From 6f209c26dc5a454acd1cd76f25240c26978fa827 Mon Sep 17 00:00:00 2001
From: Alan Agius <17563226+alan-agius4@users.noreply.github.com>
Date: Thu, 26 Mar 2026 12:44:07 +0000
Subject: [PATCH 1/4] fix(@angular/build): update picomatch to 4.0.4
Update picomatch to address GHSA-c2c7-rcm5-vvqj
---
packages/angular/build/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/packages/angular/build/package.json b/packages/angular/build/package.json
index 2a3a98d341da..a381cc0b780e 100644
--- a/packages/angular/build/package.json
+++ b/packages/angular/build/package.json
@@ -35,7 +35,7 @@
"magic-string": "0.30.17",
"mrmime": "2.0.1",
"parse5-html-rewriting-stream": "8.0.0",
- "picomatch": "4.0.3",
+ "picomatch": "4.0.4",
"piscina": "5.1.3",
"rollup": "4.59.0",
"sass": "1.90.0",
From 5978eeeff63cd62f1515d949eaad0b5e6f7c44cd Mon Sep 17 00:00:00 2001
From: Alan Agius <17563226+alan-agius4@users.noreply.github.com>
Date: Thu, 26 Mar 2026 12:44:12 +0000
Subject: [PATCH 2/4] fix(@angular-devkit/build-angular): update picomatch to
4.0.4
Update picomatch to address GHSA-c2c7-rcm5-vvqj
---
packages/angular_devkit/build_angular/package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/packages/angular_devkit/build_angular/package.json b/packages/angular_devkit/build_angular/package.json
index 0c9a4f13980d..1fc0a9d4bbdd 100644
--- a/packages/angular_devkit/build_angular/package.json
+++ b/packages/angular_devkit/build_angular/package.json
@@ -41,7 +41,7 @@
"mini-css-extract-plugin": "2.9.4",
"open": "10.2.0",
"ora": "8.2.0",
- "picomatch": "4.0.3",
+ "picomatch": "4.0.4",
"piscina": "5.1.3",
"postcss": "8.5.6",
"postcss-loader": "8.1.1",
From 6e9b926129a9dd79f01d47b7446411b8963ffb62 Mon Sep 17 00:00:00 2001
From: Alan Agius <17563226+alan-agius4@users.noreply.github.com>
Date: Thu, 26 Mar 2026 12:48:12 +0000
Subject: [PATCH 3/4] fix(@angular-devkit/core): update picomatch to 4.0.4
Update picomatch to address GHSA-c2c7-rcm5-vvqj
---
packages/angular_devkit/core/package.json | 2 +-
pnpm-lock.yaml | 48 +++++++++++++----------
2 files changed, 28 insertions(+), 22 deletions(-)
diff --git a/packages/angular_devkit/core/package.json b/packages/angular_devkit/core/package.json
index e2daae128bdc..b0fb4f9f0572 100644
--- a/packages/angular_devkit/core/package.json
+++ b/packages/angular_devkit/core/package.json
@@ -28,7 +28,7 @@
"ajv": "8.18.0",
"ajv-formats": "3.0.1",
"jsonc-parser": "3.3.1",
- "picomatch": "4.0.3",
+ "picomatch": "4.0.4",
"rxjs": "7.8.2",
"source-map": "0.7.6"
},
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 7d23f2dbb743..e33567d0a696 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -398,8 +398,8 @@ importers:
specifier: 8.0.0
version: 8.0.0
picomatch:
- specifier: 4.0.3
- version: 4.0.3
+ specifier: 4.0.4
+ version: 4.0.4
piscina:
specifier: 5.1.3
version: 5.1.3
@@ -693,8 +693,8 @@ importers:
specifier: 8.2.0
version: 8.2.0
picomatch:
- specifier: 4.0.3
- version: 4.0.3
+ specifier: 4.0.4
+ version: 4.0.4
piscina:
specifier: 5.1.3
version: 5.1.3
@@ -804,8 +804,8 @@ importers:
specifier: 3.3.1
version: 3.3.1
picomatch:
- specifier: 4.0.3
- version: 4.0.3
+ specifier: 4.0.4
+ version: 4.0.4
rxjs:
specifier: 7.8.2
version: 7.8.2
@@ -7349,6 +7349,10 @@ packages:
resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==}
engines: {node: '>=12'}
+ picomatch@4.0.4:
+ resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
+ engines: {node: '>=12'}
+
pify@2.3.0:
resolution: {integrity: sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==}
engines: {node: '>=0.10.0'}
@@ -11562,10 +11566,10 @@ snapshots:
'@rollup/pluginutils': 5.3.0(rollup@4.59.0)
commondir: 1.0.1
estree-walker: 2.0.2
- fdir: 6.5.0(picomatch@4.0.3)
+ fdir: 6.5.0(picomatch@4.0.4)
is-reference: 1.2.1
magic-string: 0.30.17
- picomatch: 4.0.3
+ picomatch: 4.0.4
optionalDependencies:
rollup: 4.59.0
@@ -11599,7 +11603,7 @@ snapshots:
dependencies:
'@types/estree': 1.0.8
estree-walker: 2.0.2
- picomatch: 4.0.3
+ picomatch: 4.0.4
optionalDependencies:
rollup: 4.59.0
@@ -11607,7 +11611,7 @@ snapshots:
dependencies:
'@types/estree': 1.0.8
estree-walker: 2.0.2
- picomatch: 4.0.3
+ picomatch: 4.0.4
optionalDependencies:
rollup: 4.59.0
@@ -11736,7 +11740,7 @@ snapshots:
eslint-visitor-keys: 4.2.1
espree: 10.4.0
estraverse: 5.3.0
- picomatch: 4.0.3
+ picomatch: 4.0.4
'@tootallnate/once@2.0.0': {}
@@ -14444,9 +14448,9 @@ snapshots:
dependencies:
pend: 1.2.0
- fdir@6.5.0(picomatch@4.0.3):
+ fdir@6.5.0(picomatch@4.0.4):
optionalDependencies:
- picomatch: 4.0.3
+ picomatch: 4.0.4
fetch-blob@3.2.0:
dependencies:
@@ -16594,6 +16598,8 @@ snapshots:
picomatch@4.0.3: {}
+ picomatch@4.0.4: {}
+
pify@2.3.0: {}
pify@3.0.0: {}
@@ -17892,13 +17898,13 @@ snapshots:
tinyglobby@0.2.14:
dependencies:
- fdir: 6.5.0(picomatch@4.0.3)
- picomatch: 4.0.3
+ fdir: 6.5.0(picomatch@4.0.4)
+ picomatch: 4.0.4
tinyglobby@0.2.15:
dependencies:
- fdir: 6.5.0(picomatch@4.0.3)
- picomatch: 4.0.3
+ fdir: 6.5.0(picomatch@4.0.4)
+ picomatch: 4.0.4
tinypool@1.1.1: {}
@@ -18292,8 +18298,8 @@ snapshots:
vite@7.1.11(@types/node@24.9.1)(jiti@1.21.7)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(tsx@4.20.6)(yaml@2.8.1):
dependencies:
esbuild: 0.25.9
- fdir: 6.5.0(picomatch@4.0.3)
- picomatch: 4.0.3
+ fdir: 6.5.0(picomatch@4.0.4)
+ picomatch: 4.0.4
postcss: 8.5.6
rollup: 4.59.0
tinyglobby: 0.2.15
@@ -18310,8 +18316,8 @@ snapshots:
vite@7.1.5(@types/node@24.9.1)(jiti@1.21.7)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(tsx@4.20.6)(yaml@2.8.1):
dependencies:
esbuild: 0.25.9
- fdir: 6.5.0(picomatch@4.0.3)
- picomatch: 4.0.3
+ fdir: 6.5.0(picomatch@4.0.4)
+ picomatch: 4.0.4
postcss: 8.5.6
rollup: 4.59.0
tinyglobby: 0.2.15
From e18c1255e0d718a404bb9409fc07b478ce34d6bd Mon Sep 17 00:00:00 2001
From: Alan Agius <17563226+alan-agius4@users.noreply.github.com>
Date: Fri, 27 Mar 2026 07:47:29 +0000
Subject: [PATCH 4/4] release: cut the v20.3.22 release
---
CHANGELOG.md | 24 ++++++++++++++++++++++++
package.json | 2 +-
2 files changed, 25 insertions(+), 1 deletion(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1bf6e50b2a2a..9fb5cec8cc85 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,27 @@
+
+
+# 20.3.22 (2026-03-27)
+
+### @angular-devkit/build-angular
+
+| Commit | Type | Description |
+| --------------------------------------------------------------------------------------------------- | ---- | ------------------------- |
+| [5978eeeff](https://github.com/angular/angular-cli/commit/5978eeeff63cd62f1515d949eaad0b5e6f7c44cd) | fix | update picomatch to 4.0.4 |
+
+### @angular-devkit/core
+
+| Commit | Type | Description |
+| --------------------------------------------------------------------------------------------------- | ---- | ------------------------- |
+| [6e9b92612](https://github.com/angular/angular-cli/commit/6e9b926129a9dd79f01d47b7446411b8963ffb62) | fix | update picomatch to 4.0.4 |
+
+### @angular/build
+
+| Commit | Type | Description |
+| --------------------------------------------------------------------------------------------------- | ---- | ------------------------- |
+| [6f209c26d](https://github.com/angular/angular-cli/commit/6f209c26dc5a454acd1cd76f25240c26978fa827) | fix | update picomatch to 4.0.4 |
+
+
+
# 20.3.21 (2026-03-19)
diff --git a/package.json b/package.json
index 496d9947a0f4..00812901c745 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "@angular/devkit-repo",
- "version": "20.3.21",
+ "version": "20.3.22",
"private": true,
"description": "Software Development Kit for Angular",
"keywords": [