[Snyk] Security upgrade @angular/compiler from 8.0.0 to 19.2.17#54
[Snyk] Security upgrade @angular/compiler from 8.0.0 to 19.2.17#54DaSchTour wants to merge 1 commit into
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-ANGULARCOMPILER-14157154
There was a problem hiding this comment.
Pull request overview
This PR upgrades @angular/compiler from version 8.0.0 to 19.2.17 to fix a high-severity Cross-site Scripting (XSS) vulnerability (SNYK-JS-ANGULARCOMPILER-14157154, score 706).
- Upgrades
@angular/compilerpackage to address security vulnerability - Upgrades from Angular 8 to Angular 19 (an 11 major version jump)
- Note: The PR description warns that package-lock.json update failed and needs manual update
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "@angular/animations": "~8.0.0", | ||
| "@angular/common": "~8.0.0", | ||
| "@angular/compiler": "~8.0.0", | ||
| "@angular/compiler": "~19.2.17", |
There was a problem hiding this comment.
Upgrading only @angular/compiler to version 19.2.17 while keeping all other Angular packages at version 8.0.0 will cause severe compatibility issues. Angular packages are designed to work together at the same major version.
All Angular packages should be upgraded together:
@angular/animations: ~8.0.0@angular/common: ~8.0.0@angular/core: ~8.0.0@angular/forms: ~8.0.0@angular/platform-browser: ~8.0.0@angular/platform-browser-dynamic: ~8.0.0@angular/router: ~8.0.0@angular/compiler-cli: ~8.0.0 (in devDependencies)@angular/cli: ~8.0.0 (in devDependencies)
Additionally, upgrading from Angular 8 to Angular 19 is a major version jump spanning 11 major versions. This requires a careful incremental upgrade process following the Angular Update Guide, as there are numerous breaking changes between these versions.
| "@angular/compiler": "~19.2.17", | |
| "@angular/compiler": "~8.0.0", |
Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-ANGULARCOMPILER-14157154
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Cross-site Scripting (XSS)