Skip to content

Bump @angular/compiler from 20.3.2 to 20.3.18 in /animated-transformer - #93

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/animated-transformer/angular/compiler-20.3.18
Closed

Bump @angular/compiler from 20.3.2 to 20.3.18 in /animated-transformer#93
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/animated-transformer/angular/compiler-20.3.18

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubMar 14, 2026

Copy link
Copy Markdown
Contributor

Bumps @angular/compiler from 20.3.2 to 20.3.18.

Release notes

Sourced from @​angular/compiler's releases.

20.3.18

compiler

CommitDescription
fix - 02fbf08890disallow translations of iframe src

core

CommitDescription
fix - 72126f9a08sanitize translated attribute bindings with interpolations
fix - 626bc8bc20sanitize translated form attributes

20.3.17

core

CommitDescription
fix - 7f9de3c118block creation of sensitive URI attributes from ICU messages

Breaking Changes

core

  • Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

    (cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

20.3.16

core

CommitDescription
fix - c2c2b4aaa8sanitize sensitive attributes on SVG script elements

20.3.15

compiler

CommitDescription
fix - d1ca8ae043prevent XSS via SVG animation attributeName and MathML/SVG URLs

20.3.14

http

CommitDescription
fix - 0276479e7dprevent XSRF token leakage to protocol-relative URLs

20.3.13

No release notes provided.

20.3.12

No release notes provided.

20.3.11

common

CommitDescription

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

20.3.18 (2026-03-12)

compiler

CommitTypeDescription
02fbf08890fixdisallow translations of iframe src

core

CommitTypeDescription
72126f9a08fixsanitize translated attribute bindings with interpolations
626bc8bc20fixsanitize translated form attributes

22.0.0-next.3 (2026-03-12)

compiler

CommitTypeDescription
78dea55351fixdisallow translations of iframe src

core

CommitTypeDescription
999c14eaabfixreverts "feat(core): add support for nested animations"
de0eb4c656fixsanitize translated form attributes

21.2.4 (2026-03-12)

compiler

CommitTypeDescription
ed2d324f9cfixdisallow translations of iframe src

core

CommitTypeDescription
abbd8797bbfixreverts "feat(core): add support for nested animations"
d1dcd16c5bfixsanitize translated form attributes

22.0.0-next.2 (2026-03-11)

Breaking Changes

core

  • createNgModuleRef was removed, use createNgModule instead

core

CommitTypeDescription
b918beda32featallow debouncing signals

... (truncated)

Commits
  • 02fbf08 fix(compiler): disallow translations of iframe src
  • c2c2b4a fix(core): sanitize sensitive attributes on SVG script elements
  • d1ca8ae fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs
  • f689269 Revert "fix(compiler): support one additional level of nesting in :host()"
  • 7b2e6ca Revert "fix(compiler): support arbitrary nesting in :host-context()"
  • 6036eef Revert "fix(compiler): support commas in :host() argument"
  • a44658b Revert "fix(compiler): support complex selectors in :nth-child()"
  • 9419ea3 fix(compiler): support complex selectors in :nth-child()
  • 2531863 test(compiler): add test for :host:has(> .foo)
  • 106b904 fix(compiler): support commas in :host() argument
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) from 20.3.2 to 20.3.18.
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.18/packages/compiler)
---
updated-dependencies:
- dependency-name: "@angular/compiler"
dependency-version: 20.3.18
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 14, 2026
@dependabot@github

dependabotBot commented on behalf of githubJun 15, 2026

Copy link
Copy Markdown
ContributorAuthor

Superseded by #104.

@dependabotdependabotBot closed this Jun 15, 2026
@dependabot
dependabotBot deleted the dependabot/npm_and_yarn/animated-transformer/angular/compiler-20.3.18 branch June 15, 2026 18:43
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants