diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4786dc380b..3fb6a4f524 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -170,7 +170,7 @@ jobs:
           ./scripts/saucelabs/wait-for-tunnel.sh
           yarn bazel test --config=saucelabs //tests/legacy-cli:e2e.saucelabs
           ./scripts/saucelabs/stop-tunnel.sh
-      - uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
+      - uses: actions/upload-artifact@84480863f228bb9747b473957fcc9e309aa96097 # v4.4.2
         if: ${{ failure() }}
         with:
           name: sauce-connect-log
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index cf4ff9b087..ca8ee7074a 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Initialize environment
         uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@46771fcd70e08e7ba3c30f4ee9ebf9971b7fdb5c
       - name: Setup ESLint Caching
-        uses: actions/cache@2cdf405574d6ef1f33a1d12acccd3ae82f47b3f2 # v4.1.0
+        uses: actions/cache@3624ceb22c1c5a301c8db4169662070a689d9ea8 # v4.1.1
         with:
           path: .eslintcache
           key: ${{ runner.os }}-${{ hashFiles('.eslintrc.json') }}
@@ -80,7 +80,7 @@ jobs:
       - name: Build release targets
         run: yarn ng-dev release build
       - name: Store PR release packages
-        uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
+        uses: actions/upload-artifact@84480863f228bb9747b473957fcc9e309aa96097 # v4.4.2
         with:
           name: packages
           path: dist/releases/*.tgz
diff --git a/package.json b/package.json
index 0e980e7436..31ac7621a4 100644
--- a/package.json
+++ b/package.json
@@ -138,7 +138,7 @@
     "eslint-config-prettier": "9.1.0",
     "eslint-plugin-header": "3.1.1",
     "eslint-plugin-import": "2.31.0",
-    "express": "4.21.0",
+    "express": "4.21.1",
     "fast-glob": "3.3.2",
     "http-proxy": "^1.18.1",
     "http-proxy-middleware": "3.0.3",
@@ -200,7 +200,7 @@
     "ts-node": "^10.9.1",
     "tslib": "2.7.0",
     "typescript": "5.6.2",
-    "undici": "6.19.8",
+    "undici": "6.20.0",
     "unenv": "^1.10.0",
     "verdaccio": "6.0.0",
     "verdaccio-auth-memory": "^10.0.0",
diff --git a/packages/angular_devkit/build_angular/package.json b/packages/angular_devkit/build_angular/package.json
index 5f5b513a42..e7b316eb39 100644
--- a/packages/angular_devkit/build_angular/package.json
+++ b/packages/angular_devkit/build_angular/package.json
@@ -73,7 +73,7 @@
     "esbuild": "0.24.0"
   },
   "devDependencies": {
-    "undici": "6.19.8"
+    "undici": "6.20.0"
   },
   "peerDependencies": {
     "@angular/compiler-cli": "^19.0.0-next.0",
diff --git a/yarn.lock b/yarn.lock
index 367d764f2a..46a9fbaa15 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -115,7 +115,7 @@ __metadata:
     terser: "npm:5.34.1"
     tree-kill: "npm:1.2.2"
     tslib: "npm:2.7.0"
-    undici: "npm:6.19.8"
+    undici: "npm:6.20.0"
     vite: "npm:5.4.8"
     watchpack: "npm:2.4.2"
     webpack: "npm:5.95.0"
@@ -718,7 +718,7 @@ __metadata:
     eslint-config-prettier: "npm:9.1.0"
     eslint-plugin-header: "npm:3.1.1"
     eslint-plugin-import: "npm:2.31.0"
-    express: "npm:4.21.0"
+    express: "npm:4.21.1"
     fast-glob: "npm:3.3.2"
     http-proxy: "npm:^1.18.1"
     http-proxy-middleware: "npm:3.0.3"
@@ -780,7 +780,7 @@ __metadata:
     ts-node: "npm:^10.9.1"
     tslib: "npm:2.7.0"
     typescript: "npm:5.6.2"
-    undici: "npm:6.19.8"
+    undici: "npm:6.20.0"
     unenv: "npm:^1.10.0"
     verdaccio: "npm:6.0.0"
     verdaccio-auth-memory: "npm:^10.0.0"
@@ -8217,6 +8217,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"cookie@npm:0.7.1":
+  version: 0.7.1
+  resolution: "cookie@npm:0.7.1"
+  checksum: 10c0/5de60c67a410e7c8dc8a46a4b72eb0fe925871d057c9a5d2c0e8145c4270a4f81076de83410c4d397179744b478e33cd80ccbcc457abf40a9409ad27dcd21dde
+  languageName: node
+  linkType: hard
+
 "cookie@npm:~0.4.1":
   version: 0.4.2
   resolution: "cookie@npm:0.4.2"
@@ -9914,6 +9921,45 @@ __metadata:
   languageName: node
   linkType: hard
 
+"express@npm:4.21.1":
+  version: 4.21.1
+  resolution: "express@npm:4.21.1"
+  dependencies:
+    accepts: "npm:~1.3.8"
+    array-flatten: "npm:1.1.1"
+    body-parser: "npm:1.20.3"
+    content-disposition: "npm:0.5.4"
+    content-type: "npm:~1.0.4"
+    cookie: "npm:0.7.1"
+    cookie-signature: "npm:1.0.6"
+    debug: "npm:2.6.9"
+    depd: "npm:2.0.0"
+    encodeurl: "npm:~2.0.0"
+    escape-html: "npm:~1.0.3"
+    etag: "npm:~1.8.1"
+    finalhandler: "npm:1.3.1"
+    fresh: "npm:0.5.2"
+    http-errors: "npm:2.0.0"
+    merge-descriptors: "npm:1.0.3"
+    methods: "npm:~1.1.2"
+    on-finished: "npm:2.4.1"
+    parseurl: "npm:~1.3.3"
+    path-to-regexp: "npm:0.1.10"
+    proxy-addr: "npm:~2.0.7"
+    qs: "npm:6.13.0"
+    range-parser: "npm:~1.2.1"
+    safe-buffer: "npm:5.2.1"
+    send: "npm:0.19.0"
+    serve-static: "npm:1.16.2"
+    setprototypeof: "npm:1.2.0"
+    statuses: "npm:2.0.1"
+    type-is: "npm:~1.6.18"
+    utils-merge: "npm:1.0.1"
+    vary: "npm:~1.1.2"
+  checksum: 10c0/0c287867e5f6129d3def1edd9b63103a53c40d4dc8628839d4b6827e35eb8f0de5a4656f9d85f4457eba584f9871ebb2ad26c750b36bd75d9bbb8bcebdc4892c
+  languageName: node
+  linkType: hard
+
 "extend@npm:^3.0.0, extend@npm:~3.0.2":
   version: 3.0.2
   resolution: "extend@npm:3.0.2"
@@ -17624,10 +17670,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"undici@npm:6.19.8":
-  version: 6.19.8
-  resolution: "undici@npm:6.19.8"
-  checksum: 10c0/07fd8520bce7e34ea29c07ef0de27b734183042cdb4e2f1262cd1fb9b755a6b04ff2471040395dfb1770fb7786069a97c5178bcf706b80a34075994f46feb37c
+"undici@npm:6.20.0":
+  version: 6.20.0
+  resolution: "undici@npm:6.20.0"
+  checksum: 10c0/b74a6e4dcdfc3a6e7f5eab77c24f598c5a8664091797dc4940f86e1ed27e5dc9bef390aa1ecf53f20c7ec0e8809bc3d1518a8c3c560fa5972a6a325d628765be
   languageName: node
   linkType: hard