Securitysshole: password bypass in Alpine’s OpenSSH

@angular/core@22.2.5

Review before merging.

Release notes list 1 breaking change: The img/video src attribute is removed when its value is null or undefined.

Why this verdict

  • Release notes list 1 breaking change: The img/video src attribute is removed when its value is null or undefined.Evidence

Confidence 100% · algorithm v1 · computed 2026-11-12. How verdicts work

Supply chain and security

Malware reports
None known (OSV)
Known advisories
None known (OSV)
License
MIT
Install scripts
None
Build provenance
No provenance
Weekly downloads
236,034

Compatibility

No compatibility boundary is crossed: this is a patch or minor release on a stable major.

Breaking changes in the release notes

  • The img/video src attribute is removed when its value is null or undefined.“remove attribute when img/video attr.src is null or undefined”

AI-extracted from the official release notes and checked against the quoted text. Read the source

9 issues mention this version in angular/angular so far (14-day window still open). See them on GitHub

Check the official release notes below for behaviour changes before merging.

Release notes

Read the Angular changelog on Changes.Watch or the package page on npm for this version’s features and fixes.

New in this release

  • A debugName option was added to rxResource.“add debugName option to rxResource”
  • FormValueControl now supports updateOn blur and submit.“support updateOn blur and submit for custom FormValueControl”
  • The router can read focusReset from navigation extras.“read focusReset from the navigation extras”
  • loadComponent and loadChildren now run in the root environment injector (g3 only).“run loadComponent and loadChildren in root environment injector (g3 only)”
  • Required validators are reflected in compatibility fields for forms.“reflect required validators in compat fields”

AI-extracted from the official release notes and checked against the quoted text. Read the source

Deprecations and deadlines

The maintainer has not deprecated this version on npm.

Did upgrading to 22.2.5 work for you?

Results appear once three developers have voted.

More @angular/core verdicts