chore(deps): update dependency @angular/common [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@angular/common (source)	^9.1.12 → ^9.1.12 || ^22.0.0
@angular/common (source)	~9.1.12 → ~19.2.0

---

Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

CVE-2025-66035 / GHSA-58c5-g7wp-6w37

More information

Details

The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain.

Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header.

Impact

The token leakage completely bypasses Angular's built-in CSRF protection, allowing an attacker to capture the user's valid XSRF token. Once the token is obtained, the attacker can perform arbitrary Cross-Site Request Forgery (CSRF) attacks against the victim user's session.

Attack Preconditions

1. The victim's Angular application must have XSRF protection enabled.
2. The attacker must be able to make the application send a state-changing HTTP request (e.g., POST) to a protocol-relative URL (e.g., //attacker.com) that they control.

Patches

• 19.2.16
• 20.3.14
• 21.0.1

Workarounds

Developers should avoid using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
• https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
• https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
• https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
• https://github.com/angular/angular/releases/tag/19.2.16
• https://github.com/angular/angular/releases/tag/20.3.14
• https://github.com/angular/angular/releases/tag/21.0.1
• https://nvd.nist.gov/vuln/detail/CVE-2025-66035
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html
• https://cert-portal.siemens.com/productcert/html/ssa-485750.html
• https://github.com/advisories/GHSA-58c5-g7wp-6w37

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/common)

v22.0.7

Compare Source

common

Commit	Type	Description
91e33aa1de	fix	avoid prototype lookups in date format caches

compiler

Commit	Type	Description
5b516e3a58	fix	parsing of an empty template literal interpolation

compiler-cli

Commit	Type	Description
c88ddde1c9	fix	re-tag SourceFiles after TsCreateProgramDriver.updateFiles()

core

Commit	Type	Description
94d9591b51	fix	allow static attributes for explicit input transforms
c89f71a74c	fix	ignore processing instruction syntax in templates
70500e4067	fix	preserve explicit input transform write type

forms

Commit	Type	Description
1b9964675f	fix	allow multiple async validators
64d6d47a0c	fix	preserve intermediate number values in signal forms
6cf7446afa	fix	prevent stale CVA writeback during debounce

http

Commit	Type	Description
20b7dc3023	fix	prevent interceptor signal reads from leaking into calling reactive contexts

localize

Commit	Type	Description
22d5a091d1	fix	build runtime translations map with a null prototype
8ce1fcf7fa	fix	use Object.hasOwn for placeholder lookup in translate

platform-browser

Commit	Type	Description
b34bf0dce8	fix	prevent ReDoS in SOURCEMAP_URL_REGEXP

v22.0.6

Compare Source

compiler

Commit	Type	Description
fd4ddcafed	fix	use regular optional chaining expression for safe function calls in TCBs

compiler-cli

Commit	Type	Description
534fe81a89	fix	apply debugName transform to required signal queries
3b08201bfb	fix	detect uninvoked signals in bound expressions using ternary

forms/signals

Commit	Type	Description
171669f7b2	fix	make extractValue reactive for compat AbstractControl values

migrations

Commit	Type	Description
0a6af1496b	fix	preserve transitive NgModule references when pruning
d4a926a762	fix	remove stale model import in model-output migration

router

Commit	Type	Description
c238bd2ad7	fix	handle outlet named proto in segment group maps
8e6d7f7190	fix	use safe hasOwnProperty when parsing query params

v22.0.5

Compare Source

common

Commit	Type	Description
eb8fb9fe58	fix	use Object.hasOwn in I18nSelectPipe to handle null-prototype and shadowed mappings

compiler-cli

Commit	Type	Description
baf09a9939	fix	include toSignal in debugName transform

core

Commit	Type	Description
e598dc843f	fix	improve input writes migration in best effort mode
ced0180b06	fix	reject dynamic script host elements

router

Commit	Type	Description
ca13b42e7c	fix	fix malformed jsdoc comment for RouterLinkWithHref export

v22.0.4

Compare Source

migrations

Commit	Type	Description
fd37f09f37	fix	resolve migration failure when tsconfig specifies rootDir

v22.0.3

Compare Source

compiler

Commit	Type	Description
f90c20df40	fix	account for NgModule dependencies in JIT-compiled partial declarations
f4f7f3755c	fix	remove unused import breaking CI in 22.0.x

compiler-cli

Commit	Type	Description
06d854929c	fix	report diagnostic instead of crashing on malformed host binding

core

Commit	Type	Description
2799304259	fix	avoid uncaught promise errors in injectAsync prefetching

http

Commit	Type	Description
8cdc202dfc	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
b4a5a2fb4e	fix	preserve referrer in asset requests
a16f9b2263	fix	preserve referrer policy in asset requests

upgrade

Commit	Type	Description
bcc648f4b6	fix	support model() signals in downgradeComponent

v22.0.2

Compare Source

common

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#​69316)

compiler

Commit	Type	Description
6f1171991a	fix	restrict possible event handler check to property names longer than 2 characters

core

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

http

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#​69316)

migrations

Commit	Type	Description
15314c1736	fix	migration skip any target are not build or test

v22.0.1

Compare Source

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.
  (cherry picked from commit 8446e46)

common

Commit	Type	Description
c4b5fa3c92	fix	escape CSS string-terminating characters in escapeCssUrl
dfff57ede9	fix	Limits date format string length
3c2892c8df	fix	prevent prototype pollution in formatDateTime
1d87c49f6e	fix	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Type	Description
1ee224ca30	fix	disallow i18n event attributes
a56f1cdf8f	fix	more robust logic to check if regex can be optimized
5946c18275	fix	sanitize href/xlink:href attributes of any element of the MathML namespace
393b84caf8	fix	sanitize two-way properties

compiler-cli

Commit	Type	Description
3d9ca2f173	fix	bind switch exhaustive check expressions

core

Commit	Type	Description
669146b0e7	fix	disable WebMCP during SSR
562a566ead	fix	Handle synchronous errors in PendingTasks.run function
fa546f382d	fix	harden TransferState restoration against DOM clobbering
29fdb98684	fix	prevent dangling prevConsumer reference from leaking destroyed views (#​68681)
cdcea80327	fix	require WebMCP tool descriptions
4289c4c840	fix	update comment for Default change detection
3dd433b39a	fix	use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray
045bb736b3	fix	validate lowercase SVG animation attribute names

forms

Commit	Type	Description
11836a670a	fix	delay mcp reading the form model by a tick
85d2d100e3	fix	harden FormGroup control lookups against prototype shadowing
e51ad374ea	fix	remove animationstart listener on component destroy to prevent memory leak
55b7b5a6b6	fix	set additionalProperties: false on generated WebMCP form

http

Commit	Type	Description
ffb06c0514	fix	ensure query parameters are inserted before URL fragments
2dd65d21e6	fix	pass down the reportUploadProgress and reportDownloadProgress on post/patch requests
4254eb416c	fix	preserve empty referrer option in HttpRequest
167bd4c162	fix	Rejects non-HTTP(S) URLs in JSONP requests

language-service

Commit	Type	Description
43a0e28729	fix	prevent external template inlay hints from appearing in TS files

platform-server

Commit	Type	Description
ed48ca7f51	fix	harden platform location origin validation during SSR
1881ede3a7	refactor	deprecate ServerXhr

router

Commit	Type	Description
43edc8410f	fix	use native URL object for navigation boundary and comparison

service-worker

Commit	Type	Description
cf97b1f828	fix	Strips sensitive headers on cross-origin redirects

v22.0.0

Compare Source

Blog post "Announcing Angular v22".

Breaking Changes

compiler

• This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects.
  You might want to disable those 2 diagnotiscs in your tsconfig temporarily.
• data prefixed attribute no-longer bind inputs nor outputs.
• The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.
• in variables will throw in template expressions.

compiler-cli

• Elements with multiple matching selectors will now throw at compile time.

core

• The second arguement of appRef.bootstrap does not accept any anymore. Make sure the element you pass is not nullable.
• • TypeScript versions older than 6.0 are no longer supported.
• Leave animations are no longer limited to the element being removed.
• Component with undefined changeDetection property are now OnPush by default. Specify changeDetection: ChangeDetectionStrategy.Eager to keep the previous behavior.
• change AnimationCallbackEvent.animationComplete signature
• ChangeDetectorRef.checkNoChanges was removed. In tests use fixture.detectChanges() instead.
• createNgModuleRef was removed, use createNgModule instead
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponentFunction.
• ComponentFactoryResolver and ComponentFactory are no longer available. Pass the component class directly to APIs that previously required a factory, such as ViewContainerRef.createComponent or use the standalone createComponent function.

forms

• min and max validation rules no longer support
  string values. Bound values must be numbers or null.

http

• Use the HttpXhrBackend with provideHttpClient(withXhr) if you want to keep supporting upload progress reports.

platform-browser

• This removes styles when they appear to no longer be used by an associated host. However other DOM on the page may still be affected by those styles if not leveraging ViewEncapsulation.Emulated or if those styles are used by elements outside of Angular, potentially causing other DOM to appear unstyled.
• Hammer.js integration has been removed. Use your own implementation.

router

• The return type for TitleStrategy.getResolvedTitleForRoute
  was previously 'any' while the actual return type could only be either string
  or undefined. The return type now reflects the possible values correctly.
  Code that reads the value may need to be adjusted.

  (cherry picked from commit ad37f52)

• The currentSnapshot parameter in CanMatchFn and the canMatch method of the CanMatch interface is now required. While this was already the behavior of the Router at runtime, existing class implementations of CanMatch must now include the third argument to satisfy the interface.

• paramsInheritanceStrategy now defaults to 'always'

  The default value of paramsInheritanceStrategy has been changed from 'emptyOnly' to 'always'. This means that route parameters are inherited from all parent routes by default. To restore the previous behavior, set paramsInheritanceStrategy to 'emptyOnly' in your router configuration.

