Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependency @angular/cli to v8 - autoclosed #174

Closed

Conversation

mend-for-github-com[bot]
Copy link
Contributor

@mend-for-github-com mend-for-github-com bot commented Aug 24, 2022

This PR contains the following updates:

Package Type Update Change
@angular/cli devDependencies major ~1.7.3 -> ~8.0.0

By merging this PR, the below issues will be automatically resolved and closed:

Severity CVSS Score CVE GitHub Issue
High 9.8 CVE-2018-1000620 #86
High 9.8 CVE-2018-11499 #83
High 9.8 CVE-2020-7774 #85
High 9.1 CVE-2019-10744 #14
High 8.8 CVE-2018-11694 #21
High 8.8 CVE-2018-11695 #22
High 8.8 CVE-2018-11696 #24
High 8.8 CVE-2018-19827 #92
High 8.6 CVE-2021-37701 #147
High 8.6 CVE-2021-37712 #148
High 8.6 CVE-2021-37713 #149
High 8.1 CVE-2018-11693 #27
High 8.1 CVE-2018-11697 #25
High 8.1 CVE-2018-11698 #19
High 8.1 CVE-2021-32803 #146
High 8.1 CVE-2021-32804 #30
High 7.5 CVE-2018-20834 #48
High 7.5 CVE-2019-13173 #74
High 7.3 WS-2019-0180 #66

By merging this PR, the below issues will be automatically resolved and closed:

Severity CVSS Score CVE GitHub Issue
High 9.8 CVE-2018-3774 #4
High 9.8 CVE-2018-3774 #4
High 9.8 CVE-2019-10746 #17
High 9.8 CVE-2019-10747 #16
High 9.8 CVE-2019-10747 #16
High 9.8 CVE-2019-15599 #7
High 9.8 CVE-2020-7774 #85
High 9.8 CVE-2021-23440 #171
High 9.8 CVE-2021-23440 #171
High 9.8 CVE-2021-23807 #11
High 9.8 CVE-2021-3918 #39
High 9.8 CVE-2022-29078 #159
High 9.8 CVE-2022-37601 #179
High 9.8 CVE-2022-37601 #179
High 9.8 WS-2020-0344 #34
High 9.8 WS-2021-0153 #53
High 9.3 CVE-2022-1650 #164
High 9.1 CVE-2019-10744 #14
High 9.1 CVE-2022-0686 #141
High 9.1 CVE-2022-0686 #141
High 8.8 CVE-2018-3728 #118
High 8.2 WS-2020-0345 #31
High 8.1 CVE-2020-7660 #87
High 7.8 CVE-2021-43138 #155
High 7.8 CVE-2021-43138 #155
High 7.5 CVE-2018-14732 #38
High 7.5 CVE-2019-20149 #8
High 7.5 CVE-2020-28469 #46
High 7.5 CVE-2020-7662 #95
High 7.5 CVE-2021-23343 #94
High 7.5 CVE-2021-23382 #35
High 7.5 CVE-2021-23424 #41
High 7.5 CVE-2021-27290 #15
High 7.5 CVE-2021-33623 #49
High 7.5 CVE-2021-3803 #60
High 7.5 CVE-2021-3807 #64
High 7.5 CVE-2022-21222 #176
High 7.5 CVE-2022-24771 #153
High 7.5 CVE-2022-24772 #152
High 7.5 WS-2020-0042 #78
High 7.5 WS-2020-0342 #33
High 7.4 CVE-2020-8203 #57
High 7.4 WS-2018-0588 #99
High 7.4 WS-2018-0588 #99
High 7.3 CVE-2020-7720 #121
High 7.2 CVE-2021-23337 #88

Release Notes

angular/angular-cli

v8.0.0

Compare Source

Welcome to version 8.0 of Angular and the CLI.

