Repository navigation
Update @angular/cli@21 dependency @modelcontextprotocol/sdk to 1.30.0 to mitigate GHSA-frvp-7c67-39w9 #33787
Description
Command
other
Is this a regression?
- Yes, this behavior used to work in the previous version
The previous version in which this bug was not present was
No response
Description
Excerpt from @angular/cli@21 dependency tree looks like:
@angular/cli@21.2.20
└─┬ @modelcontextprotocol/sdk@1.26.0
└── @hono/node-server@1.19.17
Now, @hono/node-server < 2.0.5 is vulnerable to GHSA-frvp-7c67-39w9. The first @modelcontextprotocol/sdk version allowing @hono/node-server@2.0.5 is v1.30.0. So, the probably easiest solution would be to update @modelcontextprotocol/sdk to that version, which is currently fixed to v1.26.0.
Minimal Reproduction
- Install @angular/cli ^21
- run
npm audit
Exception or Error
Transitive dependency @hono/node-server vulnerable to GHSA-frvp-7c67-39w9
Your Environment
_ _ ____ _ ___
/ \ _ __ __ _ _ _| | __ _ _ __ / ___| | |_ _|
/ △ \ | '_ \ / _` | | | | |/ _` | '__| | | | | | |
/ ___ \| | | | (_| | |_| | | (_| | | | |___| |___ | |
/_/ \_\_| |_|\__, |\__,_|_|\__,_|_| \____|_____|___|
|___/
Angular CLI : 21.2.19
Angular : 21.2.19
Node.js : 24.19.0
Package Manager : npm 11.19.0
Operating System : linux x64
┌───────────────────────────────────┬───────────────────┬───────────────────┐
│ Package │ Installed Version │ Requested Version │
├───────────────────────────────────┼───────────────────┼───────────────────┤
│ @angular/build │ 21.2.19 │ ^21.2.19 │
│ @angular/cdk │ 21.2.14 │ ^21.2.14 │
│ @angular/cli │ 21.2.19 │ ^21.2.19 │
│ @angular/common │ 21.2.19 │ ^21.2.19 │
│ @angular/compiler │ 21.2.19 │ ^21.2.19 │
│ @angular/compiler-cli │ 21.2.19 │ ^21.2.19 │
│ @angular/core │ 21.2.19 │ ^21.2.19 │
│ @angular/elements │ 21.2.19 │ ^21.2.19 │
│ @angular/forms │ 21.2.19 │ ^21.2.19 │
│ @angular/platform-browser │ 21.2.19 │ ^21.2.19 │
│ @angular/platform-browser-dynamic │ 21.2.19 │ ^21.2.19 │
│ @angular/router │ 21.2.19 │ ^21.2.19 │
│ @angular/service-worker │ 21.2.19 │ ^21.2.19 │
│ ng-packagr │ 21.2.6 │ ^21.2 │
│ rxjs │ 7.8.2 │ ^7.8.2 │
│ typescript │ 5.9.3 │ ^5.9.3 || ^6 │
│ vitest │ 4.1.10 │ ^4.1.7 │
│ zone.js │ 0.16.2 │ ^0.15 || ^0.16 │
└───────────────────────────────────┴───────────────────┴───────────────────┘
Anything else relevant?
No response
Activity
fix(@angular/cli): update dependency @modelcontextprotocol/sdk to v1.…
fix(@angular/cli): update dependency @modelcontextprotocol/sdk to v1.…
angular-automatic-lock-bot commentedon Oct 18, 2026
This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.
Read more about our automatic conversation locking policy.
This action has been performed automatically by a bot.