Update dependency @angular/compiler to v19 [SECURITY]

[aoe-renovate]

This PR contains the following updates:

Package	Type	Update	Change
@angular/compiler (source)	dependencies	major	^15.2.10 -> ^19.0.0

---

Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

CVE-2025-66412 / GHSA-v4hv-rgfq-gp49

More information

Details

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts.

Additionally, a related vulnerability exists involving SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>). The attributeName attribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes like href or xlink:href on other elements. By binding attributeName to "href" and providing a javascript: URL in the values or to attribute, an attacker could bypass sanitization and execute arbitrary code.

Attributes confirmed to be vulnerable include:

• SVG-related attributes: (e.g., xlink:href), and various MathML attributes (e.g., math|href, annotation|href).
• SVG animation attributeName attribute when bound to "href" or "xlink:href".

When template binding is used to assign untrusted, user-controlled data to these attributes (e.g., [attr.xlink:href]="maliciousURL" or <animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject a javascript:URL payload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.

Impact

When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:

• Session Hijacking: Stealing session cookies and authentication tokens.
• Data Exfiltration: Capturing and transmitting sensitive user data.
• Unauthorized Actions: Performing actions on behalf of the user.

Patches

• 19.2.17
• 20.3.15
• 21.0.2

Attack Preconditions

• The victim's Angular application must render data derived from untrusted input (e.g., from a database or API) and bind it to one of the unsanitized URL attributes or the attributeName of an SVG animation element.
• The victim must perform a user interaction (e.g., clicking) on the compromised element for the stored script to execute, or the animation must trigger the execution.

Workarounds

If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).

• Avoid Affected Template Bindings: Specifically avoid using template bindings (e.g., [attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.
• Avoid Dynamic attributeName on SVG Animations: Do not bind untrusted data to the attributeName attribute of SVG animation elements (<animate>, <set>, etc.).
• Enable Content Security Policy (CSP): Configure a robust CSP header that disallows javascript: URLs.

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-v4hv-rgfq-gp49
• https://nvd.nist.gov/vuln/detail/CVE-2025-66412
• https://github.com/angular/angular/commit/1c6b0704fb63d051fab8acff84d076abfbc4893a
• https://github.com/angular/angular

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/compiler)

v19.0.0

Compare Source

Blog post: https://blog.angular.dev/meet-angular-v19-7b29dfd05b84

Breaking Changes

compiler

• this.foo property reads no longer refer to template context variables. If you intended to read the template variable, do not use this..
• changes to CSS selectors parsing where introduced, mainly to: pseudo selectors :where() and :is(),
  parsing of :host and host-context, parsing selectors within pseudo selector arguments (for instance comma separated selectors).
  These changes could lead to a different specificity of the resulting selectors and/or previously broken selectors being applied now,
  for example :where(:host) used to transform to :where()[ng-host] and is being :where([ng-host]) now. Unlike the previous outcome,
  the new result can target elements and therefore could lead to breakages.

core

• Angular directives, components and pipes are now standalone by default.

  • Specify standalone: false for declarations that are currently declared in @NgModules.
  • ng update for v19 will take care of this automatically.

• TypeScript versions less than 5.5 are no longer supported.

• Timing changes for effect API (in developer preview):

  • effects which are triggered outside of change detection run as part of
    the change detection process instead of as a microtask. Depending on the
    specifics of application/test setup, this can result in them executing
    earlier or later (or requiring additional test steps to trigger; see below
    examples).

  • effects which are triggered during change detection (e.g. by input
    signals) run earlier, before the component's template.

• ExperimentalPendingTasks has been renamed to PendingTasks.

• The autoDetect feature of ComponentFixture will now
  attach the fixture to the ApplicationRef. As a result, errors during
  automatic change detection of the fixture be reported to the ErrorHandler.
  This change may cause custom error handlers to observe new failures that were previously unreported.

• createComponent will now render default fallback with empty projectableNodes.

