Description

Czar-Ec

opened on Aug 26, 2026

Issue body actions

Command

build

Description

$ npm ls image-size

└─┬ @angular-devkit/[email protected]
└─┬ [email protected]
└── [email protected]

@angular-devkit/build-angular is using a version of image size that has a CVE vulnerability

I can't upgrade from Angular 21, unfortunately

Describe the solution you'd like

Upgrade to latest image-size package

Describe alternatives you've considered

No response

Activity

1. angular-robot

   added

   area: @angular-devkit/build-angular

   gemini-triagedLabel noting that an issue has been triaged by geminiLabel noting that an issue has been triaged by gemini

   on Aug 26, 2026
2. angular-robot

   added this to the needsTriage milestone on Aug 26, 2026
3. Czar-Ec commented on Aug 26, 2026

   

   Czar-Ec

   on Aug 26, 2026

   Author

   More actions

   It looks like it should be less that needs to be upgraded actually
4. alan-agius4

   self-assigned this

   on Aug 26, 2026
5. alan-agius4

   linked a pull request that will close this issuefix(@angular-devkit/build-angular): update less to 4.9.0 #33944on Aug 27, 2026
6. alan-agius4

   linked a pull request that will close this issuefix(@angular-devkit/build-angular): update less to 4.9.0 #33943on Aug 27, 2026
7. Czar-Ec commented on Aug 27, 2026

   

   Czar-Ec

   on Aug 27, 2026

   Author

   More actions

   @alan-agius4 yep, thats what I did locally, will wait till this is released
8. alan-agius4

   linked a pull request that will close this issuebuild: update dependency less to v4.9.0 (22.1.x) #33946on Aug 27, 2026
9. alan-agius4

   closed this as completedon Aug 27, 2026
10. alan-agius4

    added 2 commits that reference this issue on Aug 27, 2026

    fix(@angular-devkit/build-angular): update less to 4.9.0

    This issue will close once commit b4059cd is merged into the 'main' branch.

    b4059cd

    fix(@angular-devkit/build-angular): update less to 4.9.0

    This issue will close once commit d3aaa48 is merged into the 'main' branch.

    d3aaa48
11. angular-automatic-lock-bot commented on Oct 20, 2026

    

    angular-automatic-lock-botBot

    on Oct 20, 2026

    More actions

    This issue has been automatically locked due to inactivity.
    Please file a new issue if you are encountering a similar or related problem.

    Read more about our automatic conversation locking policy.

    _{This action has been performed automatically by a bot.}
12. angular-automatic-lock-bot

    locked and limited conversation to collaborators on Oct 20, 2026

Issue actions