Update dependency @angular/core [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/core (source)	^6.0.0-rc.0 || ^6.0.0 → ^6.0.0-rc.0 || ^6.0.0 || ^22.0.0
@angular/core (source)	7.2.12 → 10.2.5

---

Angular vulnerable to Cross-site Scripting

CVE-2021-4231 / GHSA-c75v-2vq8-878f

More information

Details

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 10.2.5, 11.0.5 or 11.1.0-next.3 is advised to to address this issue.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-4231
• https://github.com/angular/angular/issues/40136
• https://github.com/angular/angular/commit/ba8da742e3b243e8f43d4c63aa842b44e14f2b09
• https://security.snyk.io/vuln/SNYK-JS-ANGULARCORE-1070902
• https://vuldb.com/?id.181356
• https://github.com/angular/angular/commit/0aa220bc0000fc4d1651ec388975bbf5baa1da36
• https://github.com/angular/angular/commit/47d9b6d72dab9d60c96bc1c3604219f6385649ea
• https://github.com/advisories/GHSA-c75v-2vq8-878f

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/core)

v22.0.5

Compare Source

common

Commit	Type	Description
eb8fb9fe58	fix	use Object.hasOwn in I18nSelectPipe to handle null-prototype and shadowed mappings

compiler-cli

Commit	Type	Description
baf09a9939	fix	include toSignal in debugName transform

core

Commit	Type	Description
e598dc843f	fix	improve input writes migration in best effort mode
ced0180b06	fix	reject dynamic script host elements

router

Commit	Type	Description
ca13b42e7c	fix	fix malformed jsdoc comment for RouterLinkWithHref export

v22.0.4

Compare Source

migrations

Commit	Type	Description
fd37f09f37	fix	resolve migration failure when tsconfig specifies rootDir

v22.0.3

Compare Source

compiler

Commit	Type	Description
f90c20df40	fix	account for NgModule dependencies in JIT-compiled partial declarations
f4f7f3755c	fix	remove unused import breaking CI in 22.0.x

compiler-cli

Commit	Type	Description
06d854929c	fix	report diagnostic instead of crashing on malformed host binding

core

Commit	Type	Description
2799304259	fix	avoid uncaught promise errors in injectAsync prefetching

http

Commit	Type	Description
8cdc202dfc	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
b4a5a2fb4e	fix	preserve referrer in asset requests
a16f9b2263	fix	preserve referrer policy in asset requests

upgrade

Commit	Type	Description
bcc648f4b6	fix	support model() signals in downgradeComponent

v22.0.2

Compare Source

common

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#​69316)

compiler

Commit	Type	Description
6f1171991a	fix	restrict possible event handler check to property names longer than 2 characters

core

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

http

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#​69316)

migrations

Commit	Type	Description
15314c1736	fix	migration skip any target are not build or test

v22.0.1

Compare Source

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.
  (cherry picked from commit 8446e46)

common

Commit	Type	Description
c4b5fa3c92	fix	escape CSS string-terminating characters in escapeCssUrl
dfff57ede9	fix	Limits date format string length
3c2892c8df	fix	prevent prototype pollution in formatDateTime
1d87c49f6e	fix	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Type	Description
1ee224ca30	fix	disallow i18n event attributes
a56f1cdf8f	fix	more robust logic to check if regex can be optimized
5946c18275	fix	sanitize href/xlink:href attributes of any element of the MathML namespace
393b84caf8	fix	sanitize two-way properties

compiler-cli

Commit	Type	Description
3d9ca2f173	fix	bind switch exhaustive check expressions

core

Commit	Type	Description
669146b0e7	fix	disable WebMCP during SSR
562a566ead	fix	Handle synchronous errors in PendingTasks.run function
fa546f382d	fix	harden TransferState restoration against DOM clobbering
29fdb98684	fix	prevent dangling prevConsumer reference from leaking destroyed views (#​68681)
cdcea80327	fix	require WebMCP tool descriptions
4289c4c840	fix	update comment for Default change detection
3dd433b39a	fix	use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray
045bb736b3	fix	validate lowercase SVG animation attribute names

forms

Commit	Type	Description
11836a670a	fix	delay mcp reading the form model by a tick
85d2d100e3	fix	harden FormGroup control lookups against prototype shadowing
e51ad374ea	fix	remove animationstart listener on component destroy to prevent memory leak
55b7b5a6b6	fix	set additionalProperties: false on generated WebMCP form

http

Commit	Type	Description
ffb06c0514	fix	ensure query parameters are inserted before URL fragments
2dd65d21e6	fix	pass down the reportUploadProgress and reportDownloadProgress on post/patch requests
4254eb416c	fix	preserve empty referrer option in HttpRequest
167bd4c162	fix	Rejects non-HTTP(S) URLs in JSONP requests

language-service

Commit	Type	Description
43a0e28729	fix	prevent external template inlay hints from appearing in TS files

platform-server

Commit	Type	Description
ed48ca7f51	fix	harden platform location origin validation during SSR
1881ede3a7	refactor	deprecate ServerXhr

router

Commit	Type	Description
43edc8410f	fix	use native URL object for navigation boundary and comparison

service-worker

Commit	Type	Description
cf97b1f828	fix	Strips sensitive headers on cross-origin redirects

v22.0.0

Compare Source

Blog post "Announcing Angular v22".

Breaking Changes

compiler

• This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects.
  You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
• data prefixed attribute no-longer bind inputs nor outputs.
• The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
• in variables will throw in template expressions.

compiler-cli

• Elements with multiple matching selectors will now throw at compile time.

core

• The second arguement of appRef.bootstrap does not accept any anymore. Make sure the element you pass is not nullable.
• • TypeScript versions older than 6.0 are no longer supported.
• Leave animations are no longer limited to the element being removed.
• Component with undefined changeDetection property are now OnPush by default. Specify changeDetection: ChangeDetectionStrategy.Eager to keep the previous behavior.
• change AnimationCallbackEvent.animationComplete signature
• ChangeDetectorRef.checkNoChanges was removed. In tests use fixture.detectChanges() instead.
• createNgModuleRef was removed, use createNgModule instead
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.

forms

• min and max validation rules no longer support
  string values. Bound values must be numbers or null.

http

• Use the HttpXhrBackend with provideHttpClient(withXhr) if you want to keep supporting upload progress reports.

platform-browser

• This removes styles when they appear to no longer be used by an associated host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.
• Hammer.js integration has been removed. Use your own implementation.

router

• The return type for TitleStrategy.getResolvedTitleForRoute
  was previously 'any' while the actual return type could only be either string
  or undefined. The return type now reflects the possible values correctly.
  Code that reads the value may need to be adjusted.

  (cherry picked from commit ad37f52)

• The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.

• paramsInheritanceStrategy now defaults to 'always'

  The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.

• provideRoutes() has been removed. Use provideRouter() or ROUTES as multi token if necessary.

upgrade

• Deprecated getAngularLib/setAngularLib have been removed use getAngularJSGlobal/setAngularJSGlobal instead.

Deprecations

http

• withFetch is now deprecated, it can be safely removed.
• The reportProgress option is deprecated please use reportUploadProgress & reportDownloadProgress instead.

compiler

Commit	Type	Description
47fcbc4704	feat	allow safe navigation to correctly narrow down nullables
2896c93cc1	feat	Angular expressions with optional chaining returns undefined
e850643b1b	feat	Support comments in html element.
96be4f429b	fix	abstract emitter producing incorrect code for dynamic imports
488d962bc7	fix	Don't bind inputs/outputs for data- attributes
2c5aabb9da	fix	don't escape dollar sign in literal expression
c7aef8ec5d	fix	enforce parentheses containing arguments for :host-context
b225a5d902	fix	invalid type checking code if field name needs to be quoted
ab9154ab75	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#​68868)
8a1533c9ad	fix	preserve leading commas in animation definitions
194f723f66	fix	remove dedicated support for legacy shadow DOM selectors
4c25a42e98	fix	remove deprecated shadow CSS encapsulation polyfills
6ff620a033	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#​68868)
7dc1017e51	fix	simplify handling of colon host with a selector list
d99ab0e040	fix	stop generating unused field
03db2aefaa	fix	throw on duplicate input/outputs
786ef8261f	fix	throw on invalid in expressions
ccb7d427e4	fix	type check invalid for loops

compiler-cli

Commit	Type	Description
b8d3f36ed9	feat	add support for Node.js 26.0.0
7f9450219f	feat	Adds warning for prefetch without main defer trigger
2eae497a04	feat	support external TCBs with copied content in specific mode
e5f96c2d88	fix	animation events not type checked properly when bound through HostListener decorator
9218140348	fix	resolve TCB mapping failure for safe property reads with as any
7a0d6b8df2	fix	transform dropping exclamationToken from properties
ca67828ee2	refactor	introduce NG8023 compile-time diagnostic for duplicate selectors

core

Commit	Type	Description
17d3ea44e2	feat	add IdleRequestOptions support to IdleService
3b0ae5fef0	feat	add provideWebMcpTools
444b024d49	feat	Add a injectAsync helper function
3bc095d508	feat	Add a schematics to migrate provideHttpClient to keep using the HttpXhrBackend implementation.
5a7c1e62dc	feat	add ability to cache resources for SSR
cb4cb77053	feat	Add migration to add ChangeDetectionStrategy.Eager where applicable
2206efa55f	feat	add special return statuses for resource params
246a984a5d	feat	add TestBed.getFixture
b918beda32	feat	allow debouncing signals
8bc31a515f	feat	Allow other expression for exhaustive typechecking
4e331062e8	feat	allow synchronous values for stream Resources
a0aa8304cd	feat	bootstrap via ApplicationRef with config
9c55fcb3e6	feat	de-duplicate host directives
8fe025f514	feat	drop support for TypeScript 5.9
2f5ab541ea	feat	enhance profiling with documentation URLs
ef1810197b	feat	export experimental declareWebMcpTool support
75f2cb8f56	feat	implement Angular DI graph in-page AI tool
8f3d0b9d97	feat	introduce @Service decorator
df659b8d0c	feat	re-introduce nested leave animations scoped to component boundaries
8ce9cc4f6b	feat	register AI runtime debugging tools
eae8f7e30b	feat	Set default Component changeDetection strategy to OnPush
cdda51a3b2	feat	support bootstrapping Angular applications underneath shadow roots
a5981b83a6	feat	support customization of @​defer's on idle behavior
98eb24cea0	feat	Support optional timeout for idle deferred triggers
dc3131c639	feat	TestBed.getFixture -> TestBed.getLastFixture and update implementation
9f479ae964	feat	Update Testability to use PendingTasks for stability indicator
8ebae1de33	fix	allow service with factory on abstract classes
f9d8da6924	fix	bind global context to idle callback shims in @​defer's idle service
61a48e99aa	fix	do not register dom triggers when defer blocks are in manual mode
49748b5c79	fix	enforce return type for service factory
16adbbf423	fix	ensure custom controls resolve transitive host directives
50e599e73e	fix	lazy-initialize debounced state to prevent computation cycle
7aad302c3e	fix	mark service decorator as stable
a08e4fb93c	fix	normalize tag names in runtime i18n attribute security context lookup (#​68868)
b20f0fe078	fix	prevent rxResource from leaking a subscription
22f8b0a500	fix	resolver function not matching expected type
88d138ccc8	fix	support prefix-insensitive DOM schema lookups and compile-time i18n attribute validation
bfe6f6c2a5	fix	synchronize core sanitization schema with compiler
5e99ae9f00	fix	widen type for directive inputs/outputs
b9b5c279b4	refactor	enhance AnimationCallbackEvent.animationComplete signature
69fb1614ef	refactor	remove checkNoChanges from the public API.
36936872c9	refactor	remove createNgModuleRef
9d76ac8229	refactor	remove ComponentFactoryResolver & ComponentFactory from the api surface
b1f5181ffd	refactor	remove ComponentFactoryResolver & ComponentFactory from the api surface""

forms

Commit	Type	Description
74f76d8075	feat	add reloadValidation to Signal Forms to manually trigger async validation
24e52d450d	feat	add debounce option to validateAsync and validateHttp
709f5a390c	feat	add FieldState.getError()
7745365910	feat	graduate signal forms APIs to public API
f9f24fc669	feat	shim legacy NG_VALIDATORS into parseErrors for CVA mode (#​67943)
41b1410cb8	feat	support binding `number	nullto`
3983080236	feat	support ngNoCva as an opt-out for ControlValueAccessors
c4ce3f345f	feat	template & reactive support for FVC
3524de29f3	fix	Add support for range type with outside of native bounds
de56d74da3	fix	align FormField CVA selection priority with standard forms
0eeb1b5f03	fix	allow FormRoot to be used without submission options (#​67727)
394ad0c2a2	fix	allow late-bound input types for signals forms
ee8d2098cb	fix	change FieldState optional properties to non-optional	undefined
df8b020299	fix	clear native date inputs correctly in signal forms when changed via native UI
2e9aeea0fe	fix	deduplicate writeValue calls in CVA interop
0ea50ffe5a	fix	ensure debounced async validators produce pending status during debounce
3c44d7c90b	fix	fix orphan field error on blur during array removal
849dba6c65	fix	implement custom control reset propagation
5835a5e3a7	fix	prevent orphan field crashes in debounceSync and async validation
3e7ce0dafc	fix	restrict SignalFormsConfig to a readonly API
fb166772d2	fix	split the touched model into an input and touch output
83032e3605	fix	support generic unions in signal form schemas
68c3abbe09	fix	synchronize controls with the model on reset
2061fd8253	fix	Untrack setValue in reactive forms
72d3ace03c	fix	use controlValue in NgControl for CVA interop (#​67943)
3b4ef1e2ff	perf	avoid redundant invalidations in parser errors signal
07a9358157	perf	avoid spurious recomputation in FormField.parseErrors
98c5afdb02	perf	lazily instantiate signal form fields
e0536091f5	perf	optimize reactivity by using shallow array equality
9b9769479b	perf	shortcut deepSignal writes if value is unchanged
[592a12d6c9](https://redirect.github.com/angular/angular/commit/592a12d6c947a0210020b00fd98ffa9fdaca2c

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.