Skip to content

Conversation

@yogeshchoudhary147
Copy link
Contributor

@yogeshchoudhary147 yogeshchoudhary147 commented Dec 24, 2025

Angular 19 Dependency Update

Updates Angular dependencies to v19 to fix critical Snyk vulnerabilities.

Security Vulnerabilities Fixed

1. @angular/common@18.2.13

  • CVE-2025-66035 - Insertion of Sensitive Information Into Sent Data
  • Severity: High (CVSS 7.7)
  • Fixed in: 19.2.16+
  • Snyk Issue: SNYK-JS-ANGULARCOMMON-14135651

2. @angular/compiler@18.2.13

  • CVE-2025-66412 - Cross-site Scripting (XSS)
  • Severity: High (CVSS 8.4)
  • Fixed in: 19.2.17+
  • Snyk Issue: SNYK-JS-ANGULARCOMPILER-14157154

Changes

  • Angular: 18.2.13 → 19.2.17 ✅ (fixes both CVEs)
  • TypeScript: 5.5.x → 5.8.3
  • All related dependencies updated to Angular 19
  • Added standalone: false to playground components for Angular 19 compatibility
  • Disabled prefer-standalone ESLint rule in playground

SDK Changes

None - The SDK API is unchanged. This only updates dependencies.

For Consumers

If you're on Angular 18, upgrade to Angular 19 first:

ng update @angular/core@19 @angular/cli@19
npm install @auth0/auth0-angular@latest

- Update all @angular/* packages to 19.2.17
- Update @angular/cli and @Angular-devkit to 19.2.19
- Update @angular-eslint packages to 19.0.0
- Update ng-packagr to 19.2.2
- Update zone.js to 0.15.1
- Update TypeScript to 5.8.3

This upgrade addresses Snyk security vulnerabilities:
- @angular/common@18.2.13 → @angular/common@19.2.17
- @angular/compiler@18.2.13 → @angular/compiler@19.2.17

Skipped optional migrations:
- use-application-builder (deferred for separate PR)
- provide-initializer (deferred for separate PR)

All tests passing. No breaking changes for library consumers.
@yogeshchoudhary147 yogeshchoudhary147 requested a review from a team as a code owner December 24, 2025 04:38
- Convert AppComponent and test components to standalone
- Add required imports (NgIf, AsyncPipe, UpperCasePipe, etc.)
- Update test configuration to import standalone components
- Fix all linting errors related to standalone components
- Move all standalone components to imports array in AppModule
- Move LazyModuleComponent to imports in LazyModuleModule
- Empty declarations arrays since all components are now standalone
@yogeshchoudhary147 yogeshchoudhary147 changed the title chore: Upgrade to Angular 19.2.17 chore: Upgrade to Angular 19.2.17 and migrate to standalone components Dec 24, 2025
@yogeshchoudhary147 yogeshchoudhary147 changed the title chore: Upgrade to Angular 19.2.17 and migrate to standalone components chore: upgrade to Angular 19 (BREAKING CHANGE) Dec 24, 2025
@gyaneshgouraw-okta
Copy link
Contributor

@yogeshchoudhary147 We should update MIGRATION_GUIDE for changes made in this PR.

@yogeshchoudhary147 yogeshchoudhary147 marked this pull request as draft December 24, 2025 07:38
@yogeshchoudhary147 yogeshchoudhary147 changed the title chore: upgrade to Angular 19 (BREAKING CHANGE) chore: update to Angular 19 Dec 26, 2025
@yogeshchoudhary147 yogeshchoudhary147 marked this pull request as ready for review December 26, 2025 11:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants