@angular-devkit/build-angular depends on vulnerable version of esbuild - GHSA-67mh-4wv8-2f99

[poiuylkkk]

Command

build

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

npm audit
esbuild <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server and read the response - GHSA-67mh-4wv8-2f99
fix available via npm audit fix --force
Will install @angular-devkit/build-angular@19.2.5, which is a breaking change
node_modules/@angular-devkit/build-angular/node_modules/esbuild
node_modules/vite/node_modules/esbuild
vite <=6.1.2
Depends on vulnerable versions of esbuild
node_modules/vite

@angular-devkit/build-angular@16.2.16
├── esbuild@0.18.17
└─┬ vite@4.5.5
└── esbuild@0.18.20

GHSA-67mh-4wv8-2f99

Minimal Reproduction

Create a new angular project using the latest v16 @angular-cli
Run npm audit in the project folder

Exception or Error

Your Environment

_                      _                 ____ _     ___
    / \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|
   / △ \ | '_ \ / _` | | | | |/ _` | '__|   | |   | |    | |
  / ___ \| | | | (_| | |_| | | (_| | |      | |___| |___ | |
 /_/   \_\_| |_|\__, |\__,_|_|\__,_|_|       \____|_____|___|
                |___/
    

Angular CLI: 16.2.16
Node: 18.20.4
Package Manager: npm 10.7.0
OS: win32 x64

Angular: 16.2.12
... animations, common, compiler, compiler-cli, core, forms
... platform-browser, platform-browser-dynamic, router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1602.16
@angular-devkit/build-angular   16.2.16
@angular-devkit/core            16.2.16
@angular-devkit/schematics      16.2.16
@angular/cli                    16.2.16
@schematics/angular             16.2.16
rxjs                            7.8.2
typescript                      5.1.6
zone.js                         0.13.3

Anything else relevant?

No response

[alan-agius4]

Thanks for opening the issue, but Angular version 16 is no longer supported.

See: https://angular.dev/reference/releases#actively-supported-versions

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}