Skip to content

build(deps): bump undici, @angular-builders/custom-webpack, @angular-builders/jest and @angular-devkit/build-angular in /simulator-ui - #412

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/simulator-ui/multi-4faac6a52f
Closed

build(deps): bump undici, @angular-builders/custom-webpack, @angular-builders/jest and @angular-devkit/build-angular in /simulator-ui#412
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/simulator-ui/multi-4faac6a52f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 5, 2026

Copy link
Copy Markdown
Contributor

Bumps undici to 6.28.0 and updates ancestor dependencies undici, @angular-builders/custom-webpack, @angular-builders/jest and @angular-devkit/build-angular. These dependencies need to be updated together.

Updates undici from 6.25.0 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did

... (truncated)

Commits
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
  • cba3a52 fix(retry): reject partial content length mismatch
  • af74840 fix: harden cookie domain, path, and unparsed attribute validation
  • 551138c Bumped v6.27.0 (#5431)
  • b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
  • 25efa44 fix(cookies): preserve values and parse SameSite strictly
  • Additional commits viewable in compare view

Updates undici from 7.25.0 to 7.29.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did

... (truncated)

Commits
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
  • cba3a52 fix(retry): reject partial content length mismatch
  • af74840 fix: harden cookie domain, path, and unparsed attribute validation
  • 551138c Bumped v6.27.0 (#5431)
  • b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
  • 25efa44 fix(cookies): preserve values and parse SameSite strictly
  • Additional commits viewable in compare view

Updates @angular-builders/custom-webpack from 21.0.3 to 22.0.1

Changelog

Sourced from @​angular-builders/custom-webpack's changelog.

22.0.1 (2026-06-23)

Note: Version bump only for package @​angular-builders/custom-webpack

22.0.1-beta.0 (2026-06-22)

Note: Version bump only for package @​angular-builders/custom-webpack

22.0.0 (2026-06-10)

Note: Version bump only for package @​angular-builders/custom-webpack

22.0.0-beta.1 (2026-06-09)

Note: Version bump only for package @​angular-builders/custom-webpack

22.0.0-beta.0 (2026-06-09)

⚠ BREAKING CHANGES

  • All packages now require Angular 22.
  • User TypeScript config/plugin modules now load via jiti instead of ts-node. Configs are transpiled rather than type-checked (run tsc --noEmit separately if you relied on build-time type-checking); ts-node and tsconfig-paths are no longer dependencies; and the NODE_OPTIONS='--loader ts-node/esm' workaround for ESM apps is no longer needed.

Features

  • ng add / ng update schematics for jest, custom-esbuild, custom-webpack (#2267) (062f423), closes #22
  • replace ts-node with jiti for loading TypeScript modules (#2287) (0348e06), closes #816
  • upgrade builders + examples to Angular 22 (22.0.0-rc.2) (#2264) (9ed7020)

Miscellaneous Chores

  • graduate Angular 22 from RC to GA (daec882)

21.1.0 (2026-06-08)

Note: Version bump only for package @​angular-builders/custom-webpack

21.1.0-beta.13 (2026-06-05)

Reverts

21.1.0-beta.12 (2026-06-04)

Bug Fixes

  • builders: annotate builder default exports with Builder to avoid TS2742 (#2278) (7db3848)

21.1.0-beta.11 (2026-06-01)

... (truncated)

Commits
  • 0a130ae ci(release): publish
  • 79b145a ci(release): publish
  • 6cdd684 style: format repo with prettier and add CI format gate (#2323)
  • 7cebff9 ci(release): publish
  • 6647e73 ci(release): publish
  • 49f90e4 docs(changelog): clean up v22 breaking-change sections
  • a27c6b0 ci(release): publish
  • daec882 chore!: graduate Angular 22 from RC to GA
  • 2cb9a56 chore(deps): update bazel-example to Angular CLI 22
  • 0348e06 feat!: replace ts-node with jiti for loading TypeScript modules (#2287)
  • Additional commits viewable in compare view

Updates @angular-builders/jest from 21.0.3 to 22.0.1

Changelog

Sourced from @​angular-builders/jest's changelog.

22.0.1 (2026-06-23)

Note: Version bump only for package @​angular-builders/jest

22.0.1-beta.2 (2026-06-22)

Note: Version bump only for package @​angular-builders/jest

22.0.1-beta.1 (2026-06-22)

Bug Fixes

  • jest: stop pinning jest-preset-angular in ng-add; resolve it transitively (#2319) (f5f993f)

22.0.1-beta.0 (2026-06-22)

Note: Version bump only for package @​angular-builders/jest

22.0.0 (2026-06-10)

Note: Version bump only for package @​angular-builders/jest

22.0.0-beta.1 (2026-06-09)

Note: Version bump only for package @​angular-builders/jest

22.0.0-beta.0 (2026-06-09)

⚠ BREAKING CHANGES

  • All packages now require Angular 22.
  • User TypeScript config/plugin modules now load via jiti instead of ts-node. Configs are transpiled rather than type-checked (run tsc --noEmit separately if you relied on build-time type-checking); ts-node and tsconfig-paths are no longer dependencies; and the NODE_OPTIONS='--loader ts-node/esm' workaround for ESM apps is no longer needed.
  • isolatedModules now defaults to true for faster compilation, which disables cross-file TypeScript type-checking during Jest runs. Set isolatedModules: false in your config to restore the previous behavior.
  • Coverage output is now scoped per project: coverageDirectory defaults to <projectRoot>/coverage instead of ./coverage, so projects in a multi-project workspace no longer overwrite each other's reports.

Features

  • ng add / ng update schematics for jest, custom-esbuild, custom-webpack (#2267) (062f423), closes #22
  • replace ts-node with jiti for loading TypeScript modules (#2287) (0348e06), closes #816
  • upgrade builders + examples to Angular 22 (22.0.0-rc.2) (#2264) (9ed7020)

Bug Fixes

  • jest: default isolatedModules to true for faster compilation (fixes #1899) (#2191) (acd2d37)
  • jest: scope coverage output per-project in multi-project workspaces (fixes #1009) (#2212) (0ac5d6d)

Miscellaneous Chores

  • graduate Angular 22 from RC to GA (daec882)

... (truncated)

Commits
  • 0a130ae ci(release): publish
  • 79b145a ci(release): publish
  • 6cdd684 style: format repo with prettier and add CI format gate (#2323)
  • ed21d04 ci(release): publish
  • f5f993f fix(jest): stop pinning jest-preset-angular in ng-add; resolve it transitivel...
  • 5afafd6 ci(release): publish
  • 6f14a1d chore(deps): update dependency jest-preset-angular to v17 (#2313)
  • 7cebff9 ci(release): publish
  • 6647e73 ci(release): publish
  • 49f90e4 docs(changelog): clean up v22 breaking-change sections
  • Additional commits viewable in compare view

Updates @angular-devkit/build-angular from 21.2.11 to 22.1.3

Release notes

Sourced from @​angular-devkit/build-angular's releases.

22.1.3

@​angular/cli

Commit Description
fix - f837b788c6 always install package during ng add to inspect manifest on disk for schematics (#33718)
fix - 72ae93638d correctly report available package updates during bare ng update
fix - a949e06568 discover migrations from installed packages when omitted by registry metadata (#33718)
fix - 1d9122fd50 normalize Windows drive-letter casing for process.cwd

@​angular/build

Commit Description
fix - a4860d505a prevent build process hang on unhandled error (#33715)
fix - 7686d66cab retain watch files on error in load result cache
fix - 25b7cf7504 support case-insensitive and alternative license file names
perf - 4fd81402ce release build resources early in non-watch mode (#33715)

@​angular/ssr

Commit Description
fix - 6af906cb94 settle writeResponseToNodeResponse when client disconnects
perf - 917d3b2254 avoid buffering request body when sanitizing headers

22.1.2

@​angular/cli

Commit Description
fix - 57db27ea91 add packages with built-in schematics to devDependencies only

@​angular/build

Commit Description
fix - baed978885 prevent IIFE wrapper interleaving for adjacent classes in minified files

22.1.1

@​angular/cli

Commit Description
fix - ab971a8543 support npm 12 metadata array and error formats

@​angular/build

Commit Description
fix - db24220fb8 rewrite paths from sandboxed execroots when running under Bazel

22.1.0

@​angular/cli

Commit Description
fix - f59bcf529 abort and guide manual mitigation when updating catalog packages
fix - 48f90f5d5 prevent Yarn registry environment variable override
fix - c963ecbec remove algoliasearch dependency and support latest docs versions
fix - 6859d25c3 resolve correct registry name when using npm alias syntax during update
fix - 3a2589dac respect client-side release age settings during update resolution

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

22.1.3 (2026-08-05)

@​angular/cli

Commit Type Description
f837b788c6 fix always install package during ng add to inspect manifest on disk for schematics (#33718)
72ae93638d fix correctly report available package updates during bare ng update
a949e06568 fix discover migrations from installed packages when omitted by registry metadata (#33718)
1d9122fd50 fix normalize Windows drive-letter casing for process.cwd

@​angular/build

Commit Type Description
a4860d505a fix prevent build process hang on unhandled error (#33715)
7686d66cab fix retain watch files on error in load result cache
25b7cf7504 fix support case-insensitive and alternative license file names
4fd81402ce perf release build resources early in non-watch mode (#33715)

@​angular/ssr

Commit Type Description
6af906cb94 fix settle writeResponseToNodeResponse when client disconnects
917d3b2254 perf avoid buffering request body when sanitizing headers

21.2.20 (2026-08-05)

@​angular-devkit/build-angular

Commit Type Description
972f6db7e9 fix upgrade postcss to 8.5.23

@​angular/build

Commit Type Description
8de75ada50 fix upgrade postcss to 8.5.23

20.3.33 (2026-08-05)

... (truncated)

Commits
  • 60078fc release: cut the v22.1.3 release
  • 434e070 refactor(@​angular/cli): remove unused eslint-disable comment in git utility
  • 3a49bd4 build: update pnpm to v11.20.0
  • 7686d66 fix(@​angular/build): retain watch files on error in load result cache
  • 1d9122f fix(@​angular/cli): normalize Windows drive-letter casing for process.cwd
  • 4e54f3a ci: schedule ng-snapshot Renovate updates for early morning only
  • 6f75b73 build: update cross-repo angular dependencies
  • 25b7cf7 fix(@​angular/build): support case-insensitive and alternative license file names
  • 212373a build: lock file maintenance
  • 74d6d0b build: update dependency postcss to v8.5.25
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…builders/jest and @angular-devkit/build-angular

Bumps [undici](https://github.com/nodejs/undici) to 6.28.0 and updates ancestor dependencies [undici](https://github.com/nodejs/undici), [@angular-builders/custom-webpack](https://github.com/just-jeb/angular-builders/tree/HEAD/packages/custom-webpack), [@angular-builders/jest](https://github.com/just-jeb/angular-builders/tree/HEAD/packages/jest) and [@angular-devkit/build-angular](https://github.com/angular/angular-cli). These dependencies need to be updated together.


Updates `undici` from 6.25.0 to 6.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.25.0...v6.28.0)

Updates `undici` from 7.25.0 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.25.0...v6.28.0)

Updates `@angular-builders/custom-webpack` from 21.0.3 to 22.0.1
- [Release notes](https://github.com/just-jeb/angular-builders/releases)
- [Changelog](https://github.com/just-jeb/angular-builders/blob/master/packages/custom-webpack/CHANGELOG.md)
- [Commits](https://github.com/just-jeb/angular-builders/commits/@angular-builders/custom-webpack@22.0.1/packages/custom-webpack)

Updates `@angular-builders/jest` from 21.0.3 to 22.0.1
- [Release notes](https://github.com/just-jeb/angular-builders/releases)
- [Changelog](https://github.com/just-jeb/angular-builders/blob/master/packages/jest/CHANGELOG.md)
- [Commits](https://github.com/just-jeb/angular-builders/commits/@angular-builders/jest@22.0.1/packages/jest)

Updates `@angular-devkit/build-angular` from 21.2.11 to 22.1.3
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](angular/angular-cli@v21.2.11...v22.1.3)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: indirect
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: indirect
- dependency-name: "@angular-builders/custom-webpack"
  dependency-version: 22.0.1
  dependency-type: direct:development
- dependency-name: "@angular-builders/jest"
  dependency-version: 22.0.1
  dependency-type: direct:development
- dependency-name: "@angular-devkit/build-angular"
  dependency-version: 22.1.3
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 5, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 12, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/simulator-ui/multi-4faac6a52f branch August 12, 2026 11:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants