Skip to content

chore(deps-dev): bump @angular/core from 20.3.10 to 20.3.18#3701

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/angular/core-20.3.18
Open

chore(deps-dev): bump @angular/core from 20.3.10 to 20.3.18#3701
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/angular/core-20.3.18

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 14, 2026

Bumps @angular/core from 20.3.10 to 20.3.18.

Release notes

Sourced from @​angular/core's releases.

20.3.18

compiler

Commit Description
fix - 02fbf08890 disallow translations of iframe src

core

Commit Description
fix - 72126f9a08 sanitize translated attribute bindings with interpolations
fix - 626bc8bc20 sanitize translated form attributes

20.3.17

core

Commit Description
fix - 7f9de3c118 block creation of sensitive URI attributes from ICU messages

Breaking Changes

core

  • Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

    (cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

20.3.16

core

Commit Description
fix - c2c2b4aaa8 sanitize sensitive attributes on SVG script elements

20.3.15

compiler

Commit Description
fix - d1ca8ae043 prevent XSS via SVG animation attributeName and MathML/SVG URLs

20.3.14

http

Commit Description
fix - 0276479e7d prevent XSRF token leakage to protocol-relative URLs

20.3.13

No release notes provided.

20.3.12

No release notes provided.

20.3.11

common

Commit Description

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

20.3.18 (2026-03-12)

compiler

Commit Type Description
02fbf08890 fix disallow translations of iframe src

core

Commit Type Description
72126f9a08 fix sanitize translated attribute bindings with interpolations
626bc8bc20 fix sanitize translated form attributes

22.0.0-next.3 (2026-03-12)

compiler

Commit Type Description
78dea55351 fix disallow translations of iframe src

core

Commit Type Description
999c14eaab fix reverts "feat(core): add support for nested animations"
de0eb4c656 fix sanitize translated form attributes

21.2.4 (2026-03-12)

compiler

Commit Type Description
ed2d324f9c fix disallow translations of iframe src

core

Commit Type Description
abbd8797bb fix reverts "feat(core): add support for nested animations"
d1dcd16c5b fix sanitize translated form attributes

22.0.0-next.2 (2026-03-11)

Breaking Changes

core

  • createNgModuleRef was removed, use createNgModule instead

core

Commit Type Description
b918beda32 feat allow debouncing signals

... (truncated)

Commits
  • 626bc8b fix(core): sanitize translated form attributes
  • 72126f9 fix(core): sanitize translated attribute bindings with interpolations
  • 7f9de3c fix(core): block creation of sensitive URI attributes from ICU messages
  • c2c2b4a fix(core): sanitize sensitive attributes on SVG script elements
  • d1ca8ae fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs
  • 820bb39 Revert "refactor(core): let the profiler handle asymmetric events leniently"
  • 2dccdcd Revert "fix(core): notify profiler events in case of errors"
  • a966ff1 refactor(core): let the profiler handle asymmetric events leniently
  • 52cf658 fix(core): notify profiler events in case of errors
  • daae263 docs: Adds links to relevant guides for APIs in core package
  • Additional commits viewable in compare view

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 14, 2026
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/angular/core-20.3.18 branch 5 times, most recently from 8d3d3f4 to 3eab9d8 Compare April 3, 2026 19:43
Bumps [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) from 20.3.10 to 20.3.18.
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.18/packages/core)

---
updated-dependencies:
- dependency-name: "@angular/core"
  dependency-version: 20.3.18
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/angular/core-20.3.18 branch from 3eab9d8 to 9d18d9b Compare April 4, 2026 15:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants