@angular-devkit/build-angular depends on vulnerable version of vite about angular-cli HOT 7 CLOSED

This vulnerability notice also occurs when you create a new project with Angular CLI version 16.2.13 and run npm audit on it.

from angular-cli.

Current workaround is to specify the following overrides in package.json:

  "overrides": {
    "undici": "^6.11.1",
    "vite": "~5.1.7"
  }

It is important to note that angular-memory-plugin generates a runtime error with the latest version of vite 5.2.8 which is why it is ~5.1.7 and not ^5.1.7

Excerpt of error

...
node_modules\@angular-devkit\build-angular\src\tools\vite\angular-memory-plugin.js:240:31
...
[vite] Internal server error: Failed to update Vite client error overlay text. (2)
      at loadViteClientCode

from angular-cli.

semi-related https://github.com/nodejs/undici/releases/tag/v6.11.1

from angular-cli.

Closed via #27430 and #27429

from angular-cli.

@alan-agius4, please, can you tell me when the fix will be available on NPM Registry please.

from angular-cli.

@Fabrice-K, typically, releases are done on Wednesdays

from angular-cli.

from angular-cli.