fix(deps): update dependency @angular/compiler to v20 [security] by renovate[bot] · Pull Request #802 · heap-code/nna

renovate · 2025-12-02T06:31:54Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/compiler (source)	`~18.2.0` → `~20.0.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

CVE-2026-50557 / GHSA-f3m7-gqxr-g87x

More information

Details

An issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds.

Specifically, namespaced script elements (e.g., <svg:script> or <:svg:script>) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped.

Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers.

Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS).

Impact

Any Angular application that compiles user-controlled templates at runtime, or relies on sanitization of namespaced elements/attributes, is vulnerable to this security bypass.

Once exploited, this allows a malicious actor to inject a namespaced script element or dynamic attribute bindings, bypassing core sanitization constraints to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.

Attack Preconditions

To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist:

User-Controlled Template Input: The application must accept user-controlled inputs that are directly processed by the Angular template compiler at runtime.
Namespace Parsing Support: The input structure must employ custom namespace prefixes (such as <svg:script>) to evade standard tag-name blocklists/checks.
Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the Angular compiler.

Patches

22.0.0-rc.2
21.2.15
20.3.22
19.2.23

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Angular vulnerable to XSS in i18n attribute bindings

CVE-2026-32635 / GHSA-g93w-mfhg-p222

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script.

The following example illustrates the issue:

<a href="" i18n-href>Click me</a>

The following attributes have been confirmed to be vulnerable:

action
background
cite
codebase
data
formaction
href
itemtype
longdesc
poster
src
xlink:href

Impact

When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:

Session Hijacking: Stealing session cookies and authentication tokens.
Data Exfiltration: Capturing and transmitting sensitive user data.
Unauthorized Actions: Performing actions on behalf of the user.

Attack Preconditions

The application must use a vulnerable version of Angular.
The application must bind unsanitized user input to one of the attributes mentioned above.
The bound value must be marked for internationalization via the presence of a i18n-<name> attribute on the same element.

Patches

22.0.0-next.3
21.2.4
20.3.18
19.2.20

Workarounds

The primary workaround is to ensure that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters) until the patch is applied, or when it is, it shouldn't be marked for internationalization.

Alternatively, users can explicitly sanitize their attributes by passing them through Angular's DomSanitizer:

import {Component, inject, SecurityContext} from '@angular/core';
import {DomSanitizer} from '@angular/platform-browser';

@Component({
  template: `
    <form action="" i18n-action>
      <button>Submit</button>
    </form>
  `,
})
export class App {
  url: string;

  constructor() {
    const dangerousUrl = 'javascript:alert(1)';
    const sanitizer = inject(DomSanitizer);
    this.url = sanitizer.sanitize(SecurityContext.URL, dangerousUrl) || '';
  }
}

References

Fix 1
Fix 2

Severity

CVSS Score: 8.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

CVE-2026-22610 / GHSA-jrmj-c5cx-3cw6

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.

In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.

When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.

Impact

When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:

Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.

Attack Preconditions

The victim application must explicitly use SVG <script> elements within its templates.
The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.
The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).

Patches

19.2.18
20.3.16
21.0.7
21.1.0-rc.0

Workarounds

Until the patch is applied, developers should:

Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.
Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.

Resources

https://github.com/angular/angular/pull/66318

Severity

CVSS Score: 8.5 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

CVE-2025-66412 / GHSA-v4hv-rgfq-gp49

More information

Details

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts.

Additionally, a related vulnerability exists involving SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>). The attributeName attribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes like href or xlink:href on other elements. By binding attributeName to "href" and providing a javascript: URL in the values or to attribute, an attacker could bypass sanitization and execute arbitrary code.

Attributes confirmed to be vulnerable include:

SVG-related attributes: (e.g., xlink:href), and various MathML attributes (e.g., math|href, annotation|href).
SVG animation attributeName attribute when bound to "href" or "xlink:href".

When template binding is used to assign untrusted, user-controlled data to these attributes (e.g., [attr.xlink:href]="maliciousURL" or <animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject a javascript:URL payload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.

Impact

When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:

Session Hijacking: Stealing session cookies and authentication tokens.
Data Exfiltration: Capturing and transmitting sensitive user data.
Unauthorized Actions: Performing actions on behalf of the user.

Patches

19.2.17
20.3.15
21.0.2

Attack Preconditions

The victim's Angular application must render data derived from untrusted input (e.g., from a database or API) and bind it to one of the unsanitized URL attributes or the attributeName of an SVG animation element.
The victim must perform a user interaction (e.g., clicking) on the compromised element for the stored script to execute, or the animation must trigger the execution.

Workarounds

If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).

Avoid Affected Template Bindings: Specifically avoid using template bindings (e.g., [attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.
Avoid Dynamic attributeName on SVG Animations: Do not bind untrusted data to the attributeName attribute of SVG animation elements (<animate>, <set>, etc.).
Enable Content Security Policy (CSP): Configure a robust CSP header that disallows javascript: URLs.

Severity

CVSS Score: 8.5 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)

CVE-2026-54265 / GHSA-58w9-8g37-x9v5

More information

Details

An issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings.

Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]="value" or bindon-innerHTML="value"), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized.

This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular's built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS).

Impact

Any Angular application that uses two-way data binding ([()] or bindon-) on security-sensitive native DOM properties (like innerHTML, href on <a>, src on <img>/<iframe>, etc.) is vulnerable to this security bypass.

Once exploited, this allows a malicious actor to supply an unsanitized property binding value that bypasses core sanitization constraints. This could lead to the execution of arbitrary JavaScript within the target user's browser context, potentially resulting in session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.

Attack Preconditions

To successfully exploit this vulnerability, the following environment parameters and application states must concurrently exist:

Two-Way Binding on Sensitive Properties: The application must bind to a sensitive native DOM property using the two-way binding syntax (e.g., <div [(innerHTML)]="userContent"></div>).
User-Controlled Input: The value bound to this property must be influenceable by user-controlled input.
Absence of Additional Sanitization: The application does not perform separate manual sanitization (e.g., via DomSanitizer) before passing the value to the bound property.

Patches

22.0.1
21.2.17
20.3.25

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

CVE-2026-88057 / GHSA-hh8m-fm6v-7cvg

More information

Details

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks (such as href, src, action, xlink:href, and data) to protect against Cross-Site Scripting (XSS).

Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings (host: {'[attr.href]': 'value'} or @HostBinding('attr.href')) based solely on the declaring directive or component selector at compile time, rather than the concrete host element that the directive was applied to.

When a directive with a security-sensitive host binding was applied to a different concrete host element—such as through:

hostDirectives composition,
Class inheritance of host bindings,
Dynamic component instantiation (createComponent with custom hostElement or dynamic directives),
Elements with SVG/MathML namespaces (e.g. <svg:a>, <math>), or
Elements using tag-neutral selectors (e.g. :not(...)),

the compiler either failed to associate a sanitizer with the host binding or attached an incorrect security context. As a result, untrusted inputs (e.g. javascript:... URLs) bound via the host binding would be written to the DOM attribute without passing through Angular's built-in sanitizer.

Impact

An attacker capable of controlling the value bound to an affected directive host binding could execute arbitrary JavaScript in the user's browser context (Cross-Site Scripting).

Patches

This issue has been resolved in versions:

22.1.0
21.2.20
20.3.28

Workarounds

Ensure that any user-controlled values assigned to properties bound via directive host bindings are explicitly sanitized using DomSanitizer.sanitize(SecurityContext.URL, ...) before assignment, or restrict the input to validated safe URL schemes (e.g. http://, https://).

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

CVE-2026-69151 / GHSA-jj27-h5hq-8x99

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation (validateAttribute() / validateProperty()), the i18n metadata collection path allowed these same attribute names to be marked for translation using i18n-on* attributes (e.g., i18n-onerror).

When exploited, a lower-trust translation file could replace a benign static handler such as onerror="void 0" with arbitrary executable JavaScript in the localized build.

The following example illustrates a vulnerable pattern:

<img src="foo.jpg" onerror="void 0" i18n-onerror />

Impact

When exploited, this vulnerability allows arbitrary JavaScript execution within the context of the vulnerable application's domain if an attacker can control or influence the translation files used during localization. This can lead to:

Session Hijacking: Accessing session cookies, tokens, or sensitive user data.
Unauthorized Actions: Performing actions on behalf of the authenticated user.

Patched Versions

22.0.1
21.2.19
20.3.27

Workarounds

Ensure that static event-handler attributes (e.g., onerror, onclick) are never marked for internationalization (i18n-on*) in application templates, and ensure translation files are sourced from trusted origins.

Severity

CVSS Score: 7.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

angular/angular (@angular/compiler)

`v20.0.0`

Compare Source

Blog post: https://blog.angular.dev/announcing-angular-v20-b5c9c06cf301

Breaking Changes

common

Using the Y formatter (week-numbering year) without also including w (week number) is now detected as suspicious date pattern, as y is typically intended.
AsyncPipe now directly catches unhandled errors in
subscriptions and promises and reports them to the application's
ErrorHandler. For Zone-based applications, these errors would have
been caught by ZoneJS and reported to ErrorHandler so the result is
generally the same. The change to the exact mechanism for reporting can
result in differences in test environments that will require test
updates.

compiler

'in' in an expression now refers to the operator
void in an expression now refers to the operator

Previously an expression in the template like {{void}} referred to a
property on the component class. After this change it now refers to the
void operator, which would make the above example invalid. If you have
existing expressions that need to refer to a property named void,
change the expression to use this.void instead: {{this.void}}.
Parenthesis are always respected.

This can lead to runtime breakages when a nullish coalescing operator is nested within parentheses.
eg. {{ (foo?.bar).baz }} will throw if foo is nullish. This is the same behavior as native JavaScript.

core

TypeScript versions less than 5.8 are no longer supported.
the TestBed.flushEffects() was removed - use
the TestBed.tick() instead.
provideExperimentalCheckNoChangesForDebug has several
breaking changes:
- It is renamed to provideCheckNoChangesConfig
- The behavior applies to all checkNoChanges runs
- The useNgZoneOnStable option is removed. This wasn't found to be generally
  more useful than interval
provideExperimentalZonelessChangeDetection is
renamed to provideZonelessChangeDetection as it is now "Developer
Preview" rather than "Experimental".
- InjectFlags has been removed.
- inject no longer accepts InjectFlags.
- Injector.get no longer accepts InjectFlags.
- EnvironmentInjector.get no longer accepts InjectFlags.
- TestBed.get no longer accepts InjectFlags.
- TestBed.inject no longer accepts InjectFlags.
- TestBed.get has been removed. Use TestBed.inject instead.
afterRender was renamed to afterEveryRender.
- Angular no longer supports Node.js v18.
- Node.js versions 22.0 to 22.10 are also no longer supported.
Before upgrading to Angular v20, ensure the Node.js version is at least 20.11.1.
For the full list of supported versions, visit: https://angular.dev/reference/versions
PendingTasks.run no longer returns the result of the
async function. If this behavior is desired, it can be re-implemented
manually with the PendingTasks.add. Be aware, however, that promise rejections
will need to be handled or they can cause the node process to shut down
when using SSR.
Uncaught errors in listeners which were previously only reported to
ErrorHandler are now also reported to Angular's internal error
handling machinery. For tests, this means that the error will be
rethrown by default rather than only logging the error. Developers
should fix these errors, catch them in the test if the test is
intentionally covering an error case, or use rethrowApplicationErrors: false in configureTestingModule as a last resort.
The any overload has been removed from
injector.get. It now only supports ProviderToken<T> and (deprecated
since v4) string.
Animations are guaranteed to be flushed when Angular
runs automatic change detection or manual calls to ApplicationRef.tick.
Prior to this change, animations would not be flushed in some situations
if change detection did not run on any views attached to the
application. This change can affect tests which may rely on the old
behavior, often by making assertions on DOM elements that should have
been removed but weren't because DOM removal is delayed until animations
are flushed.
ApplicationRef.tick will no longer catch and report
errors to the application ErrorHandler. Errors will instead be thrown out of
the method and will allow callers to determine how to handle these
errors, such as aborting follow-up work or reporting the error and
continuing.
This commit deprecates ng-reflect-* attributes and updates the runtime to stop producing them by default. Please refactor application and test code to avoid relying on ng-reflect-* attributes.

To enable a more seamless upgrade to v20, we've added the provideNgReflectAttributes() function (can be imported from the @angular/core package), which enables the mode in which Angular would be producing those attribites (in dev mode only). You can add the provideNgReflectAttributes() function to the list of providers within the bootstrap call.

router

The RedirectFn can now return Observable or
Promise. Any code that directly calls functions returning this type
may need to be adjusted to account for this.
Several methods in the public API of the Router which
required writable arrays have now been updated to accept readonly
arrays when no mutations are done.
The guards arrays on Route no longer include any in
the type union. The union includes functions for the functional guards
as well as a type matching Injector.get: ProviderToken<T>|string.
Note that string is still deprecated on both the route guards and
Injector.get.

Deprecations

core

ngIf/ngFor/ngSwitch are deprecated. Use the control flow blocks instead (@for/@if/@switch).

platform-browser

All entries of the @angular/platform-browser-dynamic
HammerJS support is deprecated and will be removed in a future major version.

platform-server

@angular/platform-server/testing

Use e2e tests to verify SSR behavior instead.

common

Commit	Type	Description
2e5362a469	feat	accept undefined inputs in NgTemplateOutlet (#61404)
b7d3f3dbfc	feat	Allow passing ScrollOptions to ViewportScroller (#61002)
74cceba587	feat	throw error for suspicious date patterns (#59798)
255c79e048	fix	cleanup `updateLatestValue` if view is destroyed before promise resolves (#58041)
739cadae62	fix	Handle errors in async pipe subscriptions (#60057)
cbbea70fa3	fix	issue a warning instead of an error when `NgOptimizedImage` exceeds the preload limit (#60879)
fc4a56d5c5	fix	rename httpResource function in factory (#60022)
785a1110e6	fix	resolve host binding type issues (#60481)

compiler

Commit	Type	Description
7a971766dc	feat	add extended diagnostic for uninvoked track function on `@for` blocks (#60495)
f2d5cf7edd	feat	support exponentiation operator in templates (#59894)
51b8ff23ce	feat	support tagged template literals in expressions (#59947)
1b8e7ab9fe	feat	support the `in` keyword in Binary expression (#58432)
0361c2d81f	feat	support void operator in templates (#59894)
8b990a31c3	fix	error if rawText isn't estimated correctly (#60529)
4fe489f1b4	fix	exponentiation should be right-to-left associative (#60101)
ef1fd137a9	fix	incorrect spans for template literals (#60323)
e0d378d20e	fix	incorrectly handling let declarations inside i18n (#60512)
b70ad3c4e6	fix	proper handling of typeof, void in RecursiveAstVisitor (#60101)
e25e6c95a2	fix	remove TypeScript from linker (#61635)
768239a89c	perf	reduce allocations for let declarations only used in the same view (#60512)

compiler-cli

Commit	Type	Description
bec1610da2	feat	add extended diagnostic for invalid nullish coalescing (#60279)
c889382a20	feat	detect missing structural directive imports (#59443)
1971e57a45	feat	support type checking of host bindings (#60267)
9ec9c7e1b8	fix	avoid fatal diagnostics for invalid module schemas (#61220)
a1cacc5b17	fix	avoid fatal diagnostics for missing template files (#58673)
1e6faad479	fix	correctly parse event name in HostListener (#60561)
ffb19e64f1	fix	preserve required parens for nullish coalescing (#60060)
7c9b4892e9	fix	preserve required parens in exponentiation expressions (#60101)
7e03af898e	fix	set correct target when type checking events (#60561)
2d51a203dc	fix	wrong event name for host listener decorators (#60460)

core

Commit	Type	Description
22d3f0562c	feat	add hook for producer creation side effects (#60333)
fe57332fc5	feat	add input binding support to dynamically-created components (#60137)
65adb3024d	feat	Add provider which reports unhandled errors on window to ErrorHandler (#60704)
b154fb3911	feat	add support for two-way bindings on dynamically-created components (#60342)
82aa2c1a52	feat	add the ability to apply directives to dynamically-created components (#60137)
326d48afb4	feat	drop support for TypeScript older than 5.8 (#60197)
d260ca3091	feat	emit template function for template related profiler hooks (#60174)
a4bad8d361	feat	export signalGetFn from signal primitives (#60497)
4812215a7b	feat	Expose `Injector.destroy` on `Injector` created with `Injector.create` (#60054)
c1bcae91dd	feat	expose performance data in Chrome DevTools (#60789)
809b5b4596	feat	introduce new DI profiling event (#60158)
d5fd7349fb	feat	introduce TestBed.tick() (#60993)
4e88e18a8e	feat	mark `toObservable` as stable (#60449)
727cda3856	feat	mark linkedSignal API as public (#60865)
644d9f3bbd	feat	mark the toSignal API as stable (#60442)
e711f99d81	feat	move `provideExperimentalCheckNoChangesForDebug` to `provideCheckNoChangesConfig` (#60906)
7ccec1494f	feat	move DOCUMENT token into core (#60663)
953c4b2580	feat	Move zoneless change detection to dev preview (#60748)
611baaf069	feat	remove InjectFlags from public API (#60318)
5e209cb560	feat	remove TestBed.get (#60414)
d8fbb909ce	feat	rename afterRender to afterEveryRender and stabilize (#60999)
567522398f	feat	stabilize incremental hydration api (#60888)
8d050b5bfc	feat	stabilize linkedSignal API (#60741)
866cea9a05	feat	Stabilize PendingTasks Injectable (#60716)
bf8492b871	feat	stabilize withI18nSupport() api (#60889)
be44cc8f40	feat	support listening to outputs on dynamically-created components (#60137)
fe9b79b615	feat	update Node.js version support (#60545)
e170d24240	fix	add migration away from InjectFlags (#60318)
7eb59d3887	fix	added @angular/compiler as a peer dependency (#55610)
7232ce5b17	fix	Catch and report rejections in async function of `PendingTasks.run` (#60044)
fd12220a35	fix	defer block render failures should report to application error handler (#60149)
3459faadbf	fix	do not allow setInput to be used with inputBinding (#60137)
0ac949c266	fix	do not run change detection on global error events (#60944)
4fe34f4cfe	fix	enable stashing only when `withEventReplay()` is invoked (#61077)
962b59b14e	fix	Ensure ComponentFixture does not duplicate error reporting from FakeAsync (#60104)
7b819be83f	fix	Ensure errors in listeners report to the application error handler (#60251)
ff772d7800	fix	fix typing on injector.get to omit 'any' (#60202)
13d1c8ab38	fix	fixes timing of hydration cleanup on control flow (#60425)
0b69b61929	fix	Flush animations when no component has been checked (#58089)
3ba39bc28f	fix	getting resource value throws an error instead of returning undefined (#61441)
ca6295e90b	fix	handle different DI token types in Chrome DevTools integration (#61333)
0162ceb427	fix	inject migration should treat `@Attribute` as optional (#60916)
ea5eb28865	fix	input targeting not checking if input exists on host (#60137)
c8951159ac	fix	mark `zone.js` as an optional peer dependency (#61616)
[d62379bb13](https:

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2025-12-02T06:31:57Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: @heap-code/nna@0.0.0
npm error Found: @angular/compiler@20.0.7
npm error node_modules/@angular/compiler
npm error   @angular/compiler@"~20.0.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer @angular/compiler@"18.2.14" from @angular/platform-browser-dynamic@18.2.14
npm error node_modules/@angular/platform-browser-dynamic
npm error   @angular/platform-browser-dynamic@"~18.2.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-09-10T20_47_15_019Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-10T20_47_15_019Z-debug-0.log

renovate Bot added dependencies renovate security labels Dec 2, 2025

renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch 2 times, most recently from c0bca57 to dced01e Compare December 7, 2025 04:36

renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch from dced01e to 1ae7886 Compare December 13, 2025 05:16

renovate Bot changed the title ~~fix(deps): update dependency @angular/compiler to v19 [security]~~ fix(deps): update dependency @angular/compiler to v19 [security] - autoclosed Dec 22, 2025

renovate Bot closed this Dec 22, 2025

renovate Bot deleted the renovate/npm-angular-compiler-vulnerability branch December 22, 2025 22:32

renovate Bot changed the title ~~fix(deps): update dependency @angular/compiler to v19 [security] - autoclosed~~ fix(deps): update dependency @angular/compiler to v19 [security] Dec 23, 2025

renovate Bot reopened this Dec 23, 2025

renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch 2 times, most recently from 1ae7886 to b97744a Compare December 23, 2025 01:33

renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch from b97744a to 7fc987d Compare February 10, 2026 14:57

renovate Bot changed the title ~~fix(deps): update dependency @angular/compiler to v19 [security]~~ fix(deps): update dependency @angular/compiler to v19 [security] - autoclosed Feb 27, 2026

renovate Bot closed this Feb 27, 2026

renovate Bot changed the title ~~fix(deps): update dependency @angular/compiler to v19 [security] - autoclosed~~ fix(deps): update dependency @angular/compiler to v19 [security] Feb 27, 2026

renovate Bot reopened this Feb 27, 2026

renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch 2 times, most recently from 7fc987d to f1665f1 Compare February 27, 2026 14:01

renovate Bot changed the title ~~fix(deps): update dependency @angular/compiler to v19 [security]~~ fix(deps): update dependency @angular/compiler to v19 [security] - autoclosed Mar 4, 2026

renovate Bot closed this Mar 4, 2026

renovate Bot changed the title ~~fix(deps): update dependency @angular/compiler to v19 [security] - autoclosed~~ fix(deps): update dependency @angular/compiler to v19 [security] Mar 4, 2026

renovate Bot reopened this Mar 4, 2026

renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch 2 times, most recently from f1665f1 to 4503163 Compare March 4, 2026 04:51

renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch from 4503163 to 1798514 Compare March 27, 2026 05:02

renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch from 1798514 to 6c4b786 Compare April 10, 2026 01:52

renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch from 6c4b786 to 0b1adb4 Compare May 5, 2026 22:30

renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch from 0b1adb4 to 853afc6 Compare May 29, 2026 22:46

renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch from 853afc6 to 0f98f5b Compare July 16, 2026 01:00

renovate Bot changed the title ~~fix(deps): update dependency @angular/compiler to v19 [security]~~ fix(deps): update dependency @angular/compiler to v20 [security] Jul 16, 2026

renovate Bot changed the title ~~fix(deps): update dependency @angular/compiler to v20 [security]~~ fix(deps): update dependency @angular/compiler to v20 [security] - autoclosed Jul 20, 2026

renovate Bot closed this Jul 20, 2026

fix(deps): update dependency @angular/compiler to v20 [security]

fab880d

renovate Bot changed the title ~~fix(deps): update dependency @angular/compiler to v20 [security] - autoclosed~~ fix(deps): update dependency @angular/compiler to v20 [security] Jul 20, 2026

renovate Bot reopened this Jul 20, 2026

renovate Bot force-pushed the renovate/npm-angular-compiler-vulnerability branch 2 times, most recently from 0f98f5b to fab880d Compare July 20, 2026 23:11

Navigation Menu

Uh oh!

fix(deps): update dependency @angular/compiler to v20 [security] - #802

fix(deps): update dependency @angular/compiler to v20 [security]#802
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-angular-compiler-vulnerability

renovate Bot commented Dec 2, 2025 •

edited

Loading

Uh oh!

renovate Bot commented Dec 2, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

Details

Impact

Attack Preconditions

Patches

Severity

References

Angular vulnerable to XSS in i18n attribute bindings

Details

Impact

Attack Preconditions

Patches

Workarounds

References

Severity

References

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

Details

Impact

Attack Preconditions

Patches

Workarounds

Resources

Severity

References

Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

Details

Impact

Patches

Attack Preconditions

Workarounds

Severity

References

@​angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)

Details

Impact

Attack Preconditions

Patches

Severity

References

Angular: Sanitization bypass via directive host bindings on concrete host elements in @​angular/core and @​angular/compiler

Details

Impact

Patches

Workarounds

Severity

References

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Details

Impact

Patched Versions

Workarounds

Severity

References

Release Notes

v20.0.0

Breaking Changes

common

compiler

core

router

Deprecations

core

platform-browser

platform-server

common

compiler

compiler-cli

core

Configuration

Uh oh!

renovate Bot commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: package-lock.json

Uh oh!

renovate Bot commented Dec 2, 2025 •

edited

Loading

@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

`v20.0.0`

renovate Bot commented Dec 2, 2025 •

edited

Loading