Angular 19 depends on vulnerable version of Vite

[json-derulo]

Command

other

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

The Angular CLI v19 depends on Vite version 6.2.0, which is vulnerable: GHSA-x574-m823-4x7w

It should be updated to v6.2.3

Minimal Reproduction

Generate a new error with ng new and run npm audit

Exception or Error

Your Environment

Angular CLI: 19.2.4
Node: 22.14.0
Package Manager: npm 11.2.0
OS: darwin arm64

Angular: 19.2.3
... animations, common, compiler, compiler-cli, core, forms
... platform-browser, platform-browser-dynamic, router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1902.4
@angular-devkit/build-angular   19.2.4
@angular-devkit/core            19.2.4
@angular-devkit/schematics      19.2.4
@angular/cdk                    19.2.6
@angular/cli                    19.2.4
@angular/material               19.2.6
@schematics/angular             19.2.4
rxjs                            7.8.2
typescript                      5.8.2
zone.js                         0.15.0

Anything else relevant?

No response