Repository navigation
@angular/cli zod vulnerable dependency 22.2.2 #34330
Description
Command
other
Is this a regression?
- Yes, this behavior used to work in the previous version
The previous version in which this bug was not present was
No response
Description
When running Snyk test on my project I get a high risk error.
CVE-2023-54404
npm audit doesn't detect this.
This is an issue detected in Zod 4.6.5. Since @angular/cli explicitly mentions this version in its package.json there's a fix needed here.
Zod itself released a fix already.
Minimal Reproduction
Command: npm run snyk test
Package is zod@4.6.5 that is downloaded via @angular/cli
Exception or Error
Your Environment
Windows 11
$ ng version
_ _ ____ _ ___
/ \ _ __ __ _ _ _| | __ _ _ __ / ___| | |_ _|
/ △ \ | '_ \ / _` | | | | |/ _` | '__| | | | | | |
/ ___ \| | | | (_| | |_| | | (_| | | | |___| |___ | |
/_/ \_\_| |_|\__, |\__,_|_|\__,_|_| \____|_____|___|
|___/
Angular CLI : 22.2.2
Angular : 22.2.2
Node.js : 24.21.0
Package Manager : npm 11.19.0
Operating System : win32 x64
┌───────────────────────────────────┬───────────────────┬───────────────────┐
│ Package │ Installed Version │ Requested Version │
├───────────────────────────────────┼───────────────────┼───────────────────┤
│ @angular/animations │ 22.2.2 │ 22.2.2 │
│ @angular/build │ 22.2.2 │ 22.2.2 │
│ @angular/cdk │ 22.2.2 │ 22.2.2 │
│ @angular/cli │ 22.2.2 │ 22.2.2 │
│ @angular/common │ 22.2.2 │ 22.2.2 │
│ @angular/compiler │ 22.2.2 │ 22.2.2 │
│ @angular/compiler-cli │ 22.2.2 │ 22.2.2 │
│ @angular/core │ 22.2.2 │ 22.2.2 │
│ @angular/forms │ 22.2.2 │ 22.2.2 │
│ @angular/language-service │ 22.2.2 │ 22.2.2 │
│ @angular/material │ 22.2.2 │ 22.2.2 │
│ @angular/material-luxon-adapter │ 22.2.2 │ 22.2.2 │
│ @angular/platform-browser │ 22.2.2 │ 22.2.2 │
│ @angular/platform-browser-dynamic │ 22.2.2 │ 22.2.2 │
│ @angular/router │ 22.2.2 │ 22.2.2 │
│ rxjs │ 7.8.2 │ 7.8.2 │
│ typescript │ 6.0.3 │ 6.0.3 │
│ vitest │ 4.1.11 │ 4.1.11 │
└───────────────────────────────────┴───────────────────┴───────────────────┘
Anything else relevant?
Zod@4.6.7 should fix the vulnerability error
Activity
fix(@angular/cli): update zod to 4.6.6
fix(@angular/cli): update zod to 4.6.6