This release includes some significant new features:

  • Differential Loading is a build system feature in the CLI. It builds two versions of your application. One version is for modern browsers, and has a 10-30% smaller JS bundle size and fewer required polyfills. The second version works in older browsers. During ng update, we make some minor changes to your application to make it possible for all browsers to automatically downloaded the most suitable bundles. This change requires no server-side or serving infrastructure changes. The change is enabled by default via the target field set to es2015 in application’s tsconfig.json. If this change breaks your application, you can change the value back to es5 which disables differential loading. Thanks to Manfred Steyer https://github.com/manfredsteyer for upstreaming his excellent work on ngx-build-plus. See the documentation at https://angular.io/guide/deployment#differential-loading
  • Support for EcmaScript dynamic import() for lazy loading of routes. This aligns Angular with the JavaScript specification and makes your application more compatible with tooling. ng update will automatically change the loadChildren syntax to import(), and we no longer recommend using the string-based style like path/to/module#ModuleName. Thanks to Craig Spence https://github.com/phenomnomnominal for adding support for this.
  • WebWorker bundling is now automatic in the CLI. This lets you easily write code that moves expensive computation to a separate thread, and have that bundled in a separate script that works in the browser. Thanks to Jason Miller https://github.com/developit for writing the Webpack plugin and assisting us with integrating this feature into the CLI. See the documentation at https://angular.io/guide/web-worker.
  • CLI telemetry is an opt-in feature that lets you report CLI usage data to the Angular team, and also to your own Google Analytics account. This lets us make better decisions about which CLI features to prioritize, and measure the impact of our improvements. See the documentation at https://angular.io/analytics
  • Builders is a new API in the CLI that allows tooling developers to replace the behavior of CLI commands such as build and test. Before 8.0.0 we will add documentation, for now you can see a preview at https://pr29964-c99aea0.ngbuilds.io/guide/architect and read the blog post. As part of 8.0.0 we are working with cloud providers to take advantage of Architect to provide a new deploy command. Along with Architect, we've added a Workspace API for tools that need to read or write the angular.json file; see https://github.com/angular/angular-cli/blob/master/packages/angular_devkit/core/README.md#workspaces
  • Reduced transitive tarball download size of @angular/cli by 60%

To update, please visit https://update.angular.io

Note: if you configure Node.js with extra memory for your ng build command, you may need to do the same for ng update since this update loads your program in memory.

Breaking Changes

@​angular-devkit/build-angular: use `sass` instead of `node-sass` (ce15899)

we no longer use `node-sass` by default, instead we use `sass` (dart-sass).

While in most cases this should not have an impact the generated code, dart sass has some differences from Ruby Sass. See https://github.com/sass/dart-sass#behavioral-differences-from-ruby-sass for more details

If you wish to use node-sass instead of sass you need to install node-sass as a dev dependency.

npm users

npm install node-sass --save-dev

yarn users

yarn add node-sass --dev

Note: for larger Sass projects to avoid this performance hit you might want to install fibers. See: https://www.npmjs.com/package/fibers

Ref: TOOL-748

@​angular-devkit/core: Remove dep on chokidar (eb5643e)

Users who rely on angular-devkit/core to do the file watching must add chokidar to their devDependencies.

@​angular-devkit/build-angular: disable by default stylesheet root relative URL rebasing (94b087c)

Root relative URLs are a standardized method to reference a resource path from the root of a host. The previous behavior of the Angular CLI prevented this from occuring and resulted in an inability to reference stylesheet assets in this manner. The initial reason for this behavior is no longer present in the internal implementation of the Angular CLI. Therefore, this now unnecessary and non-standard behavior is being phased out. If an application currently relies on this behavior, a compatibility option `rebaseRootRelativeCssUrls` has been provided for the 8.x release cycle to facilitate transition away from this non-standard and limiting behavior. The recommended method to transition is to use relative paths within the source stylesheet. This allows the build system to process and generate a full URL for the asset.

Schematics are now async

For Schematics authors: note that schematics have always been potentially async, but now they all are.

