chore(deps): bump undici and @angular/build

[dependabot]

Bumps undici and @angular/build. These dependencies needed to be updated together.
Updates undici from 7.22.0 to 7.24.4

Release notes

Sourced from undici's releases.

v7.24.4

What's Changed

• fix(fetch): handle URL credentials in dispatch path extraction by @​mcollina in nodejs/undici#4892

Full Changelog: nodejs/undici@v7.24.3...v7.24.4

v7.24.3

What's Changed

• fix(h2): TypeError: Cannot read properties of null (reading 'push') i… by @​hxinhan in nodejs/undici#4881

Full Changelog: nodejs/undici@v7.24.2...v7.24.3

v7.24.2

What's Changed

• fix fetch path logic by @​KhafraDev in nodejs/undici#4890
• remove maxDecompressedMessageSize by @​KhafraDev in nodejs/undici#4891

Full Changelog: nodejs/undici@v7.24.1...v7.24.2

v7.24.1

What's Changed

• fix: proto pollution by @​rahulyadav5524 in nodejs/undici#4885

Full Changelog: nodejs/undici@v7.24.0...v7.24.1

v7.24.0

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

• GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
  Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

• GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
  Malicious WebSocket 64-bit frame length handling could crash the client.

• GHSA-phc3-fgpg-7m6h / CVE-2026-2581 (Medium)
  Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).

• GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)

... (truncated)

Commits

• 4991f3e Bumped v7.24.4
• ea3a06d fix(fetch): preserve path for credentialed URLs (#4892)
• 9b96516 Bumped v7.24.3
• 7926660 Ignore .githuman
• 9eaa5af fix(h2): TypeError: Cannot read properties of null (reading 'push') in Reques...
• a9bfe21 ignore .pi
• f2e155b Bumped v7.24.2
• 4d2d1af remove maxDecompressedMessageSize (#4891)
• 3a05a4f fix fetch path logic (#4890)
• 23e3cd3 Bumped v7.24.1
• Additional commits viewable in compare view

Updates @angular/build from 21.1.4 to 21.2.11

Release notes

Sourced from @​angular/build's releases.

21.2.11

@​angular/cli

Commit	Description
	robustly parse npm manifest from array

@​angular/ssr

Commit	Description
	allow all hosts in common engine rendering options to prevent validation errors
	remove stateful flag from URL_PARAMETER_REGEXP

21.2.10

@​angular/cli

Commit	Description
	restrict MCP workspace access to allowed client roots during resolution

21.2.9

@​schematics/angular

Commit	Description
	add missing imports for focus and skip APIs in refactor-jasmine-vitest

@​angular/cli

Commit	Description
	fix broken img ref in ai-tutor
	introduce initial package manager workspace awareness
	remove standalone true ref in ai tutor

@​angular/ssr

Commit	Description
	introduce trustProxyHeaders option to safely validate and sanitize proxy headers
	add support for configuring trusted proxy headers via environment variable
	decode route segments when building and matching route tree
	use router to normalize URLs for comparison

21.2.8

@​angular/cli

Commit	Description
	dynamically resolve project Angular CLI executable inside MCP tools
	ignore EBADF file system errors during MCP project scan
	use headless option in MCP test tool

@​angular-devkit/build-angular

Commit	Description
	ensure route has leading slash in prerender builder
	fix app-shell route format and

@​angular/build

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/build's changelog.

21.2.11 (2026-05-13)

@​angular/cli

Commit	Type	Description
bbd63b7a5	fix	robustly parse npm manifest from array

@​angular/ssr

Commit	Type	Description
eafe1a719	fix	allow all hosts in common engine rendering options to prevent validation errors
7a116a80d	fix	remove stateful flag from URL_PARAMETER_REGEXP

20.3.26 (2026-05-13)

@​angular/ssr

Commit	Type	Description
7cc1871ee	fix	allow all hosts in common engine rendering options to prevent validation errors

19.2.26 (2026-05-13)

@​angular/ssr

Commit	Type	Description
842fee029	fix	allow all hosts in common engine rendering options to prevent validation errors

21.2.10 (2026-05-06)

@​angular/cli

Commit	Type	Description
bb8611913	fix	restrict MCP workspace access to allowed client roots during resolution

... (truncated)

Commits

• 00e3663 release: cut the v21.2.11 release
• eafe1a7 fix(@​angular/ssr): allow all hosts in common engine rendering options to prev...
• 7a116a8 fix(@​angular/ssr): remove stateful flag from URL_PARAMETER_REGEXP
• a7705fb build: update cross-repo angular dependencies
• 453ed5b build: update github/codeql-action action to v4.35.4
• f0f9b2d refactor(@​angular/cli): add validation and logging to npm manifest parsing
• bbd63b7 fix(@​angular/cli): robustly parse npm manifest from array
• 64cbd62 release: cut the v21.2.10 release
• 6f26f4f build: lock file maintenance
• 111dcc3 refactor(@​angular/cli): re-add resolveModule for find examples tool
• Additional commits viewable in compare view

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.0%. Comparing base (272a13f) to head (426ebac).

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #1310     +/-   ##
=======================================
- Coverage   66.0%   66.0%   -0.1%     
=======================================
  Files        336     336             
  Lines       9868    9868             
  Branches    1296    1297      +1     
=======================================
- Hits        6516    6514      -2     
- Misses      2975    2976      +1     
- Partials     377     378      +1     

see 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dependabot]

Superseded by #1320.