@angular-devkit/build-angular depends on vulnerable version of vite

[JainDhaval]

Command

new

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

Running npm audit on Angular v18 project causes an error output, because @angular-devkit/build-angular depends on vulnerable version of vite.
See more details: GHSA-859w-5945-r5v3

Minimal Reproduction

Create new Angular v18 project.
Run npm audit in the project folder

Exception or Error

Your Environment

Angular CLI: 18.2.12
Node: 20.16.0
Package Manager: npm 10.9.2
OS: win32 x64

Angular: 18.2.13
... animations, common, compiler, compiler-cli, core, forms
... language-service, platform-browser, platform-browser-dynamic
... router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1802.12
@angular-devkit/build-angular   18.2.19
@angular-devkit/core            18.2.12
@angular-devkit/schematics      18.2.12
@angular/cdk                    18.2.14
@angular/cli                    18.2.12
@schematics/angular             18.2.12
rxjs                            7.8.1
typescript                      5.4.2
zone.js                         0.14.10

Anything else relevant?

No response

[alan-agius4]

Please update your lock file