build(deps): bump undici and @angular/build

[dependabot]

Bumps undici to 6.28.0 and updates ancestor dependency @angular/build. These dependencies need to be updated together.

Updates undici from 6.27.0 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

Commits

• 01a912e Bumped v6.28.0 (#5591)
• 481ecfc Use Node 22 and npm 11 to release
• 740a0b7 fix: validate blob body content type
• 2698e49 fix: validate coerced header values for CRLF (#5579)
• 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
• cba3a52 fix(retry): reject partial content length mismatch
• af74840 fix: harden cookie domain, path, and unparsed attribute validation
• See full diff in compare view

Updates @angular/build from 21.2.19 to 22.1.3

Release notes

Sourced from @​angular/build's releases.

22.1.3

@​angular/cli

Commit	Description
	always install package during ng add to inspect manifest on disk for schematics (#33718)
	correctly report available package updates during bare ng update
	discover migrations from installed packages when omitted by registry metadata (#33718)
	normalize Windows drive-letter casing for process.cwd

@​angular/build

Commit	Description
	prevent build process hang on unhandled error (#33715)
	retain watch files on error in load result cache
	support case-insensitive and alternative license file names
	release build resources early in non-watch mode (#33715)

@​angular/ssr

Commit	Description
	settle writeResponseToNodeResponse when client disconnects
	avoid buffering request body when sanitizing headers

22.1.2

@​angular/cli

Commit	Description
	add packages with built-in schematics to devDependencies only

@​angular/build

Commit	Description
	prevent IIFE wrapper interleaving for adjacent classes in minified files

22.1.1

@​angular/cli

Commit	Description
	support npm 12 metadata array and error formats

@​angular/build

Commit	Description
	rewrite paths from sandboxed execroots when running under Bazel

22.1.0

@​angular/cli

Commit	Description
	abort and guide manual mitigation when updating catalog packages
	prevent Yarn registry environment variable override
	remove algoliasearch dependency and support latest docs versions
	resolve correct registry name when using npm alias syntax during update
	respect client-side release age settings during update resolution

... (truncated)

Changelog

Sourced from @​angular/build's changelog.

22.1.3 (2026-08-05)

@​angular/cli

Commit	Type	Description
f837b788c6	fix	always install package during ng add to inspect manifest on disk for schematics (#33718)
72ae93638d	fix	correctly report available package updates during bare ng update
a949e06568	fix	discover migrations from installed packages when omitted by registry metadata (#33718)
1d9122fd50	fix	normalize Windows drive-letter casing for process.cwd

@​angular/build

Commit	Type	Description
a4860d505a	fix	prevent build process hang on unhandled error (#33715)
7686d66cab	fix	retain watch files on error in load result cache
25b7cf7504	fix	support case-insensitive and alternative license file names
4fd81402ce	perf	release build resources early in non-watch mode (#33715)

@​angular/ssr

Commit	Type	Description
6af906cb94	fix	settle writeResponseToNodeResponse when client disconnects
917d3b2254	perf	avoid buffering request body when sanitizing headers

21.2.20 (2026-08-05)

@​angular-devkit/build-angular

Commit	Type	Description
972f6db7e9	fix	upgrade postcss to 8.5.23

@​angular/build

Commit	Type	Description
8de75ada50	fix	upgrade postcss to 8.5.23

20.3.33 (2026-08-05)

... (truncated)

Commits

• 60078fc release: cut the v22.1.3 release
• 434e070 refactor(@​angular/cli): remove unused eslint-disable comment in git utility
• 3a49bd4 build: update pnpm to v11.20.0
• 7686d66 fix(@​angular/build): retain watch files on error in load result cache
• 1d9122f fix(@​angular/cli): normalize Windows drive-letter casing for process.cwd
• 4e54f3a ci: schedule ng-snapshot Renovate updates for early morning only
• 6f75b73 build: update cross-repo angular dependencies
• 25b7cf7 fix(@​angular/build): support case-insensitive and alternative license file names
• 212373a build: lock file maintenance
• 74d6d0b build: update dependency postcss to v8.5.25
• Additional commits viewable in compare view

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.