Skip to content
This repository was archived by the owner on Oct 12, 2024. It is now read-only.

fix(deps): update dependency @angular/core to v12 [security] - autoclosed #68

Closed
wants to merge 1 commit into from
Closed

fix(deps): update dependency @angular/core to v12 [security] - autoclosed #68

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Sep 25, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@angular/core (source) 11.2.14 -> 12.0.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2021-4231

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 10.2.5, 11.0.5 or 11.1.0-next.3 is advised to to address this issue.

Release Notes

angular/angular (@​angular/core)

v12.0.0

Compare Source

12.0.0 (2021-05-12)
Bug Fixes
Build System
Features
Performance Improvements
BREAKING CHANGES
  • Minified UMD bundles are no longer included in the distributed NPM packages.
  • animations: DOM elements are now correctly removed when the root view is removed.
    If you are using SSR and use the app's HTML for rendering, you will need
    to ensure that you save the HTML to a variable before destorying the
    app.
    It is also possible that tests could be accidentally relying on the old behavior by
    trying to find an element that was not removed in a previous test. If
    this is the case, the failing tests should be updated to ensure they
    have proper setup code which initializes elements they rely on.
  • common: Methods of the PlatformLocation class, namely onPopState and onHashChange,
    used to return void. Now those methods return functions that can be called
    to remove event handlers.
  • common: The methods of the HttpParams class now accept string | number | boolean
    instead of string for the value of a parameter.
    If you extended this class in your application,
    you'll have to update the signatures of your methods to reflect these changes.
  • compiler-cli: Linked libraries no longer generate legacy i18n message ids. Any downstream
    application that provides translations for these messages, will need to
    migrate their message ids using the localize-migrate command line tool.
  • core: Angular no longer maintains support for node v10
  • core: Previously the ng.getDirectives function threw an error in case a
    given DOM node had no Angular context associated with it (for example
    if a function was called for a DOM element outside of an Angular app).
    This behavior was inconsistent with other debugging utilities under ng
    namespace, which handled this situation without raising an exception.
    Now calling the ng.getDirectives function for such DOM nodes would
    result in an empty array returned from that function.
  • core: Switching default of emitDistinctChangesOnlyDefaultValue
    which changes the default behavior and may cause some applications which
    rely on the incorrect behavior to fail.

emitDistinctChangesOnly flag has also been deprecated and will be
removed in a future major release.

The previous implementation would fire changes QueryList.changes.subscribe
whenever the QueryList was recomputed. This resulted in an artificially
high number of change notifications, as it is possible that recomputing
QueryList results in the same list. When the QueryList gets recomputed
is an implementation detail, and it should not be the thing that determines
how often change event should fire.

Unfortunately, fixing the behavior outright caused too many existing
applications to fail. For this reason, Angular considers this fix a
breaking fix and has introduced a flag in @ContentChildren and
@ViewChildren, that controls the behavior.

export class QueryCompWithStrictChangeEmitParent {
  @​ContentChildren('foo', {
    // This option is the new default with this change.
    emitDistinctChangesOnly: true,
  })
  foos!: QueryList<any>;
}

For backward compatibility before v12
emitDistinctChangesOnlyDefaultValue was set to false. This change
changes the default to true.

  • core: The type of the APP_INITIALIZER token has been changed to more accurately
    reflect the types of return values that are handled by Angular. Previously,
    each initializer callback was typed to return any, this is now
    Promise<unknown> | Observable<unknown> | void. In the unlikely event that
    your application uses the Injector.get or TestBed.inject API to inject
    the APP_INITIALIZER token, you may need to update the code to account for
    the stricter type.

Additionally, TypeScript may report the TS2742 error if the APP_INITIALIZER
token is used in an expression of which its inferred type has to be emitted
into a .d.ts file. To workaround this, an explicit type annotation is needed,
which would typically be Provider or Provider[].

  • core: Minimum supported zone.js version is 0.11.4

  • forms: The emitEvent option was added to the following FormArray and FormGroup methods:

  • FormGroup.addControl

  • FormGroup.removeControl

  • FormGroup.setControl

  • FormArray.push

  • FormArray.insert

  • FormArray.removeAt

  • FormArray.setControl

  • FormArray.clear

If your app has custom classes that extend FormArray or FormGroup classes and override the
above-mentioned methods, you may need to update your implementation to take the new options into
account and make sure that overrides are compatible from a types perspective.

  • forms: Previously min and max attributes defined on the <input type="number">
    were ignored by Forms module. Now presence of these attributes would
    trigger min/max validation logic (in case formControl, formControlName
    or ngModel directives are also present on a given input) and
    corresponding form control status would reflect that.
  • platform-browser: XhrFactory has been moved from @angular/common/http to @angular/common.

Before

import {XhrFactory} from '@&#8203;angular/common/http';

After

import {XhrFactory} from '@&#8203;angular/common';
  • router: Strict null checks will report on fragment potentially being null.
    Migration path: add null check.
  • router: The type of the RouterLinkActive.routerLinkActiveOptions input was
    expanded to allow more fine-tuned control. Code that previously read
    this property may need to be updated to account for the new type.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate Renovate
Copy link
Contributor Author

renovate bot commented Sep 25, 2024

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: ngx-socketio2-workspace@0.0.0
npm ERR! Found: zone.js@0.10.3
npm ERR! node_modules/zone.js
npm ERR!   zone.js@"0.10.3" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer zone.js@"~0.11.4" from @angular/core@12.0.0
npm ERR! node_modules/@angular/core
npm ERR!   @angular/core@"12.0.0" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /tmp/renovate/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate/cache/others/npm/_logs/2024-09-25T14_41_14_718Z-debug-0.log

@renovate renovate bot changed the title fix(deps): update dependency @angular/core to v12 [security] fix(deps): update dependency @angular/core to v12 [security] - autoclosed Sep 25, 2024
@renovate renovate bot closed this Sep 25, 2024
@renovate renovate bot deleted the renovate/npm-angular-core-vulnerability branch September 25, 2024 20:00
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants