chore(deps): update dependency @angular/common [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@angular/common (source)	^9.1.12 → ^9.1.12 || ^22.0.0
@angular/common (source)	~9.1.12 → ~19.2.0

---

Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

CVE-2025-66035 / GHSA-58c5-g7wp-6w37

More information

Details

The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain.

Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header.

Impact

The token leakage completely bypasses Angular's built-in CSRF protection, allowing an attacker to capture the user's valid XSRF token. Once the token is obtained, the attacker can perform arbitrary Cross-Site Request Forgery (CSRF) attacks against the victim user's session.

Attack Preconditions

1. The victim's Angular application must have XSRF protection enabled.
2. The attacker must be able to make the application send a state-changing HTTP request (e.g., POST) to a protocol-relative URL (e.g., //attacker.com) that they control.

Patches

• 19.2.16
• 20.3.14
• 21.0.1

Workarounds

Developers should avoid using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
• https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
• https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
• https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
• https://github.com/angular/angular/releases/tag/19.2.16
• https://github.com/angular/angular/releases/tag/20.3.14
• https://github.com/angular/angular/releases/tag/21.0.1
• https://nvd.nist.gov/vuln/detail/CVE-2025-66035
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html
• https://cert-portal.siemens.com/productcert/html/ssa-485750.html
• https://github.com/advisories/GHSA-58c5-g7wp-6w37

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/common)

v22.1.3

Compare Source

animations

Commit	Type	Description
d9620e0f1b	fix	detect object trigger values with Object.hasOwn

common

Commit	Type	Description
b3c78a5081	fix	preserve literal key union in KeyValuePipe.transform()

compiler

Commit	Type	Description
94f0b9a371	fix	preserve &ngsp; between sibling control flow blocks

core

Commit	Type	Description
afe529cb2d	fix	accept readonly arrays for setClassMetadata decorators
2c72fe3797	fix	allow readonly arrays in RawScopeInfoFromDecorator
ef2ce9a098	fix	expose debuggableFn for non-computed signal graph nodes
7bcce260f5	fix	prevent orphaned requestIdleCallback handle from re-entrant scheduling
44137117b3	fix	replace all hasOwnProperty usages with Object.hasOwn
85f12a5a13	fix	stop running further effects once one destroys the view mid-flush
c04931c88b	fix	throw a descriptive error instead of crashing when a hydration node is missing
601d1f6576	fix	throw NG0500 instead of a raw TypeError on element hydration mismatch

forms

Commit	Type	Description
83450d2924	fix	report forbidden 2way bindings on when FormField is applied
5cb4ea7e35	fix	warn in dev mode when ngModel cannot reach parent NgForm across component boundary

http

Commit	Type	Description
0cd635e9e2	fix	cancel oversized fetch response bodies

language-server

Commit	Type	Description
14fbe04612	fix	recover project for external templates in solution-style workspaces

platform-browser

Commit	Type	Description
3ddcb1a101	fix	disallow event handler attributes in Meta
640460d606	fix	throw a descriptive error when insertBefore reference node is missing

router

Commit	Type	Description
abe019d505	fix	pass correct component to canDeactivate for named outlets in componentless parent routes

v22.1.2

Compare Source

compiler

Commit	Type	Description
76dff307b4	fix	Generate correct expression for optional chaning.
6f9a64e6f5	fix	remove namespaced MathML script elements

compiler-cli

Commit	Type	Description
e9660b1801	fix	correctly resolve symbol for SafePropertyRead in chained optional navigation
ec6deea513	fix	record class extends clause references in DeferredSymbolTracker

core

Commit	Type	Description
0df9d5eb65	fix	ensure i18n_util hasOwnProperty checks are safe for property renaming
4d985a179e	fix	incorrect loop in defer blocks
7b40456792	fix	reject prefixed SVG script hosts

forms

Commit	Type	Description
3b5c798072	fix	keep radio inputs in sync when values change

http

Commit	Type	Description
4f7e9987fa	fix	always decode JSON responses as UTF-8

router

Commit	Type	Description
2f82601662	fix	limit protocol-relative URL handling to serialization

v22.1.1

Compare Source

core

Commit	Type	Description
aa6d3189c1	fix	initialize hydration triggers after late runtime activation
deecb301c8	fix	warn when style property bindings receive invalid values

http

Commit	Type	Description
ac3728e79f	fix	avoid aborting completed requests in FetchBackend
688a0a7118	fix	respect content-type charset in fetch backend text decoder
a13b968451	fix	run root interceptors in the terminal request chain
32af9b525e	fix	strip RFC 6265 DQUOTE characters and handle URIError in parseCookieValue

v22.1.0

Compare Source

Deprecations

http

• HttpClient.jsonp, HttpClientJsonpModule, and related JSONP classes/functions are deprecated. Use standard HTTP requests instead.

common

Commit	Type	Description
1ad6824d0d	fix	skip transfer cache for uncacheable HTTP traffic (#​69017)

compiler

Commit	Type	Description
af5e4e1131	feat	Add an error for --global-foo cases (#​68846)
d579ecaf73	feat	Disable '--global-' error outside of g3 (#​68846)
f98547675c	feat	Namespace CSS variables to the app (#​68846)
8c8b2f7783	feat	Support css var namespacing in properties (#​68846)
292199aa4d	fix	permissive whitespace parsing in default never blocks
25c744c4d0	fix	support foreign components defined outside top-level scope
5bd00add07	fix	support foreign components inside control flow blocks (#​69674)
2e442f7876	perf	do not emit tag name when control flow root is foreign component (#​69674)

compiler-cli

Commit	Type	Description
aeb55c8bc1	fix	allow passing uninvoked signals as foreign component props
7c60a98b3c	fix	support import aliases in foreignImports (#​68674)

core

Commit	Type	Description
124ba10ead	feat	add custom set option to linkedSignal
eab4847a8b	feat	Adds deep linking from Performance panel to DevTools
091456a214	fix	account for namespaces in host binding sanitization (#​69558)
b3748e9fe4	fix	correct container anchor collection order to match DOM layout
11b206b919	fix	introduce disposal mechanism for Angular views in foreign @content
56607967db	fix	introduce logical-only containers for foreign content
23cf1a828b	fix	sanitize host bindings on concrete hosts (#​69558)
0c07356c5c	fix	set current tnode in foreign component instruction on reuse

forms

Commit	Type	Description
bbbd357bd2	fix	add utility to assert that value is a field tree

http

Commit	Type	Description
e3630c23c5	feat	add options to allow caching of credentialed and non-cacheable HTTP requests
ec16a3d6c6	fix	enable xsrf for root-provided HttpClient
39e362eea5	fix	match header values exactly when deleting
be46ca8696	fix	preserve immutability of materialized clones
c0cbd46bd7	fix	skip transfer cache for fetch credentialed requests (#​69017)
af04e266cc	refactor	deprecate jsonp support

language-service

Commit	Type	Description
7f0265e43a	feat	compile non-exported classes if standalone (#​68454)
4f9c824dd9	feat	Typecheck templates which would require inline typecheck blocks (#​68454)
a99fb915c0	fix	account for strictTemplates being enabled by default

migrations

Commit	Type	Description
c75ff0255c	feat	add migration from injectable to service
5d5b2ea72d	fix	correctly detect then/else keywords in control flow migration

platform-server

Commit	Type	Description
cf9d7fa0f8	fix	harden platform location origin validation during SSR (#​69184)

router

Commit	Type	Description
97a3fd6a55	feat	handle null and undefined inputs in RouterLinkActive

v22.0.8

Compare Source

common

Commit	Type	Description
c0368f2278	fix	preserve crossorigin on image preloads

core

Commit	Type	Description
8616ba9db6	fix	ensure SVG animation attributeName is checked case-insensitively

forms

Commit	Type	Description
d302c7ab83	fix	ensure pending status propagates to the root form in signal forms

http

Commit	Type	Description
9d40f8aefe	fix	prevent transfer cache key collisions

migrations

Commit	Type	Description
388daea2fc	fix	correctly migrate ngClass with mixed space-separated keys
bb39cda648	fix	preserve NgClass import on partial migration

v22.0.7

Compare Source

common

Commit	Type	Description
91e33aa1de	fix	avoid prototype lookups in date format caches

compiler

Commit	Type	Description
5b516e3a58	fix	parsing of an empty template literal interpolation

