this a regression?

  • Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

Running npm audit on Angular v18 project causes an error output, because @angular-devkit/build-angular depends on vulnerable version of esbuild.
See more details: GHSA-67mh-4wv8-2f99

Minimal Reproduction

Create new Angular v18 project.
Run npm audit in the project folder

Exception or Error


Your Environment

Angular CLI: 18.2.12
Node: 20.16.0
Package Manager: npm 10.9.2
OS: win32 x64

Angular: 18.2.13
... animations, common, compiler, compiler-cli, core, forms
... language-service, platform-browser, platform-browser-dynamic
... router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1802.12
@angular-devkit/build-angular   18.2.18
@angular-devkit/core            18.2.12
@angular-devkit/schematics      18.2.12
@angular/cdk                    18.2.14
@angular/cli                    18.2.12
@schematics/angular             18.2.12
rxjs                            7.8.1
typescript                      5.4.2
zone.js                         0.14.10

Anything else relevant?

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions