Repository navigation
@angular-devkit/core@19 and @20 depend on vulnerable version of ajv #32591
Description
Command
new
Is this a regression?
- Yes, this behavior used to work in the previous version
The previous version in which this bug was not present was
No response
Description
Running npm audit on Angular v19 and v20 project causes an error output, because @angular-devkit/core depends on vulnerable version of ajv (fixed "ajv": "8.17.1" - required patched version: 8.18.0)
See more details:
GHSA-2g4f-4pwh-qvx6
Minimal Reproduction
Create new Angular v19 or v20 project.
Run npm audit in the project folder
Exception or Error
Your Environment
Angular CLI: 19.2.21
Node: 22.22.0
Package Manager: npm 10.9.4
OS: win32 x64
Angular: 19.2.19
... common, compiler, compiler-cli, core, forms
... platform-browser, platform-browser-dynamic, router
Package Version
---------------------------------------------------------
@angular-devkit/architect 0.1902.21
@angular-devkit/build-angular 19.2.21
@angular-devkit/core 19.2.21
@angular-devkit/schematics 19.2.21
@angular/cli 19.2.21
@schematics/angular 19.2.21
rxjs 7.8.2
typescript 5.7.3
zone.js 0.15.1
Anything else relevant?
No response
Activity
[-]@angular-devkit/core depends on vulnerable version of ajv[/-][+]@angular-devkit/core@19 and @20 depends on vulnerable version of ajv[/+][-]@angular-devkit/core@19 and @20 depends on vulnerable version of ajv[/-][+]@angular-devkit/core@19 and @20 depend on vulnerable version of ajv[/+]angular-automatic-lock-bot commentedon Mar 29, 2026
This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.
Read more about our automatic conversation locking policy.
This action has been performed automatically by a bot.