From d4e07cb3e3f871822f9bf37fdea35814ec1cdb80 Mon Sep 17 00:00:00 2001
From: Alan Agius <17563226+alan-agius4@users.noreply.github.com>
Date: Thu, 9 Jul 2026 14:02:04 +0000
Subject: [PATCH 1/2] fix(@angular-devkit/build-angular): update
http-proxy-middleware to 3.0.7
This updates http-proxy-middleware to version 3.0.7 to address a security vulnerability.
CVE-2026-55603.
Fixes #33534
---
package.json | 2 +-
.../angular_devkit/build_angular/package.json | 2 +-
pnpm-lock.yaml | 16 ++++++++--------
3 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/package.json b/package.json
index 6573d937b349..9a1b65754a02 100644
--- a/package.json
+++ b/package.json
@@ -110,7 +110,7 @@
"fast-glob": "3.3.3",
"globals": "16.3.0",
"http-proxy": "^1.18.1",
- "http-proxy-middleware": "3.0.5",
+ "http-proxy-middleware": "3.0.7",
"husky": "9.1.7",
"jasmine": "~5.9.0",
"jasmine-core": "~5.9.0",
diff --git a/packages/angular_devkit/build_angular/package.json b/packages/angular_devkit/build_angular/package.json
index 9b6cab0f72d8..67d7e8137723 100644
--- a/packages/angular_devkit/build_angular/package.json
+++ b/packages/angular_devkit/build_angular/package.json
@@ -30,7 +30,7 @@
"css-loader": "7.1.2",
"esbuild-wasm": "0.28.1",
"fast-glob": "3.3.3",
- "http-proxy-middleware": "3.0.5",
+ "http-proxy-middleware": "3.0.7",
"istanbul-lib-instrument": "6.0.3",
"jsonc-parser": "3.3.1",
"karma-source-map-support": "1.4.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 4ab2af4b1f02..a0b320169c6f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -212,8 +212,8 @@ importers:
specifier: ^1.18.1
version: 1.18.1(debug@4.4.3)
http-proxy-middleware:
- specifier: 3.0.5
- version: 3.0.5
+ specifier: 3.0.7
+ version: 3.0.7
husky:
specifier: 9.1.7
version: 9.1.7
@@ -660,8 +660,8 @@ importers:
specifier: 3.3.3
version: 3.3.3
http-proxy-middleware:
- specifier: 3.0.5
- version: 3.0.5
+ specifier: 3.0.7
+ version: 3.0.7
istanbul-lib-instrument:
specifier: 6.0.3
version: 6.0.3
@@ -6248,9 +6248,9 @@ packages:
'@types/express':
optional: true
- http-proxy-middleware@3.0.5:
- resolution: {integrity: sha512-GLZZm1X38BPY4lkXA01jhwxvDoOkkXqjgVyUzVxiEK4iuRu03PZoYHhHRwxnfhQMDuaxi3vVri0YgSro/1oWqg==}
- engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+ http-proxy-middleware@3.0.7:
+ resolution: {integrity: sha512-iwbQltVlx8bCrqePUM8C+hllHvdawVhQJaLrj1X7qllkvFQdXFsr16pW/mo9+JDVjN+QO2XUx9jd8SmoFkE5qw==}
+ engines: {node: ^14.18.0 || ^16.10.0 || >=18.0.0}
http-proxy@1.18.1:
resolution: {integrity: sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==}
@@ -15981,7 +15981,7 @@ snapshots:
transitivePeerDependencies:
- debug
- http-proxy-middleware@3.0.5:
+ http-proxy-middleware@3.0.7:
dependencies:
'@types/http-proxy': 1.17.16
debug: 4.4.3(supports-color@10.2.2)
From ed8f6ff8f1de02bb9175be92e565b720de8b3bd6 Mon Sep 17 00:00:00 2001
From: Charles Lyding <19598772+clydin@users.noreply.github.com>
Date: Thu, 9 Jul 2026 11:35:32 -0400
Subject: [PATCH 2/2] release: cut the v20.3.32 release
---
CHANGELOG.md | 12 ++++++++++++
package.json | 2 +-
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4fe066e425ee..0afd357fb722 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,15 @@
+
+
+# 20.3.32 (2026-07-09)
+
+### @angular-devkit/build-angular
+
+| Commit | Type | Description |
+| --------------------------------------------------------------------------------------------------- | ---- | ------------------------------------- |
+| [d4e07cb3e](https://github.com/angular/angular-cli/commit/d4e07cb3e3f871822f9bf37fdea35814ec1cdb80) | fix | update http-proxy-middleware to 3.0.7 |
+
+
+
# 20.3.31 (2026-07-01)
diff --git a/package.json b/package.json
index 9a1b65754a02..3620754df836 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "@angular/devkit-repo",
- "version": "20.3.31",
+ "version": "20.3.32",
"private": true,
"description": "Software Development Kit for Angular",
"keywords": [