@angular/core@20.3.26
Skip this version — install 20.3.34 instead.
2 known advisories (worst: high), fixed in 20.3.28.
Why this verdict
- 2 known advisories (worst: high), fixed in 20.3.28.Evidence
Confidence 100% · algorithm v1 · computed 2026-10-19. How verdicts work
Supply chain and security
- Malware reports
- None known (OSV)
- Known advisories
- 2 known
- License
- MIT
- Install scripts
- None
- Build provenance
- No provenance
- Weekly downloads
- 15,397
- GHSA-hh8m-fm6v-7cvgAngular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
- GHSA-jj27-h5hq-8x99Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Compatibility
No compatibility boundary is crossed: this is a patch or minor release on a stable major.
Check the official release notes below for behaviour changes before merging.
Release notes
Read the Angular changelog on Changes.Watch or the package page on npm for this version’s features and fixes.
Deprecations and deadlines
The maintainer has not deprecated this version on npm.