chore(deps): bump undici and @angular/build in /src/clientWeb by dependabot[bot] · Pull Request #32 · afonsoft/VideoChat

dependabot · 2026-06-20T10:57:56Z

Bumps undici to 7.28.0 and updates ancestor dependency @angular/build. These dependencies need to be updated together.

Updates undici from 7.24.4 to 7.28.0

Release notes

v7.28.0
⚠️ Security Release
This release line addresses 7 security advisories, all shipped in v7.28.0.
Action required: Upgrade to undici 7.28.0 or later.
npm install undici@^7.28.0
The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.
Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).
Summary
Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98
GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89
GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8
GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 7.28.0 d0574cc4
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 7.28.0 ea8930cf
High severity
WebSocket DoS via fragment count bypass — CVE-2026-12151
GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix:8cb10f98websocket: limit the number of fragments in a message (part of backport a027a4a0Backport WebSocket maxPayloadSize fixes to v7.x, #5423)
A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.
Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.
Workaround: none — upgrade is required.
TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697
GHSA-vmh5-mc38-953g · CWE-295

... (truncated)

Commits

f9eba0a Bumped v7.28.0 (#5430)
a027a4a Backport WebSocket maxPayloadSize fixes to v7.x (#5423)
8cb10f9 websocket: limit the number of fragments in a message
04201f8 fix: honor requestTls when proxy is SOCKS5
fcd642f fix(socks5): preserve dispatch backpressure return value (#5166)
bc98c97 fix(socks5): use configured connector in Socks5ProxyAgent (#5168)
9e1c743 fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (#5099)
376c8be fix(socks5): enforce authenticated state before CONNECT (#5097)
3805b8f fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...
85a2405 fix(cache): trim qualified field names
Additional commits viewable in compare view

Updates @angular/build from 21.2.5 to 22.0.3

Release notes

Sourced from @angular/build's releases.

22.0.3
@schematics/angular
Commit Description
remove default workspace vscode mcp.json configuration
22.0.2
@angular/cli
Commit Description
support registry metadata fetching under bun package manager
implement semaphore backpressure throttling in PackageManager
@angular/build
Commit Description
implement semaphore backpressure throttling in JavaScriptTransformer
@angular/ssr
Commit Description
avoid caching non-SSG page lookups
correct grammar in console warning for redirected location headers
prioritize options over environment variables in AngularNodeAppEngine
22.0.1
@schematics/angular
Commit Description
fix browserMode option mapping in refactor-jasmine-vitest
safely comment out multiline statements in refactor-jasmine-vitest
use null objects and callbacks in karma-to-vitest migration
@angular/cli
Commit Description
do not sort migrations of the same version alphabetically
fallback to local package.json for schematic detection on first run
isolate temporary package installation from parent pnpm workspace
remove forceAuth and unscoped credential parsing
validate registry option is a valid URL in ng add
optimize update schematic registry query counts by fetching package metadata lazily
@angular/build
Commit Description
allow disabling Vitest isolation from builder
exclude JSON imports from Vite dependency optimization
prevent concurrent stylesheet bundling esbuild context leaks
restrict application builder output paths to output directory
22.0.0
@schematics/angular
| Commit | Description |

... (truncated)

Changelog

Sourced from @angular/build's changelog.

22.0.3 (2026-06-18)
@schematics/angular
Commit Type Description
0eddea898 fix remove default workspace vscode mcp.json configuration
21.2.16 (2026-06-17)
@angular/cli
Commit Type Description
77c9047ac fix update pacote to 21.5.1
@angular/ssr
Commit Type Description
d052e97da fix prioritize options over environment variables in AngularNodeAppEngine
20.3.29 (2026-06-17)
@angular/cli
Commit Type Description
5f7c0328c fix update pacote to 21.5.1
@angular/ssr
Commit Type Description
a75d78e68 fix prioritize options over environment variables in AngularNodeAppEngine
22.0.2 (2026-06-17)

... (truncated)

Commits

b30b9d3 release: cut the v22.0.3 release
bc97bb3 build: update dependency vite to v7.3.5
0eddea8 fix(@schematics/angular): remove default workspace vscode mcp.json configuration
08f9959 refactor(@angular/cli): promote experimental MCP tools to stable
aab6c10 release: cut the v22.0.2 release
376e4dc build: update cross-repo angular dependencies
d996a27 fix(@angular/ssr): avoid caching non-SSG page lookups
5714bfc build: update pnpm to v10.34.3
f26011a build: lock file maintenance
2879ed9 build: update bazel dependencies
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [undici](https://github.com/nodejs/undici) to 7.28.0 and updates ancestor dependency [@angular/build](https://github.com/angular/angular-cli). These dependencies need to be updated together. Updates `undici` from 7.24.4 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.24.4...v7.28.0) Updates `@angular/build` from 21.2.5 to 22.0.3 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v21.2.5...v22.0.3) --- updated-dependencies: - dependency-name: undici dependency-version: 7.28.0 dependency-type: indirect - dependency-name: "@angular/build" dependency-version: 22.0.3 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

CLAassistant · 2026-06-20T10:58:05Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

devin-ai-integration

Devin Review found 1 potential issue.

devin-ai-integration · 2026-06-20T10:58:42Z

 },
 "devDependencies": {
- "@angular/build": "^21.2.5",
+ "@angular/build": "^22.0.3",


🔴 Major version mismatch: @angular/build ^22 with Angular 21 ecosystem
@angular/build is bumped to ^22.0.3 while every other @angular/* package in the project remains on major version 21 (@angular/core: ^21.2.0, @angular/cli: ^21.2.5, @angular/compiler-cli: ^21.2.0, @angular/ssr: ^21.2.5, etc.). Angular tooling packages are expected to be kept at the same major version as the framework. A major-version-ahead @angular/build may introduce breaking changes in the build pipeline (Webpack/esbuild configuration, SSR bundling, etc.) that are incompatible with the v21 framework and CLI, leading to build failures or subtle runtime issues.
Suggested change
"@angular/build": "^22.0.3",
"@angular/build": "^21.2.5",
Was this helpful? React with 👍 or 👎 to provide feedback.

dependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 20, 2026

devin-ai-integrationBot reviewed Jun 20, 2026
View reviewed changes

Navigation Menu

chore(deps): bump undici and @angular/build in /src/clientWeb - #32

chore(deps): bump undici and @angular/build in /src/clientWeb#32
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/clientWeb/multi-c87f1e1435

dependabotBot commented on behalf of githubJun 20, 2026•
edited by devin-ai-integration Bot
Loading

Uh oh!

CLAassistant commented Jun 20, 2026

Uh oh!

devin-ai-integrationBot left a comment

Uh oh!

devin-ai-integrationBotJun 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	`8cb10f98`
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	`04201f89`
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	`3805b8f8`
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	`85a24055`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	`d0574cc4`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	`d0574cc4`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	`ea8930cf`

Commit	Description
	support registry metadata fetching under bun package manager
	implement semaphore backpressure throttling in PackageManager

Commit	Description
	avoid caching non-SSG page lookups
	correct grammar in console warning for redirected location headers
	prioritize options over environment variables in AngularNodeAppEngine

Commit	Description
	fix browserMode option mapping in refactor-jasmine-vitest
	safely comment out multiline statements in refactor-jasmine-vitest
	use null objects and callbacks in karma-to-vitest migration

Commit	Description
	do not sort migrations of the same version alphabetically
	fallback to local package.json for schematic detection on first run
	isolate temporary package installation from parent pnpm workspace
	remove forceAuth and unscoped credential parsing
	validate registry option is a valid URL in ng add
	optimize update schematic registry query counts by fetching package metadata lazily

Commit	Description
	allow disabling Vitest isolation from builder
	exclude JSON imports from Vite dependency optimization
	prevent concurrent stylesheet bundling esbuild context leaks
	restrict application builder output paths to output directory

Conversation

dependabotBot commented on behalf of githubJun 20, 2026• edited by devin-ai-integration BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.28.0

⚠️ Security Release

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

22.0.3

@​schematics/angular

22.0.2

@​angular/cli

@​angular/build

@​angular/ssr

22.0.1

@​schematics/angular

@​angular/cli

@​angular/build

22.0.0

@​schematics/angular

22.0.3 (2026-06-18)

@​schematics/angular

21.2.16 (2026-06-17)

@​angular/cli

@​angular/ssr

20.3.29 (2026-06-17)

@​angular/cli

@​angular/ssr

22.0.2 (2026-06-17)

Uh oh!

CLAassistant commented Jun 20, 2026

Uh oh!

devin-ai-integrationBot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integrationBotJun 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabotBot commented on behalf of githubJun 20, 2026•
edited by devin-ai-integration Bot
Loading

`@schematics/angular`

`@angular/cli`

`@angular/build`

`@angular/ssr`

`@schematics/angular`

`@angular/cli`

`@angular/build`

`@schematics/angular`

`@schematics/angular`

`@angular/cli`

`@angular/ssr`

`@angular/cli`

`@angular/ssr`