Skip to content

Bump @angular/core from 20.3.15 to 20.3.17 in /frontend#214

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/frontend/angular/core-20.3.17
Open

Bump @angular/core from 20.3.15 to 20.3.17 in /frontend#214
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/frontend/angular/core-20.3.17

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 1, 2026

Bumps @angular/core from 20.3.15 to 20.3.17.

Release notes

Sourced from @​angular/core's releases.

20.3.17

core

Commit Description
fix - 7f9de3c118 block creation of sensitive URI attributes from ICU messages

Breaking Changes

core

  • Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

    (cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

20.3.16

core

Commit Description
fix - c2c2b4aaa8 sanitize sensitive attributes on SVG script elements
Changelog

Sourced from @​angular/core's changelog.

20.3.17 (2026-02-25)

Breaking Changes

core

  • Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

    (cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

core

Commit Type Description
7f9de3c118 fix block creation of sensitive URI attributes from ICU messages

21.2.0 (2026-02-25)

common

Commit Type Description
18003a33bb feat add an 'outlet' injector option for ngTemplateOutlet
8bbe6dc46c feat Add Location strategies to manage trailing slash on write
51cc914807 feat support height in ImageLoaderConfig and built-in loaders

compiler

Commit Type Description
72534e2a34 feat Add support for the instanceof binary operator
95b3f37d4a feat Exhaustive checks for switch blocks
04ba09a8d9 feat support AstVisitor.visitEmptyExpr()
ce80136e7b fix optimize away unnecessary restore/reset view calls
3242a61bae fix variable counter visiting some expressions twice

compiler-cli

Commit Type Description
473dd3e1cb fix attach source spans to object literal keys in TCB
a904d9f77b fix support nested component declaration
2ea6dfc6c9 fix update diagnostic to flag no-op arrow functions in listeners

core

Commit Type Description
8d5210c9fe feat add ChangeDetectionStrategy.Eager alias for Default
92d2498910 feat add host node to DeferBlockData (#66546)
ea2016a6dc feat add support for nested animations
81cabc1477 feat add support for TypeScript 6
1ba9b7ac50 feat resource composition via snapshots
d9923b72a2 feat support arrow functions in expressions
a7e8abbb7e fix correctly handle SkipSelf when resolving from embedded view injector
0806ee3826 fix prevent animated element duplication with dynamic components in zoneless mode
ed78fa05c7 fix Remove note to skip arrow functions in best practices

forms

Commit Type Description

... (truncated)

Commits
  • 7f9de3c fix(core): block creation of sensitive URI attributes from ICU messages
  • c2c2b4a fix(core): sanitize sensitive attributes on SVG script elements
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) from 20.3.15 to 20.3.17.
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.17/packages/core)

---
updated-dependencies:
- dependency-name: "@angular/core"
  dependency-version: 20.3.17
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 1, 2026
@dependabot dependabot bot requested a review from a team as a code owner March 1, 2026 18:44
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 1, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Mar 1, 2026

The change primarily involves updating the version of the @angular/core package in the project's dependencies. The version is incremented from 20.3.15 to 20.3.17, reflecting a patch-level update. This modification aims to incorporate the latest bug fixes, performance improvements, and potentially new features provided by the Angular team without altering the application's functionality drastically.

Walkthrough

  • Chore: Updated the @angular/core package version from 20.3.15 to 20.3.17 to ensure the application benefits from the latest bug fixes and optimizations. This change is likely to enhance stability and performance without introducing breaking changes.

Model: gpt-4o-2024-08-06 | Prompt Tokens: 305 | Completion Tokens: 139

Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here's a friendly code review enhanced with AI assistance. Some observations are suggestions rather than certainties, so please take what feels valuable to you. You remain the expert making the final choices—AI simply offers additional perspective to support your work.


Always critique what AI says. Do not let AI replace YOUR I.
Model: claude-sonnet-4-20250514 | Prompt Tokens: 866 | Completion Tokens: 365

Comment on lines 15 to 21
"@angular/cdk": "^20.2.14",
"@angular/common": "^20.3.15",
"@angular/compiler": "^20.3.15",
"@angular/core": "^20.3.15",
"@angular/core": "^20.3.17",
"@angular/forms": "^20.3.15",
"@angular/material": "^20.2.14",
"@angular/platform-browser": "^20.3.15",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Version inconsistency detected across Angular packages. While @angular/core is being updated to ^20.3.17, other Angular packages remain at different versions (^20.3.15 for common/compiler/forms/platform-browser and ^20.2.14 for cdk/material). This can lead to compatibility issues.

Consider updating all Angular packages to the same version for better compatibility:

"@angular/cdk": "^20.3.17",
"@angular/common": "^20.3.17",
"@angular/compiler": "^20.3.17",
"@angular/core": "^20.3.17",
"@angular/forms": "^20.3.17",
"@angular/material": "^20.3.17",
"@angular/platform-browser": "^20.3.17"

Alternatively, use Angular CLI's ng update command to ensure all packages are updated together maintaining compatibility.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants