Skip to content

pacote has a CVE out for the version in @angular/cli (20 and 22) #33376

Closed
Closed
pacote has a CVE out for the version in @angular/cli (20 and 22)#33376
#33380 (+2)
Labels
area: @angular/cligemini-triagedLabel noting that an issue has been triaged by gemini
Milestone
needsTriage

Description

@zsharpBDO
zsharpBDO
opened on Jun 15, 2026

Command

other

Is this a regression?

  • Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

Per CVE-2026-9496, pacote dependencies should be updated to at least version 21.5.1 (github's page on it is a little behind - Snyk identifies that 21.5.1 has the fix here).

This is currently affecting @angular/cli, both versions 20 and 22

Minimal Reproduction

  1. Initialize a new Angular project with npx -p @angular/cli@20 ng new
  2. In the new project, run npm explain pacote and note that the version (21.0.4) is affected by the CVE

Your Environment

Angular CLI: 20.3.28
Node: 22.22.3
Package Manager: npm 10.9.8
OS: win32 x64


Angular: 20.3.25
... common, compiler, compiler-cli, core, forms
... platform-browser, router

Package                      Version
------------------------------------
@angular-devkit/architect    0.2003.28
@angular-devkit/core         20.3.28
@angular-devkit/schematics   20.3.28
@angular/build               20.3.28
@angular/cli                 20.3.28
@schematics/angular          20.3.28
rxjs                         7.8.2
typescript                   5.9.3
zone.js                      0.15.1

Anything else relevant?

No response

Activity

  1. angular-robot
    added
    area: @angular/cli
    gemini-triagedLabel noting that an issue has been triaged by gemini
    on Jun 15, 2026
  2. angular-robot
    added this to the needsTriage milestone on Jun 15, 2026
  3. alan-agius4
    linked a pull request that will close this issuebuild: update dependency pacote to v21.5.1 (22.0.x) #33377on Jun 16, 2026
  4. alan-agius4
    added 3 commits that reference this issue on Jun 16, 2026

    build(@angular/cli): update pacote to 21.5.1

    d28c455

    fix(@angular/cli): update pacote to 21.5.1

    0bbc87c

    fix(@angular/cli): update pacote to 21.5.1

    6774882
  5. alan-agius4
    linked a pull request that will close this issuebuild(@angular/cli): update pacote to 21.5.1 #33381on Jun 16, 2026
  6. alan-agius4
    linked a pull request that will close this issuebuild(@angular/cli): update pacote to 21.5.1 #33380on Jun 16, 2026
  7. alan-agius4
    added 2 commits that reference this issue on Jun 16, 2026

    fix(@angular/cli): update pacote to 21.5.1

    a5ce18f

    fix(@angular/cli): update pacote to 21.5.1

    f43d15e
  8. alan-agius4
    closed this as completedon Jun 16, 2026
  9. alan-agius4
    added 2 commits that reference this issue on Jun 17, 2026

    fix(@angular/cli): update pacote to 21.5.1

    5f7c032

    fix(@angular/cli): update pacote to 21.5.1

    77c9047

  10. angular-automatic-lock-bot commented on Jul 17, 2026

    @angular-automatic-lock-bot
    angular-automatic-lock-botbot
    on Jul 17, 2026

    This issue has been automatically locked due to inactivity.
    Please file a new issue if you are encountering a similar or related problem.

    Read more about our automatic conversation locking policy.

    This action has been performed automatically by a bot.

  11. angular-automatic-lock-bot
    locked and limited conversation to collaborators on Jul 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: @angular/cligemini-triagedLabel noting that an issue has been triaged by gemini

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions