How to fix vulnerabilities and ensure stability of Angular application dependencies [closed]

To make my application more secure, I conducted an audit report.

I currently have 5 vulnerabilities:

# npm audit report

esbuild <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
fix available via `npm audit fix --force`
Will install @angular-devkit/build-angular@19.2.0, which is a breaking change
node_modules/@angular-devkit/build-angular/node_modules/vite/node_modules/esbuild
node_modules/@angular/build/node_modules/vite/node_modules/esbuild
node_modules/esbuild
@angular-devkit/build-angular 12.2.0-next.0 - 19.2.0-rc.0
Depends on vulnerable versions of @angular/build
Depends on vulnerable versions of @vitejs/plugin-basic-ssl
Depends on vulnerable versions of esbuild
node_modules/@angular-devkit/build-angular
@angular/build *
Depends on vulnerable versions of @vitejs/plugin-basic-ssl
Depends on vulnerable versions of esbuild
Depends on vulnerable versions of vite
node_modules/@angular/build
vite 0.11.0 - 6.1.1
Depends on vulnerable versions of esbuild
node_modules/@angular-devkit/build-angular/node_modules/vite
node_modules/@angular/build/node_modules/vite
@vitejs/plugin-basic-ssl <=1.1.0
Depends on vulnerable versions of vite
node_modules/@angular-devkit/build-angular/node_modules/@vitejs/plugin-basic-ssl
node_modules/@angular/build/node_modules/@vitejs/plugin-basic-ssl

5 moderate severity vulnerabilities


I would always like to keep version 18 because it is stable:

Angular CLI: 18.2.14
Node: 20.11.1
Package Manager: npm 10.2.4
OS: win32 x64

Angular: 18.2.13
... animations, common, compiler, compiler-cli, core, forms
... language-service, localize, platform-browser
... platform-browser-dynamic, router

Package Version
---------------------------------------------------------
@angular-devkit/architect 0.1802.14
@angular-devkit/build-angular 18.2.14
@angular-devkit/core 18.2.14
@angular-devkit/schematics 18.2.14
@angular/cli 18.2.14
@schematics/angular 18.2.14
rxjs 7.8.2
typescript 5.5.4
zone.js 0.14.10


I tried to install the dependencies on npm and I keep getting errors. Do you know the best methods to resolve my vulnerabilities?

Here is my package.json:

"dependencies": {
"@amcharts/amcharts4": "^4.10.22",
"@angular/animations": "^18.0.0",
"@angular/common": "^18.0.0",
"@angular/compiler": "^18.0.0",
"@angular/core": "^18.0.0",
"@angular/forms": "^18.0.0",
"@angular/localize": "^18.0.0",
"@angular/platform-browser": "^18.0.0",
"@angular/platform-browser-dynamic": "^18.0.0",
"@angular/router": "^18.0.0",
"@ng-idle/core": "^14.0.0",
"@ng-idle/keepalive": "^14.0.0",
"@ngneat/transloco": "^3.1.1",
"@ngxs/devtools-plugin": "^18.1.6",
"@ngxs/storage-plugin": "^18.1.6",
"@ngxs/store": "^18.0.0",
"@fortawesome/angular-fontawesome": "^0.10.2",
"@fortawesome/fontawesome-free": "^6.4.0",
"@fortawesome/fontawesome-svg-core": "^6.1.0",
"@fortawesome/free-solid-svg-icons": "^6.1.0",
"bootstrap": "^5.1.3",
"ngx-bootstrap": "^18.0.0",
"ngx-cookie-service": "^18.0.0",
"ngx-extended-pdf-viewer": "^20.0.0",
"typeface-nunito": "^1.1.13",
"pdf-lib": "^1.17.1",
"rxjs": "~7.8.0",
"tslib": "^2.3.0",
"zone.js": "~0.14.3"
},
"devDependencies": {
"@angular-devkit/build-angular": "^18.0.0",
"@angular-eslint/builder": "^18.0.0",
"@angular-eslint/eslint-plugin": "^18.0.0",
"@angular-eslint/eslint-plugin-template": "^18.0.0",
"@angular-eslint/schematics": "^18.0.0",
"@angular-eslint/template-parser": "^18.0.0",
"@angular/cli": "^18.0.0",
"@angular/compiler-cli": "^18.0.0",
"@angular/language-service": "^18.0.0",
"jasmine-core": "~5.1.0",
"@types/node": "^12.20.55",
"karma": "^6.4.0",
"karma-chrome-launcher": "~3.2.0",
"karma-coverage": "~2.2.0",
"karma-jasmine": "~5.1.0",
"karma-jasmine-html-reporter": "~2.1.0",
"@typescript-eslint/eslint-plugin": "^5.35.1",
"@typescript-eslint/parser": "^5.35.1",
"eslint": "^8.0.0",
"typescript": "^5.3.2"
}
}

Continue reading...