chore(deps): update dependency @angular/common to v20.3.14 [security]

[github-actions]

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/common (source)	20.2.4 → 20.3.14

---

Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

CVE-2025-66035 / GHSA-58c5-g7wp-6w37

More information

Details

The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain.

Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header.

Impact

The token leakage completely bypasses Angular's built-in CSRF protection, allowing an attacker to capture the user's valid XSRF token. Once the token is obtained, the attacker can perform arbitrary Cross-Site Request Forgery (CSRF) attacks against the victim user's session.

Attack Preconditions

1. The victim's Angular application must have XSRF protection enabled.
2. The attacker must be able to make the application send a state-changing HTTP request (e.g., POST) to a protocol-relative URL (e.g., //attacker.com) that they control.

Patches

• 19.2.16
• 20.3.14
• 21.0.1

Workarounds

Developers should avoid using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

References

• https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
• https://nvd.nist.gov/vuln/detail/CVE-2025-66035
• https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
• https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
• https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
• https://github.com/angular/angular
• https://github.com/angular/angular/releases/tag/19.2.16
• https://github.com/angular/angular/releases/tag/20.3.14
• https://github.com/angular/angular/releases/tag/21.0.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

angular/angular (@​angular/common)

v20.3.14

Compare Source

http

Commit	Type	Description
0276479e7d	fix	prevent XSRF token leakage to protocol-relative URLs

v20.3.13

Compare Source

v20.3.12

Compare Source

v20.3.11

Compare Source

common

Commit	Type	Description
5047849a4a	fix	remove placeholder image listeners once view is removed

compiler

Commit	Type	Description
f9d0818087	fix	support arbitrary nesting in :host-context()
106b9040df	fix	support commas in :host() argument
9419ea348a	fix	support complex selectors in :nth-child()
036c5d2a07	fix	support one additional level of nesting in :host()

core

Commit	Type	Description
dcdd1bcdbb	fix	skip leave animations on view swaps

v20.3.10

Compare Source

compiler-cli

Commit	Type	Description
840db59dc1	fix	make required inputs diagnostic less noisy

migrations

Commit	Type	Description
a45e6b2b66	fix	Prevent removal of templates referenced with preceding whitespace characters

v20.3.9

Compare Source

v20.3.7

Compare Source

animations

Commit	Type	Description
bd38cd45a5	fix	account for Element.animate exceptions (#​64506)

compiler

Commit	Type	Description
891f180262	fix	correctly compile long numeric HTML entities (#​64297)

compiler-cli

Commit	Type	Description
371274bfc6	fix	missingStructuralDirective diagnostic produces false negatives (#​64470)

core

Commit	Type	Description
4c89a267c3	fix	pass element removal property through in all locations (#​64565)
2fad4d4ab6	fix	prevent duplicate nodes from being retained with fast `animate.leave`` calls (#​64592)

router

Commit	Type	Description
cfd8ed3fff	fix	Fix outlet serialization and parsing with no primary children (#​64505)
182fe78f91	fix	Surface parse errors in Router.parseUrl (#​64503)

v20.3.6

Compare Source

core

Commit	Type	Description
911d6822cb	fix	update animation scheduling (#​64441)

platform-browser

Commit	Type	Description
2ece42866d	fix	DomEventsPlugin should always be the last plugin to be called for supports(). (#​50394)

v20.3.5

Compare Source

compiler-cli

Commit	Type	Description
8dec92ff9f	fix	capture metadata for undecorated fields (#​63957) (#​64317)
c2e817b0ef	perf	fix performance of "interpolated signal not invoked" check (#​64410)

core

Commit	Type	Description
f15cfa4cc4	fix	fixes regression in animate.leave function bindings (#​64413)
d54dd674ca	fix	Prevents early style pruning with leave animations (#​64335)

migrations

Commit	Type	Description
554573e524	fix	migrating input with more than 1 usage in a method (#​64367)
2c79ca0b57	fix	remove error for no matching files in control flow migration (#​64253) (#​64314)

router

Commit	Type	Description
6e4bcc7d22	fix	Scroll restoration should use instant scroll behavior for traversals (#​64299)

v20.3.4

Compare Source

core

Commit	Type	Description
853ed169a8	fix	ensure missing leave animations don't queue leave animations (#​64226)
6fed986b7a	fix	Fixes animations in conjunction with content projection (#​63776)
76fe5599fe	fix	handle undefined CSS time values in parseCssTimeUnitsToMs function (#​64181)
3b959105be	fix	prevent early exit from leave animations when multiple transitions are present (#​64225)

migrations

Commit	Type	Description
65884895ff	fix	preserve component imports when pruning NgModules in standalone migration (#​64186)

v20.3.3

Compare Source

compiler

Commit	Type	Description
f51ab32fb3	fix	recover template literals with broken expressions (#​64150)

core

Commit	Type	Description
542cd0019a	fix	do not rename ARIA property bindings to attributes (#​64089)
0e928fbc4a	fix	Fixes animations in conjunction with content projection (#​63776)
e5157bd933	fix	prevents unintended early termination of leave animations and hoisting (#​64088)

migrations

Commit	Type	Description
1710cbd7d4	fix	handle shorthand property declarations in NgModule (#​64160)
77b6305a4b	fix	skip migration for inputs with 'this' references (#​64142)

v20.3.2

Compare Source

compiler-cli

Commit	Type	Description
ba40153ac0	fix	capture metadata for undecorated fields (#​63904)
1d4f81c8ee	fix	resolve import alias in defer blocks (#​63966)

core

Commit	Type	Description
9515a70933	fix	fix narrowing of Resource.hasValue() (#​63994)
e78451cf8a	fix	prevent animations renderer from impacting animate.leave (#​63921)

forms

Commit	Type	Description
1fd8d5d446	fix	Emit FormResetEvent when resetting control (#​64034)

migrations

Commit	Type	Description
16d0d43ad4	fix	handle import aliases to the same module name (#​63934)
3ebaeccb46	fix	handle reused templates in control flow migration (#​63996)

v20.3.1

Compare Source

compiler

Commit	Type	Description
d1ca8ae043	fix	prevent XSS via SVG animation attributeName and MathML/SVG URLs

v20.3.0

Compare Source

Breaking Changes

core

• The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

  Before:

  const bootstrap = () => bootstrapApplication(AppComponent, config);

  After:

  const bootstrap = (context: BootstrapContext) =>
    bootstrapApplication(AppComponent, config, context);

  A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

  In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.

  (cherry picked from commit 8bf80c9)

Commit	Type	Description
a3f808d7c8	fix	remove refresh button from transfer state tab (#​63592)

core

Commit	Type	Description
6117ccee2e	feat	introduce BootstrapContext for improved server bootstrapping (#​63636)

---

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

🎉 This PR is included in version 1.1.4 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