fix(deps): update angular-cli monorepo to v19.2.23

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@angular-devkit/core	19.2.17 → 19.2.23
@angular-devkit/schematics	19.2.17 → 19.2.23

---

Release Notes

angular/angular-cli (@​angular-devkit/core)

v19.2.23

Compare Source

@​angular/cli

Commit	Type	Description
67cfbe32f	fix	update picomatch to 4.0.4

@​angular-devkit/build-angular

Commit	Type	Description
771b979e7	fix	update picomatch to 4.0.4

@​angular-devkit/core

Commit	Type	Description
de2da4874	fix	update picomatch to 4.0.4

@​angular/build

Commit	Type	Description
27a9ce4a7	fix	update picomatch to 4.0.4

v19.2.22

Compare Source

@​angular-devkit/core

Commit	Type	Description
0a01aecd9	fix	update ajv to 8.18.0

@​angular/build

Commit	Type	Description
79f59412a	fix	update rollup to 4.59.0

v19.2.21

Compare Source

@​angular/ssr

Commit	Type	Description
288e22816	fix	prevent open redirect via X-Forwarded-Prefix header
2a72d7483	fix	validate host headers to prevent header-based SSRF

v19.2.20

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
0e5421ba7	fix	update webpack to 5.105.0

v19.2.19

Compare Source

@​angular/build

Commit	Type	Description
4d8ea27a1	fix	update vite to v6.4.1

v19.2.18

Compare Source

@​angular/ssr

Commit	Type	Description
9136a5d13	fix	prevent malicious URL from overriding host

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[raheel-iso365]

Is this getting closed anytime soon?

npm audit
# npm audit report

ajv  7.0.0-alpha.0 - 8.17.1
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6

Which is coming from @angular-devkit/core@19.2.19:

npm ls ajv@8.17

├─┬ @nestjs/cli@11.0.16
│ └─┬ @angular-devkit/core@19.2.19
│   └── ajv@8.17.1
└─┬ @nestjs/schematics@11.0.9
  └─┬ @angular-devkit/core@19.2.17
    └── ajv@8.17.1

[SchroederSteffen]

Related:

• fix(deps): update angular-cli monorepo to v19.2.23 nest-cli#3274

[Timur2915]

@kamilmysliwiec could you please take a look at this PR?

Is this getting closed anytime soon?

npm audit
# npm audit report

ajv  7.0.0-alpha.0 - 8.17.1
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6

Which is coming from @angular-devkit/core@19.2.19:

npm ls ajv@8.17

├─┬ @nestjs/cli@11.0.16
│ └─┬ @angular-devkit/core@19.2.19
│   └── ajv@8.17.1
└─┬ @nestjs/schematics@11.0.9
  └─┬ @angular-devkit/core@19.2.17
    └── ajv@8.17.1

[prateekkathal]

@kamilmysliwiec Can we please release a new v11 update for this? Thank you!

[prateekkathal]

This PR now also fixes GHSA-c2c7-rcm5-vvqj:

picomatch  <=2.3.1 || 4.0.0 - 4.0.3
Severity: high
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj