Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency @angular/core to v11 [security] #20

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(deps): update dependency @angular/core to v11 [security] #20

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Jun 18, 2022

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@angular/core ~9.0.7 -> ~11.0.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2021-4231

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component.

Release Notes

angular/angular

v11.0.5

Compare Source

Bug Fixes

v11.0.4

Compare Source

Bug Fixes
Performance Improvements

v11.0.3

Compare Source

Bug Fixes
DEPRECATIONS
  • forms: Mark the {[key: string]: any} type for the options property of the FormBuilder.group method as deprecated. Using AbstractControlOptions gives the same functionality and is type-safe.

v11.0.2

Compare Source

Bug Fixes

v11.0.1

Compare Source

Bug Fixes
Performance Improvements
  • compiler: optimize computation of i18n message ids (#​39694) (1891455)
  • compiler: use raw bytes to represent utf-8 encoded strings (#​39694) (882ff8f)
  • compiler-cli: reduce filesystem hits during resource resolution (#​39604) (a7adcbd)

v11.0.0

Compare Source

Blog post "Version 11 of Angular Now Available".

Bug Fixes
Features
Performance Improvements
  • compiler-cli: only emit directive/pipe references that are used (#​38539) (077f516)
  • compiler-cli: optimize computation of type-check scope information (#​38539) (297c060)
  • compiler-cli: only generate template context declaration when used (#​39321) (1ac0500)
  • core: do not recurse into modules that have already been registered (#​39514) (5c13c67), closes #​39487
  • router: use ngDevMode to tree-shake error messages in router (#​38674) (db21c4f)
BREAKING CHANGES
  • common:
    • 6acea54:
      The locale data API has been marked as returning readonly arrays, rather than mutable arrays, since these arrays are shared across calls to the API.
      If you were mutating them (e.g. calling sort(), push(), splice(), etc.) then your code will no longer compile.
      If you need to mutate the array, you should now make a copy (e.g. by calling slice()) and mutate the copy.
    • 26f2820:
      When passing a date-time formatted string to the DatePipe in a format that contains fractions of a millisecond, the milliseconds will now always be rounded down rather than to the nearest millisecond.
      Most applications will not be affected by this change.
      If this is not the desired behaviour then consider pre-processing the string to round the millisecond part before passing it to the DatePipe.
    • 4744c22:
      The slice pipe now returns null for the undefined input value, which is consistent with the behavior of most pipes.
      If you rely on undefined being the result in that case, you now need to check for it explicitly.
    • 4dfe0fa:
      The typing of the keyvalue pipe has been fixed to report that for input objects that have number keys, the result will contain the string representation of the keys.
      This was already the case and the types have simply been updated to reflect this.
      Please update the consumers of the pipe output if they were relying on the incorrect types.
      Note that this does not affect use cases where the input values are Maps, so if you need to preserve numbers, this is an effective way.
    • 7b2aac9:
      The signatures of the number pipes now explicitly state which types are accepted.
      This should only cause issues in corner cases, as any other values would result in runtime exceptions.
    • daf8b7f:
      The signature of the date pipe now explicitly states which types are accepted.
      This should only cause issues in corner cases, as any other values would result in runtime exceptions.
    • 5f815c0:
      The async pipe no longer claims to return undefined for an input that was typed as undefined.
      Note that the code actually returned null on undefined inputs.
      In the unlikely case you were relying on this, please fix the typing of the consumers of the pipe output.
    • c7d5555:
      The case conversion pipes no longer let falsy values through.
      They now map both null and undefined to null and raise an exception on invalid input (0, false, NaN) just like most "common pipes".
      If your code required falsy values to pass through, you need to handle them explicitly.
  • compiler:
    • 736e064:
      TypeScript 3.9 is no longer supported, please upgrade to TypeScript 4.0.
  • compiler-cli:
    • 0a16e60:
      Expressions within ICUs are now type-checked again, fixing a regression in Ivy.
      This may cause compilation failures if errors are found in expressions that appear within an ICU.
      Please correct these expressions to resolve the type-check errors.
  • core:
    • fdea180:
      CollectionChangeRecord has been removed, use IterableChangeRecord instead.
    • c8f056b:
      If you call TestBed.overrideProvider after TestBed initialization, provider overrides are not applied.
      This behavior is consistent with other override methods (such as TestBed.overrideDirective, etc) but they throw an error to indicate that, when the check was missing in the TestBed.overrideProvider function.
      Now calling TestBed.overrideProvider after TestBed initialization also triggers an error, thus there is a chance that some tests (where TestBed.overrideProvider is called after TestBed initialization) will start to fail and require updates to move TestBed.overrideProvider calls before TestBed initialization is completed.
    • 4ca1c73:
      In v10, IE 9, 10, and IE mobile support was deprecated.
      In v11, Angular framework removes IE 9, 10, and IE mobile support completely.
      Supporting outdated browsers like these increases bundle size, code complexity, and test load, and also requires time and effort that could be spent on improvements to the framework.
      For example, fixing issues can be more difficult, as a straightforward fix for modern browsers could break old ones that have quirks due to not receiving updates from vendors.
    • 4a1c12c:
      ViewEncapsulation.Native has been removed. Use ViewEncapsulation.ShadowDom instead.
      Existing usages will be updated automatically by ng update.
  • forms:
    • d9fea85:
      Previously if FormControl, FormGroup and FormArray class instances had async validators defined at initialization time, the status change event was not emitted once async validators completed.
      After this change the status event is emitted into the statusChanges observable.
      If your code relies on the old behavior, you can filter/ignore this additional status change event.
    • 246de9a:
      Directives in the @angular/forms package used to have any[] as a type of validators and asyncValidators arguments in constructors.
      Now these arguments are properly typed, so if your code relies on directive constructor types it may require some updates to improve type safety.
    • f4f1bcc:
      Type of AbstractFormControl.parent now includes null.
      null is now included in the types of .parent.
      If you don't already have a check for this case, the TypeScript compiler might complain.
      A v11 migration exists which adds the non-null assertion operator where necessary.
      In an unlikely case your code was testing the parent against undefined with strict equality, you'll need to change this to === null instead, since the parent is now explicitly initialized with null instead of being left undefined.
  • platform-server:
    • b4e8399:
      If you use useAbsoluteUrl to setup platform-server, you now need to also specify baseUrl.
      We are intentionally making this a breaking change in a minor release, because if useAbsoluteUrl is set to true then the behavior of the application could be unpredictable, resulting in issues that are hard to discover but could be affecting production environments.
  • platform-webworker:
  • router:
    • 3817e5f:
      This change corrects the argument order when calling RouteReuseStrategy#shouldReuseRoute.
      Previously, when evaluating child routes, they would be called with the future and current arguments would be swapped.
      If your RouteReuseStrategy relies specifically on only the future or current snapshot state, you may need to update the shouldReuseRoute implementation's use of "future" and "current" ActivatedRouteSnapshots.
    • e4f4d18:
      While the new parameter types allow a variable of type NavigationExtras to be passed in, they will not allow object literals, as they may only specify known properties.
      They will also not accept types that do not have properties in common with the ones in the Pick.
      To fix this error, only specify properties from the NavigationExtras which are actually used in the respective function calls or use a type assertion on the object or variable: as NavigationExtras.
    • 837889f:
      This commit changes the default value of relativeLinkResolution from 'legacy' to 'default'.
      If your application previously used the default by not specifying a value in the ExtraOptions and uses relative links when navigating from children of empty path routes, you will need to update your RouterModule to specifically specify 'legacy' for relativeLinkResolution.
      See https://angular.io/api/router/ExtraOptions#relativeLinkResolution for more details.
    • c4becca:
      The initialNavigation property for the options in RouterModule.forRoot no longer supports legacy_disabled, legacy_enabled, true, or false as valid values.
      legacy_enabled (the old default) is instead enabledNonBlocking.
    • c4becca:
      enabled is deprecated as a valid value for the RouterModule.forRoot initialNavigation option.
      enabledBlocking has been introduced to replace it.
    • 783a5bd:
      preserveQueryParams has been removed, use queryParamsHandling: "preserve" instead.
    • b0b4953:
      If you were accessing the RouterLink values of queryParams, fragment or queryParamsHandling you might need to relax the typing to also accept undefined and null.
Code Refactoring

v10.2.5

Compare Source

v10.2.4

Compare Source

v10.2.3

Compare Source

v10.2.2

Compare Source

v10.2.1

Compare Source

v10.2.0

Compare Source

v10.1.6

Compare Source

v10.1.5

Compare Source

v10.1.4

Compare Source

v10.1.3

Compare Source

v10.1.2

Compare Source

v10.1.1

Compare Source

v10.1.0

Compare Source

v10.0.14

Compare Source

v10.0.13

Compare Source

v10.0.12

Compare Source

v10.0.11

Compare Source

v10.0.10

Compare Source

v10.0.9

Compare Source

v10.0.8

Compare Source

v10.0.7

Compare Source

v10.0.6

Compare Source

v10.0.5

Compare Source

v10.0.4

Compare Source

v10.0.3

Compare Source

v10.0.2

Compare Source

v10.0.1

Compare Source

v10.0.0

Compare Source

v9.1.13

Compare Source

v9.1.12

Compare Source

v9.1.11

Compare Source

v9.1.10

Compare Source

v9.1.9

Compare Source

v9.1.8

Compare Source

v9.1.7

Compare Source

v9.1.6

Compare Source

v9.1.5

Compare Source

v9.1.4

Compare Source

v9.1.3

Compare Source

v9.1.2

Compare Source

v9.1.1

Compare Source

v9.1.0

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, click this checkbox.

This PR has been generated by Mend Renovate. View repository job log here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants