chore(deps-dev): bump @angular/common from 8.2.14 to 20.3.25 in /angular8#162
chore(deps-dev): bump @angular/common from 8.2.14 to 20.3.25 in /angular8#162dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) from 8.2.14 to 20.3.25. - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/common) --- updated-dependencies: - dependency-name: "@angular/common" dependency-version: 20.3.25 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Semgrep found 1 Risk: Affected versions of js-yaml are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). js-yaml is vulnerable to prototype pollution through its YAML merge key ( Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 3.14.2 at angular2-jwt-samples/angular8/package-lock.json:11541. Reference(s): GHSA-mh29-5h37-fv8m, CVE-2025-64718 Semgrep found 1 Risk: Affected versions of webpack-dev-server are vulnerable to Exposed Dangerous Method or Function. webpack-dev-server serves bundled assets without rejecting cross-origin classic script requests. Because such Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 5.2.1 at angular2-jwt-samples/angular8/package-lock.json:18654. Reference(s): GHSA-4v9v-hfq4-rm2v, CVE-2025-30359 Semgrep found 1 Risk: Affected versions of webpack-dev-server are vulnerable to Origin Validation Error. webpack-dev-server improperly validates the WebSocket connection Origin header, unconditionally accepting any IP-address-based Origin. A malicious website can perform a cross-site WebSocket hijack against a running dev server and exfiltrate the developer source code carried in Hot Module Reloading (HMR) messages. The insecure origin check is the package default and is reached on every WebSocket connection, so any project running an affected version is vulnerable. Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 5.2.1 at angular2-jwt-samples/angular8/package-lock.json:18654. Reference(s): GHSA-9jgg-88mc-972h, CVE-2025-30360 Semgrep found 1 Risk: Affected versions of webpack are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). webpack's AutoPublicPathRuntimeModule emits runtime code that derives the asset public path from document.currentScript. Because document.currentScript can be DOM-clobbered by an injected scriptless element (e.g. Manual Review Advice: A vulnerability from this advisory is reachable if you build with output.publicPath unset Fix: Upgrade this library to at least version 5.94.0 at angular2-jwt-samples/angular8/package-lock.json:18563. Reference(s): GHSA-4vvj-4cpr-p986, CVE-2024-43788 Semgrep found 1 Risk: samples-bootstrap-theme contains malicious code. Remove it immediately. Fix: There are no safe versions of this library available for upgrade. Library included at angular2-jwt-samples/angular8/package-lock.json:16270. Reference(s): https://osv.dev/vulnerability/MAL-2022-5922 Semgrep found 1 Risk: Affected versions of @babel/plugin-transform-modules-systemjs are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') / Improper Control of Generation of Code ('Code Injection'). @babel/plugin-transform-modules-systemjs mishandles module string specifiers when compiling code into SystemJS module form. An attacker who can supply specially crafted source code to a Babel build that uses this plugin (directly, or transitively via @babel/preset-env configured with Manual Review Advice: A vulnerability from this advisory is reachable if you install Fix: Upgrade this library to at least version 7.29.4 at angular2-jwt-samples/angular8/package-lock.json:3570. Reference(s): GHSA-fv7c-fp4j-7gwp, CVE-2026-44728 Semgrep found 1 Risk: Affected versions of @angular/compiler are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). A stored XSS vulnerability in the Angular Template Compiler arises because its internal security schema doesn't classify certain URL‐ holding attributes (e.g. xlink:href, math|href, annotation|href) or the Manual Review Advice: A vulnerability from this advisory is reachable if you allow Fix: Upgrade this library to at least version 19.2.17 at angular2-jwt-samples/angular8/package-lock.json:996. Reference(s): GHSA-v4hv-rgfq-gp49, CVE-2025-66412 Semgrep found 6
Risk: Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation. Manual Review Advice: A vulnerability from this advisory is reachable if you use Babel to compile untrusted JavaScript Fix: There are no safe versions of this library available for upgrade. Library included at angular2-jwt-samples/angular8/package-lock.json:6186. Reference(s): GHSA-67hx-6x53-jw92, CVE-2023-45133 |
Bumps @angular/common from 8.2.14 to 20.3.25.
Release notes
Sourced from @angular/common's releases.
... (truncated)
Changelog
Sourced from @angular/common's changelog.
... (truncated)
Commits
06be298fix(http): preserve empty referrer option in HttpRequest9f443bcfix(common): Limits date format string lengthfa940e1fix(http): Rejects non-HTTP(S) URLs in JSONP requests1a62130fix(common): use cryptographically secure SHA-256 for transfer cache key gene...566ad05fix(common): skip transfer cache for uncacheable HTTP traffice2ef1cefix(http): skip transfer cache for fetch credentialed requests3d135cefix(common): add upper bounds for digitsInfo39a4b4cfix(common): sanitize placeholderde7b2a6fix(http): exclude withCredentials requests from transfer cache4233188fix(http): skip TransferCache for cookie-bearing requests by defaultDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.