compiler-cli

Commit	Type	Description
c88ddde1c9	fix	re-tag SourceFiles after TsCreateProgramDriver.updateFiles()

core

Commit	Type	Description
94d9591b51	fix	allow static attributes for explicit input transforms
c89f71a74c	fix	ignore processing instruction syntax in templates
70500e4067	fix	preserve explicit input transform write type

forms

Commit	Type	Description
1b9964675f	fix	allow multiple async validators
64d6d47a0c	fix	preserve intermediate number values in signal forms
6cf7446afa	fix	prevent stale CVA writeback during debounce

http

Commit	Type	Description
20b7dc3023	fix	prevent interceptor signal reads from leaking into calling reactive contexts

localize

Commit	Type	Description
22d5a091d1	fix	build runtime translations map with a null prototype
8ce1fcf7fa	fix	use Object.hasOwn for placeholder lookup in translate

platform-browser

Commit	Type	Description
b34bf0dce8	fix	prevent ReDoS in SOURCEMAP_URL_REGEXP

v22.0.6

Compare Source

compiler

Commit	Type	Description
fd4ddcafed	fix	use regular optional chaining expression for safe function calls in TCBs

compiler-cli

Commit	Type	Description
534fe81a89	fix	apply debugName transform to required signal queries
3b08201bfb	fix	detect uninvoked signals in bound expressions using ternary

forms/signals

Commit	Type	Description
171669f7b2	fix	make extractValue reactive for compat AbstractControl values

migrations

Commit	Type	Description
0a6af1496b	fix	preserve transitive NgModule references when pruning
d4a926a762	fix	remove stale model import in model-output migration

router

Commit	Type	Description
c238bd2ad7	fix	handle outlet named proto in segment group maps
8e6d7f7190	fix	use safe hasOwnProperty when parsing query params

v22.0.5

Compare Source

common

Commit	Type	Description
eb8fb9fe58	fix	use Object.hasOwn in I18nSelectPipe to handle null-prototype and shadowed mappings

compiler-cli

Commit	Type	Description
baf09a9939	fix	include toSignal in debugName transform

core

Commit	Type	Description
e598dc843f	fix	improve input writes migration in best effort mode
ced0180b06	fix	reject dynamic script host elements

router

Commit	Type	Description
ca13b42e7c	fix	fix malformed jsdoc comment for RouterLinkWithHref export

v22.0.4

Compare Source

migrations

Commit	Type	Description
fd37f09f37	fix	resolve migration failure when tsconfig specifies rootDir

v22.0.3

Compare Source

compiler

Commit	Type	Description
f90c20df40	fix	account for NgModule dependencies in JIT-compiled partial declarations
f4f7f3755c	fix	remove unused import breaking CI in 22.0.x

compiler-cli

Commit	Type	Description
06d854929c	fix	report diagnostic instead of crashing on malformed host binding

core

Commit	Type	Description
2799304259	fix	avoid uncaught promise errors in injectAsync prefetching

http

Commit	Type	Description
8cdc202dfc	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description
b4a5a2fb4e	fix	preserve referrer in asset requests
a16f9b2263	fix	preserve referrer policy in asset requests

upgrade

Commit	Type	Description
bcc648f4b6	fix	support model() signals in downgradeComponent

v22.0.2

Compare Source

common

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#​69316)

compiler

Commit	Type	Description
6f1171991a	fix	restrict possible event handler check to property names longer than 2 characters

core

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

http

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#​69316)

migrations

Commit	Type	Description
15314c1736	fix	migration skip any target are not build or test

v22.0.1

Compare Source

Deprecations

platform-server

• XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.
  (cherry picked from commit 8446e46)

common

Commit	Type	Description
c4b5fa3c92	fix	escape CSS string-terminating characters in escapeCssUrl
dfff57ede9	fix	Limits date format string length
3c2892c8df	fix	prevent prototype pollution in formatDateTime
1d87c49f6e	fix	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Type	Description
1ee224ca30	fix	disallow i18n event attributes
a56f1cdf8f	fix	more robust logic to check if regex can be optimized
[5946c18275](https://redirect.github.com/angular/angular/commit/5946c18275800539b2f47f80

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.