fix(deps): update dependency @angular/ssr to v18 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/ssr	^17.0.2 → ^18.0.0

GitHub Vulnerability Alerts

CVE-2025-59052

Impact

Angular uses a DI container (the "platform injector") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state.

In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response headers. As long as an attacker had network access to send any traffic that received a rendered response, they may have been able to send a large number of requests and then inspect the responses for information leaks.

The following APIs were vulnerable and required SSR-only breaking changes:

• bootstrapApplication: This function previously implicitly retrieved the last platform injector that was created. It now requires an explicit BootstrapContext in a server environment. This function is only used for standalone applications. NgModule-based applications are not affected.
• getPlatform: This function previously returned the last platform instance that was created. It now always returns null in a server environment.
• destroyPlatform: This function previously destroyed the last platform instance that was created. It's now a no-op when called in a server environment.

For bootstrapApplication, the framework now provides a new argument to the application's bootstrap function:

// Before:
const bootstrap = () => bootstrapApplication(AppComponent, config);

// After:
const bootstrap = (context: BootstrapContext) =>
  bootstrapApplication(AppComponent, config, context);

As is usually the case for changes to Angular, an automatic schematic will take care of these code changes as part of ng update:

# For apps on Angular v20:
ng update @​angular/cli @​angular/core

# For apps on Angular v19:
ng update @​angular/cli@19 @​angular/core@19

# For apps on Angular v18:
ng update @​angular/cli@18 @​angular/core@18

The schematic can also be invoked explicitly if the version bump was pulled in independently:

# For apps on Angular v20:
ng update @​angular/core --name add-bootstrap-context-to-server-main

# For apps on Angular v19:
ng update @​angular/core@19 --name add-bootstrap-context-to-server-main

# For apps on Angular v18:
ng update @​angular/core@18 --name add-bootstrap-context-to-server-main

For applications that still use CommonEngine, the bootstrap property in CommonEngineOptions also gains the same context argument in the patched versions of Angular.

In local development (ng serve), Angular CLI triggered a codepath for Angular's "JIT" feature on the server even in applications that weren't using it in the browser. The codepath introduced async behavior between platform creation and application bootstrap, triggering the race condition even if an application didn't explicitly use getPlatform or custom async logic in bootstrap. Angular applications should never run in this mode outside of local development.

Patches

The issue has been patched in all active release lines as well as in the v21 prerelease:

• @angular/platform-server: 21.0.0-next.3

• @angular/platform-server: 20.3.0

• @angular/platform-server: 19.2.15

• @angular/platform-server: 18.2.14

• @angular/ssr: 21.0.0-next.3

• @angular/ssr: 20.3.0

• @angular/ssr: 19.2.16

• @angular/ssr: 18.2.21

Workarounds

• Disable SSR via Server Routes (v19+) or builder options.
• Remove any asynchronous behavior from custom bootstrap functions.
• Remove uses of getPlatform() in application code.
• Ensure that the server build defines ngJitMode as false.

References

• https://github.com/angular/angular/pull/63562
• https://github.com/angular/angular-cli/pull/31108

---

Release Notes

angular/angular-cli (@​angular/ssr)

v18.2.21

Compare Source

Breaking Changes

@​angular/ssr

• The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

  Before:

  const bootstrap = () => bootstrapApplication(AppComponent, config);

  After:

  const bootstrap = (context: BootstrapContext) =>
    bootstrapApplication(AppComponent, config, context);

@​angular-devkit/build-angular

Commit	Type	Description
700e6bc01	fix	avoid extra tick in SSR builds

@​angular/build

Commit	Type	Description
cccc91b91	fix	avoid extra tick in SSR dev-server builds

@​angular/ssr

Commit	Type	Description
4af385201	feat	introduce BootstrapContext for isolated server-side rendering

v18.2.20

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
f048078	fix	update dependency webpack-dev-server to v5.2.2

v18.2.19

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
01cc617bc	fix	update http-proxy-middleware to v3.0.5

v18.2.18

Compare Source

@​angular/build

Commit	Type	Description
4245ca7b4	fix	update vite to 5.4.17

v18.2.17

Compare Source

@​angular/build

Commit	Type	Description
247ceff7f	fix	update vite to 5.4.16 due to a security issues

v18.2.16

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
4267a80c5	fix	remove @vitejs/plugin-basic-ssl from dependencies

@​angular/build

Commit	Type	Description
9c2904d0d	fix	update vite to 5.4.15

v18.2.15

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
255c8a50d	fix	update babel packages

v18.2.14

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
9d34d28ec	fix	remove unused vite dependency

v18.2.13

Compare Source

@​angular/cli

Commit	Type	Description
deeaf1883	fix	correctly select package versions in descending order during ng add

@​angular/build

Commit	Type	Description
fdddf2c08	fix	update vite to version 5.4.14

v18.2.12

Compare Source

@​angular/cli

Commit	Type	Description
c3925ed7f	fix	support default options for multiselect list x-prompt

@​angular/build

Commit	Type	Description
c8bee8415	fix	allow .js file replacements in all configuration cases
93f552112	fix	improve URL rebasing for hyphenated Sass namespaced variables

v18.2.11

Compare Source

@​angular/build

Commit	Type	Description
87ec15ba2	fix	show error message when error stack is undefined

v18.2.10

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
7b775f4e0	fix	update http-proxy-middleware to 3.0.3

@​angular/build

Commit	Type	Description
b1e5f51f9	fix	Address build issue in Node.js LTS versions with prerendering or SSR

v18.2.9

Compare Source

@​schematics/angular

Commit	Type	Description
237f7c5d0	fix	update browserslist config to include last 2 Android major versions

@​angular/build

Commit	Type	Description
d749ba6a3	fix	allow direct bundling of TSX files with application builder
b91c82d89	fix	avoid race condition in sass importer

v18.2.8

Compare Source

@​schematics/angular

Commit	Type	Description
b522002ff	fix	add validation for component and directive class name
dfd2d5c05	fix	include index.csr.html in resources asset group

@​angular/build

Commit	Type	Description
9445916f9	fix	Ctrl + C not terminating dev-server with SSR
9b5cfaa8c	fix	always generate a new hash for optimized chunk

v18.2.7

Compare Source

@​schematics/angular

Commit	Type	Description
3f98193d6	fix	support single quote setting in JetBrains IDEs

@​angular/build

Commit	Type	Description
8274184e1	fix	add animate to valid self-closing elements
2648e811e	fix	add few more SVG elements animateMotion, animateTransform, and feBlend etc. to valid self-closing elements
736e126e4	fix	separate Vite cache by project

v18.2.6

Compare Source

@​angular/build

Commit	Type	Description
9d0b67124	fix	allow missing HTML file request to fallback to index
5fea635b2	fix	update rollup to 4.22.4

v18.2.5

Compare Source

@​angular/build

Commit	Type	Description
707431625	fix	support HTTP HEAD requests for virtual output files
1032b3da1	fix	update vite to 5.4.6

v18.2.4

Compare Source

@​angular/build

Commit	Type	Description
765309a2e	fix	prevent transformation of Node.js internal dependencies by Vite

v18.2.3

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
482076612	fix	update webpack-dev-middleware to 7.4.2

v18.2.2

Compare Source

Breaking Changes

@​angular/ssr

• The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

  Before:

  const bootstrap = () => bootstrapApplication(AppComponent, config);

  After:

  const bootstrap = (context: BootstrapContext) =>
    bootstrapApplication(AppComponent, config, context);

@​angular-devkit/build-angular

Commit	Type	Description
700e6bc01	fix	avoid extra tick in SSR builds

@​angular/build

Commit	Type	Description
cccc91b91	fix	avoid extra tick in SSR dev-server builds

@​angular/ssr

Commit	Type	Description
4af385201	feat	introduce BootstrapContext for isolated server-side rendering

v18.2.1

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
01cc617bc	fix	update http-proxy-middleware to v3.0.5

v18.2.0

Compare Source

@​schematics/angular

Commit	Type	Description
4da922e4f	feat	use isolatedModules in generated project

@​angular/build

Commit	Type	Description
24aaf1e37	feat	support import attribute based loader configuration

v18.1.4

Compare Source

@​angular/build

Commit	Type	Description
f8b092711	fix	allow explicitly disabling TypeScript incremental mode
f3a5970fc	fix	lazy load Node.js inspector for dev server

v18.1.3

Compare Source

@​angular/build

Commit	Type	Description
a28615d7d	fix	add CSP nonce attribute to script tags when inline critical CSS is disabled
747a1447c	fix	prevent build failures with remote CSS imports when Tailwind is configured
c0933f2c0	fix	resolve error with extract-i18n builder for libraries

v18.1.2

Compare Source

@​angular/build

Commit	Type	Description
5b9378a3b	fix	account for HTML base HREF for dev-server externals
3e4ea77d7	fix	correctly detect comma in Sass URL lexer
d868270f1	fix	prevent redirection loop
3573ac655	fix	serve HTML files directly

v18.1.1

Compare Source

@​angular-devkit/build-angular

Commit	Type	Description
4f6cee272	fix	skip undefined files when generating budget stats

@​angular/build

Commit	Type	Description
96dc7e6ed	fix	remove Vite "/@​id/" prefix for explicit external dependencies
bdef39801	fix	resolve only ".wasm" files

v18.1.0

Compare Source

@​angular/cli

Commit	Type	Description
6d266c146	fix	add fallbacks for migration package resolution

@​schematics/angular

Commit	Type	Description
22e05dcb4	fix	generate new projects with ECMAScript standard class field behavior

@​angular/build

Commit	Type	Description
687a6c7ec	feat	add --inspect option to the dev-server
628d87a94	feat	support WASM/ES Module integration proposal
3e359da8d	fix	address rxjs undefined issues during SSR prebundling
4ff914a16	fix	allow additional module preloads up to limit
fb8e3c39a	fix	allow top-level await in zoneless applications
83b75af9f	fix	check inlineSourceMap option with isolated modules optimization
cd97134a6	fix	normalize paths during module resolution in Vite
13d2100dd	fix	read WASM file from script location on Node.js
3091956f5	fix	support import attributes in JavaScript transformer
dd94a831b	perf	enable dependency prebundling for server dependencies
3acb77683	perf	use direct transpilation with isolated modules

v18.0.7

Compare Source

@​angular/cli

Commit	Type	Description
67bf90131	fix	make ng update to keep newline at the end of package.json

@​angular-devkit/build-angular

Commit	Type	Description
9b43ecbd0	fix	reduce the number of max workers to available CPUs minus one
03dad6806	fix	rollback terser to 5.29.2

@​angular/build

Commit	Type	Description
fc928f638	fix	correctly name entry points to match budgets
2d51e8607	fix	redirect to path with trailing slash for asset directories
16f1c1e01	fix	reduce the number of max workers to available CPUs minus one

v18.0.6

Compare Source

@​angular/build

Commit	Type	Description
98a8a8a78	fix	show JavaScript cache store initialization warning

v18.0.5

Compare Source

@​schematics/angular

Commit	Type	Description
5c705e800	fix	update schematics to use RouterModule when --routing flag is present

@​angular-devkit/build-angular

Commit	Type	Description
86e031dc7	fix	use istanbul-lib-instrument directly for karma code coverage

@​angular/build

Commit	Type	Description
bdd168f37	fix	add CSP nonce to script with src tags
405c14809	fix	automatically resolve .mjs files when using Vite
7360a346e	fix	use Node.js available parallelism for default worker count

v18.0.4

Compare Source

@​angular/build

Commit	Type	Description
791ef809d	fix	do not reference sourcemaps in web workers and global stylesheet bundles when hidden setting is enabled
20fc6ca05	fix	generate module preloads next to script elements in index HTML
3a1bf5c8a	fix	Initiate PostCSS only once
78c611754	fix	issue warning when auto adding @angular/localize/init

v18.0.3

Compare Source

@​angular/cli

Commit	Type	Description
b709d2a24	fix	add schema.json options to parsed command, also when a version is passed to ng add <package>@&#8203;<version>

@​angular/build

Commit	Type	Description
43a2a7d13	fix	avoid escaping rebased Sass URL values
9acb5c7ca	fix	disable JS transformer persistent cache on web containers
346df4909	fix	improve Sass rebaser ident token detection
6526a5f59	fix	watch all related files during a Sass error

v18.0.2

Compare Source

@​schematics/angular

Commit	Type	Description
9967c04b8	fix	check both application builder packages in SSR schematic
92b48ab14	fix	set builders assets option correctly for new applications

@​angular/build

Commit	Type	Description
3bb06c37d	fix	disable Worker wait loop for Sass compilations in web containers
c4cf35923	fix	print Sass @warn location
352879804	fix	support valid self-closing MathML tags in HTML index file
476f3084a	fix	support valid self-closing SVG tags in HTML index file

@​angular/pwa

Commit	Type	Description
acbffd236	fix	set manifest icons location to match assets builder option

v18.0.1

Compare Source

@​schematics/angular

Commit	Type	Description
01842f515	fix	use angular.dev in readme

@​angular/build

Commit	Type	Description
7d253e9cd	fix	avoid rebasing URLs with function calls
6b6a76a99	fix	disable persistent disk caching inside webcontainers by default
ba70a50b6	fix	handle esbuild-browser polyfills option as string during ng serve
706423aca	fix	only import persistent cache store with active caching

v18.0.0

Compare Source

Breaking Changes

@​angular/cli

• The ng doc command has been removed without a replacement. To perform searches, please visit www.angular.dev
• Node.js support for versions <18.19.1 and <20.11.1 has been removed.

@​angular-devkit/build-angular

• By default, the index.html file is no longer emitted in the browser directory when using the application builder with SSR. Instead, an index.csr.html file is emitted. This change is implemented because in many cases server and cloud providers incorrectly treat the index.html file as a statically generated page. If you still require the old behavior, you can use the index option to specify the output file name.

  "architect": {
    "build": {
      "builder": "@​angular-devkit/build-angular:application",
      "options": {
        "outputPath": "dist/my-app",
        "index": {
          "input": "src/index.html",
          "output": "index.html"
        }
      }
    }
  }

• The support for the legacy Sass build pipeline, previously accessible via NG_BUILD_LEGACY_SASS when utilizing webpack-based builders, has

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: eligibility-tracker@0.0.0
npm error Found: @angular/common@17.3.12
npm error node_modules/@angular/common
npm error   @angular/common@"^17.0.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer @angular/common@"^18.0.0" from @angular/ssr@18.2.21
npm error node_modules/@angular/ssr
npm error   @angular/ssr@"^18.0.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-02-02T18_25_39_216Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-02-02T18_25_39_216Z-debug-0.log