chore(deps): bump @angular/core from 17.3.12 to 19.2.19 by dependabot[bot] · Pull Request #4331 · BuilderIO/builder

dependabot · 2026-03-02T09:47:53Z

Bumps @angular/core from 17.3.12 to 19.2.19.

Release notes

Sourced from @angular/core's releases.

19.2.19

core

Commit Description

block creation of sensitive URI attributes from ICU messages

Breaking Changes

core

Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

(cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

19.2.18

core

Commit Description

sanitize sensitive attributes on SVG script elements

19.2.17

compiler

Commit Description

prevent XSS via SVG animation attributeName and MathML/SVG URLs

19.2.16

http

Commit Description

prevent XSRF token leakage to protocol-relative URLs

19.2.15

core

Commit Description

introduce BootstrapContext for improved server bootstrapping (#63639)

Breaking Changes

core
The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

Before:
const bootstrap = () => bootstrapApplication(AppComponent, config);
After:
const bootstrap = (context: BootstrapContext) =>
  bootstrapApplication(AppComponent, config, context);
A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

... (truncated)

Changelog

Sourced from @angular/core's changelog.

19.2.19 (2026-02-25)

Breaking Changes

core

Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

(cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

core

Commit Type Description

747548721d fix block creation of sensitive URI attributes from ICU messages

20.3.17 (2026-02-25)

Breaking Changes

core

Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

(cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

core

Commit Type Description

7f9de3c118 fix block creation of sensitive URI attributes from ICU messages

21.2.0 (2026-02-25)

common

Commit Type Description

18003a33bb feat add an 'outlet' injector option for ngTemplateOutlet

8bbe6dc46c feat Add Location strategies to manage trailing slash on write

51cc914807 feat support height in ImageLoaderConfig and built-in loaders

compiler

Commit Type Description

72534e2a34 feat Add support for the instanceof binary operator

95b3f37d4a feat Exhaustive checks for switch blocks

04ba09a8d9 feat support AstVisitor.visitEmptyExpr()

ce80136e7b fix optimize away unnecessary restore/reset view calls

3242a61bae fix variable counter visiting some expressions twice

compiler-cli

Commit Type Description

473dd3e1cb fix attach source spans to object literal keys in TCB

a904d9f77b fix support nested component declaration

2ea6dfc6c9 fix update diagnostic to flag no-op arrow functions in listeners

core

... (truncated)

Commits

7475487 fix(core): block creation of sensitive URI attributes from ICU messages
26cdc53 fix(core): sanitize sensitive attributes on SVG script elements
7c42e2e fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs
70d0639 fix(core): introduce BootstrapContext for improved server bootstrapping (#6...
73d3e00 build: fix failing test (#61683)
9e1cd49 fix(migrations): preserve comments when removing unused imports (#61674)
a6d5479 build: migrate platform-server to rules_js (#61619)
2a26944 build: migrate platform-browser and platform-browser-dynamic package to use r...
2ae69f7 refactor: ensure tsurge migrations have clear ownership of files (#61612)
c101a3a refactor: clean-up deduplication workaround from migrations (#61421) (#61612)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

Medium Risk
Updates @angular/core across the Angular SDK dev/e2e/snippet workspaces, which can introduce breaking changes and peer-dependency/runtime mismatches with the remaining Angular 17 packages. Risk is limited to build/test tooling and example apps but may affect CI and SSR bootstrapping behavior.

Overview
Bumps @angular/core from the Angular 17.x line to ^19.2.19 in the Angular SDK’s dev setup (packages/sdks/output/angular) and the Angular 17 e2e + snippet workspaces (including SSR variants).

Regenerates yarn.lock accordingly, replacing the previous @angular/core@17.3.12 entry with 19.x resolutions (and updated zone.js peer range).

