Update @angular/cli@21 dependency @modelcontextprotocol/sdk to 1.30.0 to mitigate GHSA-frvp-7c67-39w9

[cracksalad]

Command

other

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

Excerpt from @angular/cli@21 dependency tree looks like:

@angular/cli@21.2.20
  └─┬ @modelcontextprotocol/sdk@1.26.0
    └── @hono/node-server@1.19.17

Now, @hono/node-server < 2.0.5 is vulnerable to GHSA-frvp-7c67-39w9. The first @modelcontextprotocol/sdk version allowing @hono/node-server@2.0.5 is v1.30.0. So, the probably easiest solution would be to update @modelcontextprotocol/sdk to that version, which is currently fixed to v1.26.0.

Minimal Reproduction

• Install @angular/cli ^21
• run npm audit

Exception or Error

Transitive dependency @hono/node-server vulnerable to GHSA-frvp-7c67-39w9

Your Environment

     _                      _                 ____ _     ___
    / \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|
   / △ \ | '_ \ / _` | | | | |/ _` | '__|   | |   | |    | |
  / ___ \| | | | (_| | |_| | | (_| | |      | |___| |___ | |
 /_/   \_\_| |_|\__, |\__,_|_|\__,_|_|       \____|_____|___|
                |___/
    

Angular CLI       : 21.2.19
Angular           : 21.2.19
Node.js           : 24.19.0
Package Manager   : npm 11.19.0
Operating System  : linux x64

┌───────────────────────────────────┬───────────────────┬───────────────────┐
│ Package                           │ Installed Version │ Requested Version │
├───────────────────────────────────┼───────────────────┼───────────────────┤
│ @angular/build                    │ 21.2.19           │ ^21.2.19          │
│ @angular/cdk                      │ 21.2.14           │ ^21.2.14          │
│ @angular/cli                      │ 21.2.19           │ ^21.2.19          │
│ @angular/common                   │ 21.2.19           │ ^21.2.19          │
│ @angular/compiler                 │ 21.2.19           │ ^21.2.19          │
│ @angular/compiler-cli             │ 21.2.19           │ ^21.2.19          │
│ @angular/core                     │ 21.2.19           │ ^21.2.19          │
│ @angular/elements                 │ 21.2.19           │ ^21.2.19          │
│ @angular/forms                    │ 21.2.19           │ ^21.2.19          │
│ @angular/platform-browser         │ 21.2.19           │ ^21.2.19          │
│ @angular/platform-browser-dynamic │ 21.2.19           │ ^21.2.19          │
│ @angular/router                   │ 21.2.19           │ ^21.2.19          │
│ @angular/service-worker           │ 21.2.19           │ ^21.2.19          │
│ ng-packagr                        │ 21.2.6            │ ^21.2             │
│ rxjs                              │ 7.8.2             │ ^7.8.2            │
│ typescript                        │ 5.9.3             │ ^5.9.3 || ^6      │
│ vitest                            │ 4.1.10            │ ^4.1.7            │
│ zone.js                           │ 0.16.2            │ ^0.15 || ^0.16    │
└───────────────────────────────────┴───────────────────┴───────────────────┘

Anything else relevant?

No response