  • When passing an empty array to projectableNodes in the createComponent API, the default fallback content
    of the ng-content will be rendered if present. To prevent rendering the default content, pass document.createTextNode('') as a projectableNode.

  // The first ng-content will render the default fallback content if present
  createComponent(MyComponent. { projectableNodes: [[], [secondNode]] });
  
  // To prevent projecting the default fallback content:
  createComponent(MyComponent. { projectableNodes: [[document.createTextNode('')], [secondNode]] });

• Errors that are thrown during ApplicationRef.tick
  will now be rethrown when using TestBed. These errors should be
  resolved by ensuring the test environment is set up correctly to
  complete change detection successfully. There are two alternatives to
  catch the errors:

  • Instead of waiting for automatic change detection to happen, trigger
    it synchronously and expect the error. For example, a jasmine test
    could write expect(() => TestBed.inject(ApplicationRef).tick()).toThrow()
  • TestBed will reject any outstanding ComponentFixture.whenStable promises. A jasmine test,
    for example, could write expectAsync(fixture.whenStable()).toBeRejected().

  As a last resort, you can configure errors to not be rethrown by
  setting rethrowApplicationErrors to false in TestBed.configureTestingModule.

• The timers that are used for zone coalescing and hybrid
  mode scheduling (which schedules an application state synchronization
  when changes happen outside the Angular zone) will now run in the zone
  above Angular rather than the root zone. This will mostly affect tests
  which use fakeAsync: these timers will now be visible to fakeAsync
  and can be affected by tick or flush.

• The deprecated factories property in KeyValueDiffers has been removed.

elements

• as part of switching away from custom CD behavior to the
  hybrid scheduler, timing of change detection around custom elements has
  changed subtly. These changes make elements more efficient, but can cause
  tests which encoded assumptions about how or when elements would be checked
  to require updating.

localize

• The name option in the ng add @localize``schematic has been removed in favor of theproject option.

platform-browser

• The deprecated BrowserModule.withServerTransition method has been removed. Please use the APP_ID DI token to set the application id instead.

router

• The Router.errorHandler property has been removed.
  Adding an error handler should be configured in either
  withNavigationErrorHandler with provideRouter or the errorHandler
  property in the extra options of RouterModule.forRoot. In addition,
  the error handler cannot be used to change the return value of the
  router navigation promise or prevent it from rejecting. Instead, if you
  want to prevent the promise from rejecting, use resolveNavigationPromiseOnError.
• The return type of the Resolve interface now includes
  RedirectCommand.

common

Commit	Type	Description
24c6373820	feat	add optional rounded transform support in cloudinary image loader (#​55364)
50f08e6c4b	feat	automatically use sizes auto in NgOptimizedImage (#​57479)
13c13067bc	feat	disable keyvalue sorting using null compareFn (#​57487)

compiler

Commit	Type	Description
a2e4ee0cb3	feat	add diagnostic for unused standalone imports (#​57605)
0c9d721ac1	feat	add support for the typeof keyword in template expressions. (#​58183)
09f589f000	fix	this.a should always refer to class property a (#​55183)
98804fd4be	fix	add more specific matcher for hydrate never block (#​58360)
b25121ee4a	fix	avoid having to duplicate core environment (#​58444)
560282aa9b	fix	control flow nodes with root at the end projected incorrectly (#​58607)
2be161d015	fix	fix :host parsing in pseudo-selectors (#​58681)
806a61b5a6	fix	fix multiline selectors (#​58681)
a3cb530d84	fix	handle typeof expressions in serializer (#​58217)
ba4340875a	fix	ignore placeholder-only i18n messages (#​58154)
e5d3abb298	fix	resolve :host:host-context(.foo) (#​58681)
80f56954ce	fix	transform chained pseudo-selectors (#​58681)

compiler-cli

Commit	Type	Description
d9687f43dd	feat	'strictStandalone' flag enforces standalone (#​57935)
9e87593055	feat	ensure template style elements are preprocessed as inline styles (#​57429)
231e6ff6ca	feat	generate the HMR replacement module (#​58205)
dbe612f2cd	fix	disable standalone by default on older versions of Angular (#​58405)
d4d76ead80	fix	do not fail fatal when references to non-existent module are discovered (#​58515)
33fe252c58	fix	do not report unused declarations coming from an imported array (#​57940)
fb44323c51	fix	incorrectly generating relative file paths on case-insensitive platforms (#​58150)
22cd6869ef	fix	make the unused imports diagnostic easier to read (#​58468)
9bbb01c85e	fix	report individual diagnostics for unused imports (#​58589)
4716c3b966	perf	reduce duplicate component style resolution (#​57502)

core

Commit	Type	Description
6ea8e1e9aa	feat	Add a schematics to migrate to standalone: false. (#​57643)
3ebe6b4ad4	feat	Add async run method on ExperimentalPendingTasks (#​56546)
69fc5ae922	feat	Add incremental hydration public api (#​58249)
8ebbae88ca	feat	Add rxjs operator prevent app stability until an event (#​56533)
19edf2c057	feat	add syntactic sugar for initializers (#​53152)
c93b510f9b	feat	allow passing undefined without needing to include it in the type argument of input (#​57621)
ab25a192ba	feat	allow running output migration on a subset of paths (#​58299)
fc59e2a7b7	feat	change effect() execution timing & no-op allowSignalWrites (#​57874)
8bcc663a53	feat	drop support for TypeScript 5.4 (#​57577)
18d8d44b1f	feat	experimental resource() API for async dependencies (#​58255)
9762b24b5e	feat	experimental impl of rxResource() (#​58255)
6b8c494d05	feat	flipping the default value for standalone to true (#​58169)
e6e5d29e83	feat	initial version of the output migration (#​57604)
be2e49639b	feat	introduce afterRenderEffect (#​57549)
ec386e7f12	feat	introduce debugName optional arg to framework signal functions (#​57073)
8311f00faa	feat	introduce the reactive linkedSignal (#​58189)
1b1519224d	feat	mark input, output and model APIs as stable (#​57804)
a7eff3ffaa	feat	mark signal-based query APIs as stable (#​57921)
a1f229850a	feat	migrate ExperimentalPendingTasks to PendingTasks (#​57533)
3f1e7ab6ae	feat	promote outputFromObservable & outputToObservable to stable. (#​58214)
97c44a1d6c	feat	Promote takeUntilDestroyed to stable. (#​58200)
e5adf92965	feat	stabilize @let syntax (#​57813)
b063468027	feat	support TypeScript 5.6 (#​57424)
819ff034ce	feat	treat directives, pipes, components as by default (#​58229)
ee426c62f0	fix	allow signal write error (#​57973)
c095679f92	fix	avoid breaking change with apps using rxjs 6.x (#​58341)
71ee81af2c	fix	clean up event contract once hydration is done (#​58174)
f03d274e87	fix	ComponentFixture autoDetect feature works like production (#​55228)
950a5540f1	fix	Ensure the ViewContext is retained after closure minification (#​57903)
7b1e5be20b	fix	fallback to default ng-content with empty projectable nodes. (#​57480)
0300dd2e18	fix	Fix fixture.detectChanges with autoDetect disabled and zoneless (#​57416)
5fe57d4fbb	fix	fixes issues with control flow and incremental hydration (#​58644)
51933ef5a6	fix	prevent errors on contract cleanup (#​58614)
fd7716440b	fix	Prevents trying to trigger incremental hydration on CSR (#​58366)
656b5d3e78	fix	Re-assign error codes to be within core bounds (<1000) (#​53455)
6e0af6dbbb	fix	resolve forward-referenced host directives during directive matching (#​58492)
468d3fb9b1	fix	rethrow errors during ApplicationRef.tick in TestBed (#​57200)
226a67dabb	fix	Schedulers run in zone above Angular rather than root (#​57553)
97fb86d331	perf	set encapsulation to None for empty component styles (#​57130)
c15ec36bd1	refactor	remove deprecated factories Property in KeyValueDiffers (#​58064)

elements

Commit	Type	Description
fe5c4e086a	fix	support output()-shaped outputs (#​57535)
0cebfd7462	fix	switch to ComponentRef.setInput & remove custom scheduler (#​56728)

forms

Commit	Type	Description
3e7d724037	feat	add ability to clear a FormRecord (#​50750)
18b6f3339f	fix	fix FormRecord type inference (#​50750)

http

Commit	Type	Description
4b9accdf16	feat	promote withRequestsMadeViaParent to stable. (#​58221)
057cf7fb6b	fix	preserve all headers from Headers object (#​57802)

language-service

Commit	Type	Description
8da9fb49b5	feat	add code fix for unused standalone imports (#​57605)
1f067f4507	feat	add code reactoring action to migrate @Input to signal-input (#​57214)
56ee47f2ec	feat	allow code refactorings to compute edits asynchronously (#​57214)
bc83fc1e2e	feat	support converting to signal queries in VSCode extension (#​58106)
5c4305f024	feat	support migrating full classes to signal inputs in VSCode (#​57975)
6342befff8	feat	support migrating full classes to signal queries (#​58263)
7ecfd89592	fix	The suppress diagnostics option should work for external templates (#​57873)

localize

Commit	Type	Description
9c3bd1b5d1	refactor	remove deprecated name option. (#​58063)

migrations

Commit	Type	Description
dff4de0f75	feat	add a combined migration for all signals APIs (#​58259)
b6bc93803c	feat	add schematic to migrate to signal queries (#​58032)
2bfc64daf1	feat	expose output as function migration (#​58299)
59fe9bc772	feat	introduce signal input migration as ng generate schematic (#​57805)
90c7ec39a0	fix	inject migration always inserting generated variables before super call (#​58393)
7a65cdd911	fix	inject migration not inserting generated code after super call in some cases (#​58393)
c1aa411cf1	fix	properly resolve tsconfig paths on windows (#​58137)
e26797b38e	fix	replace removed NgModules in tests with their exports (#​58627)

platform-browser

Commit	Type	Description
c36a1c023b	fix	correctly add external stylesheets to ShadowDOM components (#​58482)
5c61f46409	refactor	remove deprecated BrowserModule.withServerTransition method (#​58062)

platform-server

Commit	Type	Description
9e82559de4	fix	destroy PlatformRef when error happens during the bootstrap() phase (#​58112)

router

Commit	Type	Description
f271021e19	feat	Add routerOutletData input to RouterOutlet directive (#​57051)
b2790813a6	fix	Align RouterModule.forRoot errorHandler with provider error handler (#​57050)
a49c35ec76	fix	remove setter for injector on OutletContext (#​58343)
7436d3180e	fix	Update Resolve interface to include RedirectCommand like ResolveFn (#​57309)

service-worker

Commit	Type	Description
8ddce80a0b	feat	allow specifying maxAge for entire application (#​49601)
1479af978c	feat	finish implementation of refreshAhead feature (#​53356)

v18.2.14

Compare Source

Breaking Changes

core

• The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

  Before:

  const bootstrap = () => bootstrapApplication(AppComponent, config);

  After:

  const bootstrap = (context: BootstrapContext) =>
    bootstrapApplication(AppComponent, config, context);

  A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

  In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.

  (cherry picked from commit 8bf80c9)

core

Commit	Type	Description
9d1fb33f5e	fix	introduce BootstrapContext for improved server bootstrapping (#​63640)

v18.2.13

Compare Source

migrations

Commit	Type	Description
06d70a25ea	fix	take care of tests that import both HttpClientModule & HttpClientTestingModule. (#​58777)

v18.2.12

Compare Source

compiler-cli

Commit	Type	Description
4c38160853	fix	correct extraction of generics from type aliases (#​58548)

v18.2.11

Compare Source

core

Commit	Type	Description
5f2d98a1b1	fix	avoid slow stringification when checking for duplicates in dev mode (#​58521)
3aa45a2fa1	fix	resolve forward-referenced host directives during directive matching (#​58492) (#​58500)

v18.2.10

Compare Source

compiler

Commit	Type	Description
69dce38e778	fix	transform pseudo selectors correctly for the encapsulated view. (#​58417)

localize

Commit	Type	Description
3b989ac5bd9	fix	Adding arb format to the list of valid formats in the localization extractor cli (#​58287)

v18.2.9

Compare Source

compiler-cli

Commit	Type	Description
b0ab653965	fix	report when NgModule imports or exports itself (#​58231)

v18.2.8

Compare Source

compiler

Commit	Type	Description
11692c8dab	fix	add multiple :host and nested selectors support (#​57796)
66dcc691f5	fix	allow combinators inside pseudo selectors (#​57796)
48a1437e77	fix	fix comment typo (#​57796)
d325f9b55f	fix	fix parsing of the :host-context with pseudo selectors (#​57796)
aea747ab3b	fix	preserve attributes attached to :host selector (#​57796)
21be258be6	fix	scope :host-context inside pseudo selectors, do not decrease specificity (#​57796)
7a6fd427d5	fix	transform pseudo selectors correctly for the encapsulated view (#​57796)

compiler-cli

Commit	Type	Description
f187c3abf8	fix	defer symbols only used in types (#​58104)

core

Commit	Type	Description
46bafb0b0a	fix	clean up afterRender after it is executed (#​58119)

platform-server

Commit	Type	Description
b40875a2cc	fix	destroy PlatformRef when error happens during the bootstrap() phase (#​58112) (#​58135)

v18.2.7

Compare Source

common

Commit	Type	Description
249d0260f9	fix	execute checks and remove placeholder when image is already loaded (#​55444)
46a2ad39f5	fix	prevent warning about oversize image twice (#​58021)
8f2b0ede59	fix	skip checking whether SVGs are oversized (#​57966)

compiler-cli

Commit	Type	Description
901c1e1a7f	fix	correctly get the type of nested function call expressions (#​57010)

core

Commit	Type	Description
2f347ef8fc	fix	provide flag to opt into manual cleanup for after render hooks (#​57917)

http

| Commit | Type | Description |
| --

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[aoe-renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: aoe-web-frontend/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @angular/compiler-cli@15.2.10
npm error Found: @angular/compiler@19.2.17
npm error node_modules/@angular/compiler
npm error   @angular/compiler@"^19.0.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer @angular/compiler@"15.2.10" from @angular/compiler-cli@15.2.10
npm error node_modules/@angular/compiler-cli
npm error   dev @angular/compiler-cli@"15.2.10" from the root project
npm error   peer @angular/compiler-cli@"^15.0.0" from @angular-devkit/build-angular@15.2.11
npm error   node_modules/@angular-devkit/build-angular
npm error     dev @angular-devkit/build-angular@"15.2.11" from the root project
npm error   1 more (@ngtools/webpack)
npm error
npm error Conflicting peer dependency: @angular/compiler@15.2.10
npm error node_modules/@angular/compiler
npm error   peer @angular/compiler@"15.2.10" from @angular/compiler-cli@15.2.10
npm error   node_modules/@angular/compiler-cli
npm error     dev @angular/compiler-cli@"15.2.10" from the root project
npm error     peer @angular/compiler-cli@"^15.0.0" from @angular-devkit/build-angular@15.2.11
npm error     node_modules/@angular-devkit/build-angular
npm error       dev @angular-devkit/build-angular@"15.2.11" from the root project
npm error     1 more (@ngtools/webpack)
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /tmp/renovate/cache/others/npm/_logs/2026-01-06T17_01_21_672Z-eresolve-report.txt
npm error A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2026-01-06T17_01_21_672Z-debug-0.log