^{Written by Cursor Bugbot for commit 7d84487. This will update automatically on new commits. Configure here.}

Bumps [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) from 17.3.12 to 19.2.19. - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.19/packages/core) --- updated-dependencies: - dependency-name: "@angular/core" dependency-version: 19.2.19 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2026-03-02T09:48:01Z

⚠️ No Changeset found

Latest commit: 7d84487

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

cursor · 2026-03-02T09:50:03Z

packages/sdks/e2e/angular-17-ssr/package.json

    "@angular/common": "^17.3.0",
    "@angular/compiler": "^17.3.0",
-    "@angular/core": "^17.3.0",
+    "@angular/core": "^19.2.19",


Angular core v19 mixed with v17 sibling packages

High Severity

@angular/core is bumped to ^19.2.19 while all other @angular/* packages (animations, common, compiler, forms, platform-browser, platform-browser-dynamic, platform-server, router, ssr, compiler-cli, cli, build-angular) remain at ^17.3.0. Angular requires all framework packages to share the same major version. Additionally, @angular/core@19 requires zone.js: ~0.15.0 but these packages still specify zone.js: ~0.14.3. The properly configured angular-19-ssr e2e package demonstrates the correct pattern — all @angular/* packages at ^19.0.0 with zone.js: ~0.15.0. This mismatch will cause peer dependency conflicts and likely build or runtime failures across all five affected packages.

Additional Locations (2)

packages/sdks/e2e/angular-17/package.json#L16-L17

packages/sdks/output/angular/package.json#L36-L37

nx-cloud · 2026-03-02T09:51:58Z

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

_{To disable these notifications, a workspace admin can disable them in workspace settings.}

View your CI Pipeline Execution ↗ for commit 7d84487

Command	Status	Duration	Result
`nx test @e2e/angular-17`	❌ Failed	1m 18s	View ↗
`nx test @e2e/angular-17-ssr`	❌ Failed	1m 18s	View ↗
`nx test @e2e/angular-19-ssr`	❌ Failed	1m 19s	View ↗
`nx test @snippet/angular-17`	❌ Failed	1m 14s	View ↗
`nx test @snippet/angular-17-ssr`	❌ Failed	2m 1s	View ↗
`nx test @e2e/hydrogen`	✅ Succeeded	5m 8s	View ↗
`nx test @e2e/solid-start`	✅ Succeeded	4m 20s	View ↗
`nx test @e2e/react-sdk-next-pages`	✅ Succeeded	5m 9s	View ↗
`Additional runs (37)`	✅ Succeeded	...	View ↗

☁️ Nx Cloud last updated this comment at 2026-03-02 10:11:07 UTC

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 2, 2026

cursor bot reviewed Mar 2, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump @angular/core from 17.3.12 to 19.2.19#4331

chore(deps): bump @angular/core from 17.3.12 to 19.2.19#4331
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/angular/core-19.2.19

dependabot bot commented on behalf of github Mar 2, 2026 •

edited by cursor bot

Loading

Uh oh!

changeset-bot bot commented Mar 2, 2026

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Mar 2, 2026

Uh oh!

nx-cloud bot commented Mar 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Type	Description
18003a33bb	feat	add an 'outlet' injector option for ngTemplateOutlet
8bbe6dc46c	feat	Add Location strategies to manage trailing slash on write
51cc914807	feat	support height in ImageLoaderConfig and built-in loaders

Commit	Type	Description
72534e2a34	feat	Add support for the `instanceof` binary operator
95b3f37d4a	feat	Exhaustive checks for switch blocks
04ba09a8d9	feat	support `AstVisitor.visitEmptyExpr()`
ce80136e7b	fix	optimize away unnecessary restore/reset view calls
3242a61bae	fix	variable counter visiting some expressions twice

Commit	Type	Description
473dd3e1cb	fix	attach source spans to object literal keys in TCB
a904d9f77b	fix	support nested component declaration
2ea6dfc6c9	fix	update diagnostic to flag no-op arrow functions in listeners

Conversation

dependabot bot commented on behalf of github Mar 2, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

19.2.19

core

Breaking Changes

core

19.2.18

core

19.2.17

compiler

19.2.16

http

19.2.15

core

Breaking Changes

core

19.2.19 (2026-02-25)

Breaking Changes

core

core

20.3.17 (2026-02-25)

Breaking Changes

core

core

21.2.0 (2026-02-25)

common

compiler

compiler-cli

core

Uh oh!

changeset-bot bot commented Mar 2, 2026

⚠️ No Changeset found

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Mar 2, 2026

Choose a reason for hiding this comment

Angular core v19 mixed with v17 sibling packages

Uh oh!

nx-cloud bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Nx Cloud AI Fix Eligible

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Mar 2, 2026 •

edited by cursor bot

Loading

nx-cloud bot commented Mar 2, 2026 •

edited

Loading