title: Vulnerability in glob-parent : angular-devkit, angular-compiler, eslint - does it compromise prod build?
body: <p>I have vulnerability reported by npm audit in <code>glob-parent</code> package.</p>
  <p>When I run <code>npm ls glob-parent</code> I get this:</p>
  <pre><code>+-- @angular-devkit/build-angular@12.1.0
  | +-- copy-webpack-plugin@9.0.0
  | | +-- fast-glob@3.2.6
  | | | `-- glob-parent@5.1.2
  | | `-- glob-parent@6.0.0 deduped
  | `-- webpack-dev-server@3.11.2
  |   `-- chokidar@2.1.8
  |     `-- glob-parent@3.1.0
  +-- @angular/compiler-cli@12.1.1
  | `-- chokidar@3.5.2
  |   `-- glob-parent@5.1.2
  +-- eslint@7.29.0
  | `-- glob-parent@5.1.2
  `-- glob-parent@6.0.0
  </code></pre>
  <p>I read it as this glob-parent is being used in</p>
  <pre><code>@angular-devkit/build-angular
  @angular/compiler-cli
  eslint
  </code></pre>
  <p>Is my understanding correct?</p>
  <p>If yes when my question is - <strong>are these packages used in a prod environment (I mean devkit, compiler, lint - doesnt sound like they are needed after the app is build)?</strong></p>
  <p>Or more simply - <strong>will the glob-parent vulnerability expose my prod system anyhow?</strong></p>
  <p>Versions:</p>
  <pre><code>Angular CLI: 12.1.0
  Node: 14.17.0
  Package Manager: npm 7.14.0
  OS: win32 x64
  
  Angular: 12.1.0
  ... animations, cli, common, compiler, core, forms
  ... platform-browser, platform-browser-dynamic, platform-server
  ... router
  
  Package                         Version
  ---------------------------------------------------------
  @angular-devkit/architect       0.1201.0
  @angular-devkit/build-angular   12.1.0
  @angular-devkit/core            12.1.0
  @angular-devkit/schematics      12.1.0
  @angular/compiler-cli           12.1.1
  @angular/language-service       12.1.1
  @schematics/angular             12.1.0
  rxjs                            6.6.7
  typescript                      4.2.4
  </code></pre>