build(deps): bump undici and @angular/build

[dependabot]

Bumps undici to 6.28.0 and updates ancestor dependency @angular/build. These dependencies need to be updated together.

Updates undici from 6.27.0 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

Commits

• 01a912e Bumped v6.28.0 (#5591)
• 481ecfc Use Node 22 and npm 11 to release
• 740a0b7 fix: validate blob body content type
• 2698e49 fix: validate coerced header values for CRLF (#5579)
• 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
• cba3a52 fix(retry): reject partial content length mismatch
• af74840 fix: harden cookie domain, path, and unparsed attribute validation
• See full diff in compare view

Updates @angular/build from 21.2.21 to 22.1.4

Release notes

Sourced from @​angular/build's releases.

22.1.4

@​schematics/angular

Commit	Description
	generate CLAUDE.md for Claude Code instead of AGENTS.md
	import UrlSegment instead of subPath in guard generator

@​angular/cli

Commit	Description
	disable searching current directory for bare executable names on Windows
	serialize configuration as a single argv token in run_target strategies (#33657)
	avoid eager module loading during global bootstrap

@​angular/build

Commit	Description
	count statically imported chunks in the initial total
	normalize setupFiles paths to POSIX for vitest runner
	prevent syntax corruption for Crockford-style enum IIFE
	prevent syntax corruption in oxc transform
	return direct file contents for non-Angular TypeScript files
	return only lowest version per target engine
	set target for Rolldown dependency prebundling in Vite dev server
	avoid encoding the inline source map before remapping
	batch last_accessed updates in sqlite cache store
	hash the i18n inline cache key options once per locale
	optimize template string size calculation in server manifest
	share i18n translations with the inliner workers by reference
	use Map for chunk asset size lookups in budget calculator

@​angular/ssr

Commit	Description
	destroy platform when response stream is cancelled

22.1.3

@​angular/cli

Commit	Description
	always install package during ng add to inspect manifest on disk for schematics (#33718)
	correctly report available package updates during bare ng update
	discover migrations from installed packages when omitted by registry metadata (#33718)
	normalize Windows drive-letter casing for process.cwd

@​angular/build

Commit	Description
	prevent build process hang on unhandled error (#33715)
	retain watch files on error in load result cache
	support case-insensitive and alternative license file names
	release build resources early in non-watch mode (#33715)

@​angular/ssr

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/build's changelog.

22.1.4 (2026-08-13)

@​angular/cli

Commit	Type	Description
67a29899b	fix	disable searching current directory for bare executable names on Windows
1b0ba5c17	fix	serialize configuration as a single argv token in run_target strategies (#33657)
9440432d2	perf	avoid eager module loading during global bootstrap

@​schematics/angular

Commit	Type	Description
d4a48e3ab	fix	generate CLAUDE.md for Claude Code instead of AGENTS.md
d451f15b2	fix	import UrlSegment instead of subPath in guard generator

@​angular/build

Commit	Type	Description
46fcb29d6	fix	count statically imported chunks in the initial total
796b57684	fix	normalize setupFiles paths to POSIX for vitest runner
c805e5cfb	fix	prevent syntax corruption for Crockford-style enum IIFE
cc6c17716	fix	prevent syntax corruption in oxc transform
a142f6f83	fix	return direct file contents for non-Angular TypeScript files
956c6578d	fix	return only lowest version per target engine
689b5b116	fix	set target for Rolldown dependency prebundling in Vite dev server
70461f6ed	perf	avoid encoding the inline source map before remapping
22cce7563	perf	batch last_accessed updates in sqlite cache store
ab2ed18d5	perf	hash the i18n inline cache key options once per locale
34516ff73	perf	optimize template string size calculation in server manifest
712971c37	perf	share i18n translations with the inliner workers by reference
78f8c5fef	perf	use Map for chunk asset size lookups in budget calculator

@​angular/ssr

Commit	Type	Description
2331c1047	fix	destroy platform when response stream is cancelled

Commits

• 46dc10b release: cut the v22.1.4 release
• 7ff0d44 build: update pnpm to v11.21.0
• 9020ddd build: update dependency yargs to v18.1.0
• 039f086 build: lock file maintenance
• 898ce69 ci: limit schematics dependencies rule to minor and patch updates
• 796b576 fix(@​angular/build): normalize setupFiles paths to POSIX for vitest runner
• 2df0e9f build: update esbuild dependencies to v0.28.2
• 587accb build: update cross-repo angular dependencies
• d451f15 fix(@​schematics/angular): import UrlSegment instead of subPath in guard gener...
• a142f6f fix(@​angular/build): return direct file contents for non-Angular TypeScript f...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.