chore(deps): update dependency @angular/compiler to v20.3.15 [security] #390
Conversation
|
![ellipsis-dev[bot]](https://avatars.githubusercontent.com/in/64358?s=60&v=4){kind=small}
There was a problem hiding this comment.
Skipped PR review on ad56e37 because no changed files had a supported extension. If you think this was in error, please contact us and we'll fix it right away.
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Comment |
|
This pull request is automatically built and testable in CodeSandbox. To see build info of the built libraries, click here or the icon next to each commit SHA. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
@1stg/app-config
@1stg/babel-preset
@1stg/browserslist-config
@1stg/commitlint-config
@1stg/common-config
@1stg/config
@1stg/eslint-config
@1stg/markuplint-config
@1stg/nano-staged
@1stg/postcss-config
@1stg/prettier-config
@1stg/remark-preset
@1stg/simple-git-hooks
@1stg/stylelint-config
@1stg/tsconfig
commit: |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #390 +/- ##
======================================
Coverage 0.00% 0.00%
======================================
Files 39 39
Lines 278 278
Branches 129 129
======================================
Misses 278 278 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This PR contains the following updates:
20.0.5→20.3.15GitHub Vulnerability Alerts
CVE-2025-66412
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain
javascript:URLs) as requiring strict URL security, enabling the injection of malicious scripts.Additionally, a related vulnerability exists involving SVG animation elements (
<animate>,<set>,<animateMotion>,<animateTransform>). TheattributeNameattribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes likehreforxlink:hrefon other elements. By bindingattributeNameto "href" and providing ajavascript:URL in thevaluesortoattribute, an attacker could bypass sanitization and execute arbitrary code.Attributes confirmed to be vulnerable include:
xlink:href), and various MathML attributes (e.g.,math|href,annotation|href).attributeNameattribute when bound to "href" or "xlink:href".When template binding is used to assign untrusted, user-controlled data to these attributes (e.g.,
[attr.xlink:href]="maliciousURL"or<animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject ajavascript:URLpayload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
Patches
Attack Preconditions
attributeNameof an SVG animation element.Workarounds
If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).
[attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.attributeNameon SVG Animations: Do not bind untrusted data to theattributeNameattribute of SVG animation elements (<animate>,<set>, etc.).javascript:URLs.Release Notes
angular/angular (@angular/compiler)
v20.3.15Compare Source
compiler
attributeNameand MathML/SVG URLsv20.3.14Compare Source
http
v20.3.13Compare Source
v20.3.12Compare Source
v20.3.11Compare Source
common
compiler
core
v20.3.10Compare Source
compiler-cli
migrations
v20.3.9Compare Source
v20.3.7Compare Source
animations
Element.animateexceptions (#64506)compiler
compiler-cli
core
router
v20.3.6Compare Source
core
platform-browser
DomEventsPluginshould always be the last plugin to be called forsupports(). (#50394)v20.3.5Compare Source
compiler-cli
core
animate.leavefunction bindings (#64413)migrations
router
v20.3.4Compare Source
core
migrations
v20.3.3Compare Source
compiler
core
migrations
v20.3.2Compare Source
compiler-cli
core
Resource.hasValue()(#63994)animate.leave(#63921)forms
FormResetEventwhen resetting control (#64034)migrations
v20.3.1Compare Source
compiler
aria-invalid(#63748)compiler-cli
core
migrations
v20.3.0Compare Source
Breaking Changes
core
The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
Before:
After:
A schematic is provided to automatically update
main.server.tsfiles to pass theBootstrapContextto thebootstrapApplicationcall.In addition,
getPlatform()anddestroyPlatform()will now returnnulland be a no-op respectively when running in a server environment.(cherry picked from commit
8bf80c9)core
BootstrapContextfor improved server bootstrapping (#63636)v20.2.4Compare Source
core
platform-server
v20.2.3Compare Source
compiler
core
rxResourcestreamthrew before returning anObservable(#63342)v20.2.2Compare Source
compiler
core
@forloop animations never get cancelled (#63328)animate.leavebinding to a string with spaces (#63366)v20.2.1Compare Source
compiler
v20.2.0Compare Source
Deprecations
animations
core
router
animations
compiler
compiler-cli
core
asaliases onelse ifblocks (#63047)animate.enterclass removal when composing classes (#62981)@iftoggles with leave animations (#63048)forms
http
HttpClient(#62586)language-service
platform-browser
router
currentNavigationsignal to theRouterservice. (#62971)service-worker
| Commit
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.