@angular-devkit/build-angular depends on vulnerable version of vite

[pramodhcm]

Command

new

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

Vite dev server option server.fs.deny can be bypassed when hosted on a case-insensitive filesystem.
For more details: GHSA-c24v-8rfc-w8vw

Minimal Reproduction

Create new Angular v16 project.
Run npm audit in the project folder

Exception or Error

No response

Your Environment

Angular CLI: 16.2.10
Node: 20.11.0 (Unsupported)
Package Manager: npm 10.3.0
OS: win32 x64

Angular: 16.2.12
... animations, cdk, common, compiler, compiler-cli, core, forms
... language-service, platform-browser, platform-browser-dynamic
... router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1602.10
@angular-devkit/build-angular   16.2.11
@angular-devkit/core            16.2.10
@angular-devkit/schematics      16.2.10
@angular/cli                    16.2.10
@schematics/angular             16.2.10
rxjs                            7.8.1
typescript                      4.9.5
zone.js                         0.13.3

Anything else relevant?

No response

[JeanMeche]

Hi, this has been reported in #26916 and is being adressed in #26919 and #26930

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}