Skip to content

build(deps): bump @angular/core from 19.2.18 to 19.2.20 - #17

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/angular/core-19.2.20
Open

build(deps): bump @angular/core from 19.2.18 to 19.2.20#17
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/angular/core-19.2.20

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubMar 14, 2026

Copy link
Copy Markdown
Contributor

Bumps @angular/core from 19.2.18 to 19.2.20.

Release notes

Sourced from @​angular/core's releases.

19.2.20

compiler

CommitDescription
fix - 5be912eb55disallow translations of iframe src

core

CommitDescription
fix - b89b0a83a4sanitize translated attribute bindings with interpolations
fix - 621c7071adsanitize translated form attributes

19.2.19

core

CommitDescription
fix - 747548721dblock creation of sensitive URI attributes from ICU messages

Breaking Changes

core

  • Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

    (cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

Changelog

Sourced from @​angular/core's changelog.

19.2.20 (2026-03-12)

compiler

CommitTypeDescription
5be912eb55fixdisallow translations of iframe src

core

CommitTypeDescription
b89b0a83a4fixsanitize translated attribute bindings with interpolations
621c7071adfixsanitize translated form attributes

20.3.18 (2026-03-12)

compiler

CommitTypeDescription
02fbf08890fixdisallow translations of iframe src

core

CommitTypeDescription
72126f9a08fixsanitize translated attribute bindings with interpolations
626bc8bc20fixsanitize translated form attributes

22.0.0-next.3 (2026-03-12)

compiler

CommitTypeDescription
78dea55351fixdisallow translations of iframe src

core

CommitTypeDescription
999c14eaabfixreverts "feat(core): add support for nested animations"
de0eb4c656fixsanitize translated form attributes

21.2.4 (2026-03-12)

compiler

CommitTypeDescription
ed2d324f9cfixdisallow translations of iframe src

core

CommitTypeDescription

... (truncated)

Commits
  • 621c707 fix(core): sanitize translated form attributes
  • b89b0a8 fix(core): sanitize translated attribute bindings with interpolations
  • 7475487 fix(core): block creation of sensitive URI attributes from ICU messages
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) from 19.2.18 to 19.2.20.
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v19.2.20/packages/core)
---
updated-dependencies:
- dependency-name: "@angular/core"
dependency-version: 19.2.20
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 14, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants