chore(deps): update dependency @angular/common to v20.3.14 [security]#93
chore(deps): update dependency @angular/common to v20.3.14 [security]#93renovate[bot] wants to merge 1 commit intomainfrom
Conversation
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![ellipsis-dev[bot]](https://avatars.githubusercontent.com/in/64358?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
Looks good to me! 👍
Reviewed everything up to d244383 in 54 seconds. Click for details.
- Reviewed
13lines of code in1files - Skipped
1files when reviewing. - Skipped posting
1draft comments. View those below. - Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.
1. packages/unuse/package.json:34
- Draft comment:
The update to @angular/common is good for the security fix, but the other Angular devDependencies (compiler, core, platform-browser) are still at 20.0.5. For consistency and to avoid potential incompatibilities, please consider updating them to 20.3.14 as well. - Reason this comment was not posted:
Comment was on unchanged code.
Workflow ID: wflow_DGQrizskZk9qcVsy
You can customize 
1 participant
This PR contains the following updates:
20.0.5->20.3.14GitHub Vulnerability Alerts
CVE-2025-66035
The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain.
Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (
http://orhttps://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to theX-XSRF-TOKENheader.Impact
The token leakage completely bypasses Angular's built-in CSRF protection, allowing an attacker to capture the user's valid XSRF token. Once the token is obtained, the attacker can perform arbitrary Cross-Site Request Forgery (CSRF) attacks against the victim user's session.
Attack Preconditions
POST) to a protocol-relative URL (e.g.,//attacker.com) that they control.Patches
Workarounds
Developers should avoid using protocol-relative URLs (URLs starting with
//) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single/) or fully qualified, trusted absolute URLs.Release Notes
angular/angular (@angular/common)
v20.3.14Compare Source
http
v20.3.13Compare Source
v20.3.12Compare Source
v20.3.11Compare Source
common
compiler
core
v20.3.10Compare Source
compiler-cli
migrations
v20.3.9Compare Source
v20.3.7Compare Source
animations
Element.animateexceptions (#64506)compiler
compiler-cli
core
router
v20.3.6Compare Source
core
platform-browser
DomEventsPluginshould always be the last plugin to be called forsupports(). (#50394)v20.3.5Compare Source
compiler-cli
core
animate.leavefunction bindings (#64413)migrations
router
v20.3.4Compare Source
core
migrations
v20.3.3Compare Source
compiler
core
migrations
v20.3.2Compare Source
compiler-cli
core
Resource.hasValue()(#63994)animate.leave(#63921)forms
FormResetEventwhen resetting control (#64034)migrations
v20.3.1Compare Source
compiler
aria-invalid(#63748)compiler-cli
core
migrations
v20.3.0Compare Source
Breaking Changes
core
The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
Before:
After:
A schematic is provided to automatically update
main.server.tsfiles to pass theBootstrapContextto thebootstrapApplicationcall.In addition,
getPlatform()anddestroyPlatform()will now returnnulland be a no-op respectively when running in a server environment.(cherry picked from commit
8bf80c9)core
BootstrapContextfor improved server bootstrapping (#63636)v20.2.4Compare Source
core
platform-server
v20.2.3Compare Source
compiler
core
rxResourcestreamthrew before returning anObservable(#63342)v20.2.2Compare Source
compiler
core
@forloop animations never get cancelled (#63328)animate.leavebinding to a string with spaces (#63366)v20.2.1Compare Source
compiler
v20.2.0Compare Source
Deprecations
animations
core
router
animations
compiler
compiler-cli
core
asaliases onelse ifblocks (#63047)animate.enterclass removal when composing classes (#62981)@iftoggles with leave animations (#63048)forms
http
HttpClient(#62586)language-service
platform-browser
router
currentNavigationsignal to theRouterservice. (#62971)service-worker
v20.1.8Compare Source
compiler
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.