• provideRoutes() has been removed. Use provideRouter() or ROUTES as multi token if necessary.

upgrade

• Deprecated getAngularLib/setAngularLib have been removed use getAngularJSGlobal/setAngularJSGlobal instead.

Deprecations

http

• withFetch is now deprecated, it can be safely removed.
• The reportProgress option is deprecated please use reportUploadProgress & reportDownloadProgress instead.

compiler

Commit	Type	Description
47fcbc4704	feat	allow safe navigation to correctly narrow down nullables
2896c93cc1	feat	Angular expressions with optional chaining returns undefined
e850643b1b	feat	Support comments in html element.
96be4f429b	fix	abstract emitter producing incorrect code for dynamic imports
488d962bc7	fix	Don't bind inputs/outputs for data- attributes
2c5aabb9da	fix	don't escape dollar sign in literal expression
c7aef8ec5d	fix	enforce parentheses containing arguments for :host-context
b225a5d902	fix	invalid type checking code if field name needs to be quoted
ab9154ab75	fix	normalize tag names with custom namespaces in DomElementSchemaRegistry (#​68868)
8a1533c9ad	fix	preserve leading commas in animation definitions
194f723f66	fix	remove dedicated support for legacy shadow DOM selectors
4c25a42e98	fix	remove deprecated shadow CSS encapsulation polyfills
6ff620a033	fix	sanitize dynamic href and xlink:href bindings on SVG a elements (#​68868)
7dc1017e51	fix	simplify handling of colon host with a selector list
d99ab0e040	fix	stop generating unused field
03db2aefaa	fix	throw on duplicate input/outputs
786ef8261f	fix	throw on invalid in expressions
ccb7d427e4	fix	type check invalid for loops

compiler-cli

Commit	Type	Description
b8d3f36ed9	feat	add support for Node.js 26.0.0
7f9450219f	feat	Adds warning for prefetch without main defer trigger
2eae497a04	feat	support external TCBs with copied content in specific mode
e5f96c2d88	fix	animation events not type checked properly when bound through HostListener decorator
9218140348	fix	resolve TCB mapping failure for safe property reads with as any
7a0d6b8df2	fix	transform dropping exclamationToken from properties
ca67828ee2	refactor	introduce NG8023 compile-time diagnostic for duplicate selectors

core

Commit	Type	Description
17d3ea44e2	feat	add IdleRequestOptions support to IdleService
3b0ae5fef0	feat	add provideWebMcpTools
444b024d49	feat	Add a injectAsync helper function
3bc095d508	feat	Add a schematics to migrate provideHttpClient to keep using the HttpXhrBackend implementation.
5a7c1e62dc	feat	add ability to cache resources for SSR
cb4cb77053	feat	Add migration to add ChangeDetectionStrategy.Eager where applicable
2206efa55f	feat	add special return statuses for resource params
246a984a5d	feat	add TestBed.getFixture
b918beda32	feat	allow debouncing signals
8bc31a515f	feat	Allow other expression for exhaustive typechecking
4e331062e8	feat	allow synchronous values for stream Resources
a0aa8304cd	feat	bootstrap via ApplicationRef with config
9c55fcb3e6	feat	de-duplicate host directives
8fe025f514	feat	drop support for TypeScript 5.9
2f5ab541ea	feat	enhance profiling with documentation URLs
ef1810197b	feat	export experimental declareWebMcpTool support
75f2cb8f56	feat	implement Angular DI graph in-page AI tool
8f3d0b9d97	feat	introduce @Service decorator
df659b8d0c	feat	re-introduce nested leave animations scoped to component boundaries
8ce9cc4f6b	feat	register AI runtime debugging tools
eae8f7e30b	feat	Set default Component changeDetection strategy to OnPush
cdda51a3b2	feat	support bootstrapping Angular applications underneath shadow roots
a5981b83a6	feat	support customization of @​defer's on idle behavior
98eb24cea0	feat	Support optional timeout for idle deferred triggers
dc3131c639	feat	TestBed.getFixture -> TestBed.getLastFixture and update implementation
9f479ae964	feat	Update Testability to use PendingTasks for stability indicator
8ebae1de33	fix	allow service with factory on abstract classes
f9d8da6924	fix	bind global context to idle callback shims in @​defer's idle service
61a48e99aa	fix	do not register dom triggers when defer blocks are in manual mode
49748b5c79	fix	enforce return type for service factory
16adbbf423	fix	ensure custom controls resolve transitive host directives
50e599e73e	fix	lazy-initialize debounced state to prevent computation cycle
7aad302c3e	fix	mark service decorator as stable
a08e4fb93c	fix	normalize tag names in runtime i18n attribute security context lookup (#​68868)
b20f0fe078	fix	prevent rxResource from leaking a subscription
22f8b0a500	fix	resolver functio

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.