build(deps): bump undici and @angular/build

[dependabot]

Bumps undici to 6.28.0 and updates ancestor dependency @angular/build. These dependencies need to be updated together.

Updates undici from 6.27.0 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

Commits

• 01a912e Bumped v6.28.0 (#5591)
• 481ecfc Use Node 22 and npm 11 to release
• 740a0b7 fix: validate blob body content type
• 2698e49 fix: validate coerced header values for CRLF (#5579)
• 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
• cba3a52 fix(retry): reject partial content length mismatch
• af74840 fix: harden cookie domain, path, and unparsed attribute validation
• See full diff in compare view

Updates @angular/build from 21.2.21 to 22.1.5

Release notes

Sourced from @​angular/build's releases.

22.1.5

@​schematics/angular

Commit	Description
	transform fail() to expect.fail() in refactor-jasmine-vitest

@​angular/cli

Commit	Description
	enforce MCP roots in get_best_practices tool
	handle errors from isAllowedWorkspacePath in best-practices tool
	throw on out-of-roots workspace in best-practices tool

@​angular/build

Commit	Description
	correct misleading error message for top-level await
	disable code splitting for unit test builds
	preserve integrity and crossorigin in autoCsp loader
	traverse AST with iterative post-order walker in i18n inliner

22.1.4

@​schematics/angular

Commit	Description
	generate CLAUDE.md for Claude Code instead of AGENTS.md
	import UrlSegment instead of subPath in guard generator

@​angular/cli

Commit	Description
	disable searching current directory for bare executable names on Windows
	serialize configuration as a single argv token in run_target strategies (#33657)
	avoid eager module loading during global bootstrap

@​angular/build

Commit	Description
	count statically imported chunks in the initial total
	normalize setupFiles paths to POSIX for vitest runner
	prevent syntax corruption for Crockford-style enum IIFE
	prevent syntax corruption in oxc transform
	return direct file contents for non-Angular TypeScript files
	return only lowest version per target engine
	set target for Rolldown dependency prebundling in Vite dev server
	avoid encoding the inline source map before remapping
	batch last_accessed updates in sqlite cache store
	hash the i18n inline cache key options once per locale
	optimize template string size calculation in server manifest
	share i18n translations with the inliner workers by reference
	use Map for chunk asset size lookups in budget calculator

@​angular/ssr

Commit	Description

... (truncated)

Changelog

Sourced from @​angular/build's changelog.

22.1.5 (2026-08-19)

@​angular/cli

Commit	Type	Description
e672271f8	fix	enforce MCP roots in get_best_practices tool
a14916cc4	fix	handle errors from isAllowedWorkspacePath in best-practices tool
d6e1cddff	fix	throw on out-of-roots workspace in best-practices tool

@​schematics/angular

Commit	Type	Description
ba2b0e4c2	fix	transform fail() to expect.fail() in refactor-jasmine-vitest

@​angular/build

Commit	Type	Description
cba72902d	fix	correct misleading error message for top-level await
b4679998c	fix	disable code splitting for unit test builds
ff1d3565e	fix	preserve integrity and crossorigin in autoCsp loader
1fc1fb05c	perf	traverse AST with iterative post-order walker in i18n inliner

22.2.0-next.3 (2026-08-13)

@​angular/cli

Commit	Type	Description
7106676e6	fix	disable searching current directory for bare executable names on Windows
ecf8c0822	fix	serialize configuration as a single argv token in run_target strategies (#33657)
2e4dd90c3	perf	avoid eager module loading during global bootstrap

@​schematics/angular

Commit	Type	Description
1161e6c99	fix	generate CLAUDE.md for Claude Code instead of AGENTS.md
c536ae364	fix	import UrlSegment instead of subPath in guard generator

@​angular/build

Commit	Type	Description

... (truncated)

Commits

• 3954730 release: cut the v22.1.5 release
• 7b7064f build: update dependency listr2 to v11
• 262562d docs: mention Vitest instead of Karma in README template of schematic library...
• 712e74e build: lock file maintenance
• 93d9cff refactor(@​angular-devkit/schematics): add missing comma to reordered componen...
• 528114c refactor(@​angular-devkit/schematics): add consistent spacing and ordering
• cba7290 fix(@​angular/build): correct misleading error message for top-level await
• 0e36040 build: update pnpm to v11.22.0
• d01d2c6 build: update cross-repo angular dependencies
• ba2b0e4 fix(@​schematics/angular): transform fail() to expect.fail() in refactor-jasmi...
• Additional commits viewable in compare view

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.