Commits

@​angular/cli (8.0.0)

Commit Description Notes
verify Angular version is supported
automatically update angular builders when CLI is updated [Closes #​13581]
add tracking for command duration
support stable architect API
allows analytics sharing with a third party
add validation logic for analytics in ng config
add custom implementation for analytics for commands
add support for analytics command proper
add prompt on post install step
add analytic support to commands and command-runner
add universal-analytics as dependency
add `@nguniversal/*` to ng version [Closes #​9959]
update minimum required Node.js version to 10.9
Add VsCode recommendation for Angular Console
Add VsCode extension recommendations
support pnpm as a package manager option
ng config doesn't parse positional array [Closes #​14516]
ng generate --help shows the wrong collection [Closes #​14519]
show analytics prompt when no global configuration file [Closes #​14486]
standardize TTY checks
ensure git repository is clean before updates
show error when using x18n command on Node.js 12.0
improve error handling of update command
@​bazel/* are not shown in `ng version`
prevent nested schematic execution from generating analytics [Closes #​14190]
enable analytics for safe builders [Closes #​14355]
print full error when package is not found
honor builder schema additional properties option [Closes #​14354]
remove Angular specific version check from base architect command [Closes #​14266]
only show postinstall prompt when global analytics not configured
add missing experimentalImportFactories to schema
update config schema for karma webworker
improve opt-out language
dont force a prompt on non-interactive terminals
if no global config file found, analytics can be null
don't remove scripts from package.json
fix import path for TimingOptions [Closes #​13978]
remove redundant typescript/compiler-cli compatibility check
remove deprecated eject command
explicitly define console color logging
wrap `opn` in a new Promise because `opn` is already resolve is already resolve.
Add an error message when we call `ng doc` without keyword. Currently, we open a page with the keyword `undefined`. (#​13604)
update terser-webpack-plugin (#​13589) [Closes #​13582]
schematics commands should fail on unknown options [Closes #​12549]
remove unsupported `dryRun` and `force` from `ng add` [Closes #​13479]
ng-add should resolve package.json

@​angular-devkit/architect (0.800.0)

Commit Description Notes
add analytics to builder context
add new context methods
getOptionsForTarget should return null
add scheduleTargetAndForget function
add targetFromTargetString() function
QoL changes for builders
allow for a different output type
add generic architect builders
add node architect host
New Architect API first draft
error run on input schema error (#​14315) [Closes #​14269]
propagate option validation errors
consume the default export in TestingArchitectHost
set proper name in TestingArchitectHost
fix incorrect relative core import
remove experimental API
ensure workspaceRoot is actually set to workspaceRoot
properly subscribe to error handlers
properly report errors thrown by builder

@​angular-devkit/build-angular (0.800.0)

Commit Description Notes
use evergreen version of zone.js with ES2015
remove experimentalImportFactories option [Closes #​14218]
warn when target greater es2015
deprecate `es5BrowserSupport` option in browser builder
enable differential loading for es2015 builds
wire up index generation for differential loading
support web workers in karma builder
support karma builder webpack transformation
improve handling of nomodules and modules in index generation
differential loading
add safari-nomodule snippet
update to core-js 3 [Closes #​13954]
support TS web workers
support module web workers.
write index.html for differential loading
add experimentalImportFactories option
use builder name for category
add analytics for build
implement stable architect API for extract-i18n
add AppShell new API builder
add server output path
implement stable architect API for karma
use `sass` instead of `node-sass`
add Server Builder v2
enable webpack profile when using stats-json flag [Closes #​13907]
implement stable architect API for protractor
deprecate `profile` option in build
remove Closure compiler i18n code for ivy
move dev-server to new API
re-export schemas
browserTarget should match target pattern
add support for tslint 5.13+
add Browser Builder v2
change es5BrowserSupport output filename to `polyfills.es5.js` [Closes #​13808]
move tslint to new API
dev-server port number mismatches in logs when using `port=0` [Closes #​14499]
absolute outputPath outputs index.html in wrong location [Closes #​14474]
normalize sourceMap options in karma webpack plugin [Closes #​14457]
show error for missing modules [Closes #​14421]
extract i18n should only show warnings/errors [Closes #​14373]
propagate protractor errors during execu

@mend-for-github-com mend-for-github-com bot added the security fix Security fix generated by WhiteSource label Aug 24, 2022
@mend-for-github-com mend-for-github-com bot changed the title Update dependency @angular/cli to v8 Update dependency @angular/cli to v8 - autoclosed Nov 20, 2022
@mend-for-github-com mend-for-github-com bot deleted the whitesource-remediate/angular-cli-8.x branch November 20, 2022 15:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security fix Security fix generated by WhiteSource
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

0 participants