chore(deps): Update dependency @angular/core to v10 [SECURITY] #76
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-@angular/core-vulnerability
branch
from
c18ea2e
to
2ede2cc
Compare
renovate
bot
changed the title
⚠ Artifact update problemRenovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below: File name: package-lock.json |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^6.0.2->^10.0.0GitHub Vulnerability Alerts
CVE-2021-4231
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 10.2.5, 11.0.5 or 11.1.0-next.3 is advised to to address this issue.
Release Notes
angular/angular (@angular/core)
v10.2.5Compare Source
v10.2.4Compare Source
v10.2.3Compare Source
v10.2.2Compare Source
v10.2.1Compare Source
v10.2.0Compare Source
v10.1.6Compare Source
v10.1.5Compare Source
v10.1.4Compare Source
v10.1.3Compare Source
v10.1.2Compare Source
v10.1.1Compare Source
v10.1.0Compare Source
v10.0.14Compare Source
v10.0.13Compare Source
v10.0.12Compare Source
v10.0.11Compare Source
v10.0.10Compare Source
v10.0.9Compare Source
v10.0.8Compare Source
v10.0.7Compare Source
v10.0.6Compare Source
v10.0.5Compare Source
v10.0.4Compare Source
v10.0.3Compare Source
v10.0.2Compare Source
v10.0.1Compare Source
v10.0.0Compare Source
v9.1.13Compare Source
v9.1.12Compare Source
v9.1.11Compare Source
v9.1.10Compare Source
v9.1.9Compare Source
v9.1.8Compare Source
v9.1.7Compare Source
v9.1.6Compare Source
v9.1.5Compare Source
v9.1.4Compare Source
v9.1.3Compare Source
v9.1.2Compare Source
v9.1.1Compare Source
v9.1.0Compare Source
v9.0.7Compare Source
v9.0.6Compare Source
v9.0.5Compare Source
v9.0.4Compare Source
v9.0.3Compare Source
v9.0.2Compare Source
v9.0.1Compare Source
v9.0.0Compare Source
v8.2.14Compare Source
v8.2.13Compare Source
v8.2.12Compare Source
v8.2.11Compare Source
v8.2.10Compare Source
v8.2.9Compare Source
v8.2.8Compare Source
v8.2.7Compare Source
v8.2.6Compare Source
v8.2.5Compare Source
v8.2.4Compare Source
v8.2.3Compare Source
v8.2.2Compare Source
v8.2.1Compare Source
v8.2.0Compare Source
v8.1.3Compare Source
v8.1.2Compare Source
v8.1.1Compare Source
v8.1.0Compare Source
v8.0.3Compare Source
v8.0.2Compare Source
v8.0.1Compare Source
v8.0.0Compare Source
v7.2.16Compare Source
v7.2.15Compare Source
v7.2.14Compare Source
v7.2.13Compare Source
v7.2.12Compare Source
v7.2.11Compare Source
v7.2.10Compare Source
v7.2.9Compare Source
v7.2.8Compare Source
v7.2.7Compare Source
v7.2.6Compare Source
v7.2.5Compare Source
v7.2.4Compare Source
v7.2.3Compare Source
common
AsyncPipeshould not callmarkForCheckon subscription (#54554)compiler-cli
core
@deferblock (#52881)migrations
v7.2.2Compare Source
common
compiler
compiler-cli
core
migrations
router
v7.2.1Compare Source
v7.2.0Compare Source
v7.1.4Compare Source
v7.1.3Compare Source
compiler-cli
core
afterRenderhooks should allow updating state (#54074)markForCheckby partially reverting #54074 (#54329)router
v7.1.2Compare Source
v7.1.1Compare Source
router
lasthelper with nativeArray.at(-1)(#54021)v7.1.0Compare Source
compiler
compiler-cli
getConstructorDependencieshelper to work with reflection host after the previous change (#52215)core
inputAPI for signal-based inputs (#53872)SignalNodereactive node incorrectly exposing unset field (#53571)router
NavigationExtras(#53303)onSameUrlNavigation: 'ignore'innavigateByUrl(#52265)v7.0.4Compare Source
common
loadon image once it fails to load (#52990)compiler
compiler-cli
core
getDeferBlocksis invoked in tests (#52973)migrations
v7.0.3Compare Source
animations
core
http
content-typeto set the blobtype. (#52840)migrations
v7.0.2Compare Source
compiler-cli
core
@for(#52697)v7.0.1Compare Source
http
migrations
Web Frameworks: the internet frontier.
These are the voyages of the framework Angular.
Its continuing mission:
To explore strange, new technologies.
To seek out new users and new applications.
To boldly go where no web framework has gone before.
In honor of v17.0.1
Live long and prosper 🖖🏻
v7.0.0Compare Source
Blog post "Angular v17 is now available".
Breaking Changes
Node.js v16 support has been removed and the minimum support version has been bumped to 18.13.0.
Node.js v16 is planned to be End-of-Life on 2023-09-11. Angular will stop supporting Node.js v16 in Angular v17. For Node.js release schedule details, please see: https://github.com/nodejs/release#release-schedule
common
migrating from the previously used == operator. NgSwitch expressions and / or
individual condition values need adjusting to this stricter equality
check. The added warning message should help pin-pointing NgSwitch
usages where adjustments are needed.
core
Angular now requires
zone.jsversion~0.14.0Versions of TypeScript older than 5.2 are no longer supported.
The
mutatemethod was removed from theWritableSignalinterface and completelydropped from the public API surface. As an alternative, please use the
updatemethod andmake immutable changes to the object.
Example before:
Example after:
The
mutatemethod was removed from theWritableSignalinterface and completelydropped from the public API surface. As an alternative please use the update method and
make immutable changes to the object.
Example before:
Example after:
OnPushcomponents that are created dynamically nowonly have their host bindings refreshed and
ngDoCheck runduring changedetection if they are dirty.
Previously, a bug in the change detection would result in the
OnPushconfiguration of dynamically created components to be ignored when
executing host bindings and the
ngDoCheckfunction. This israrely encountered but can happen if code has a handle on the
ComponentRefinstance and updates values read in theOnPushcomponent template without then calling either
markForCheckordetectChangeson that component'sChangeDetectorRef.platform-browser
REMOVE_STYLES_ON_COMPONENT_DESTROYdefault value is nowtrue. This causes CSS of components to be removed from the DOM when destroyed. You retain the previous behaviour by providing theREMOVE_STYLES_ON_COMPONENT_DESTROYinjection token.The
withNoDomReuse()function was removed from the public API. If you need to disable hydration, you can exclude theprovideClientHydration()call from provider list in your application (which would disable hydration features for the entire application) or usengSkipHydrationattribute to disable hydration for particular components. See this guide for additional information: https://angular.io/guide/hydration#how-to-skip-hydration-for-particular-components.router
Absolute redirects no longer prevent further redirects.
Route configurations may need to be adjusted to prevent infinite
redirects where additional redirects were previously ignored after an
absolute redirect occurred.
Routes with
loadComponentwould incorrectly causechild routes to inherit their data by default. The default
paramsInheritanceStrategyisemptyOnly. If parent data should beinherited in child routes, this should be manually set to
always.urlHandlingStrategyhas been removed from the Router public API.This should instead be configured through the provideRouter or RouterModule.forRoot APIs.
The following Router properties have been removed from
the public API:
These should instead be configured through the
provideRouterorRouterModule.forRootAPIs.The
setupTestingRouterfunction has been removed. UseRouterModule.forRootorprovideRouterto setup theRouterfortests instead.
malformedUriErrorHandleris no longer available inthe
RouterModule.forRootoptions. URL parsing errors should instead behandled in the
UrlSerializer.parsemethod.zone.js
Deep and legacy
dist/imports likezone.js/bundles/zone-testing.jsandzone.js/dist/zoneare no longer allowed.zone-testing-bundleandzone-testing-node-bundleare also no longer part of the package.The proper way to import
zone.jsandzone.js/testingis:Deprecations
animations
AnimationDriver.NOOPsymbol is deprecated, useNoopAnimationDriverinstead.core
ChangeDetectorRef.checkNoChangesis deprecated.Test code should use
ComponentFixtureinstead ofChangeDetectorRef.Application code should not call
ChangeDetectorRef.checkNoChangesdirectly.Swapping out the context object for
EmbeddedViewRefis no longer supported. Support for this was introduced with v12.0.0, but
this pattern is rarely used. There is no replacement, but you can use
simple assignments in most cases, or
Object.assign, or alternativelystill replace the full object by using a
Proxy(seeNgTemplateOutletas an example).
Also adds a warning if the deprecated
NgProbeToken
The
NgProbeTokenis not used internally since the transition from View Engine to Ivy. The token has no utility and can be removed from applications and libraries.animations
AnimationDriver.NOOP(#51843)benchpress
common
DatePipeConfig(#51287)compiler
compiler-cli
core
ChangeDetectorRef.checkNoChanges(#52431)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.