HeroDevs
Visit AngularJS NES Home Page

AngularJS 1.5.x Release Notes

Comprehensive release notes and changelog for AngularJS 1.5.x, including security patches, bug fixes, and feature updates across all supported versions.

17 Patched Vulnerabilities
VEX Statements

AngularJS

1.5.29 (NES/XLTS) - June 17, 2026

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/angularjs@1.5.11-angularjs-1.5.29
    • @neverendingsupport/angularjs-animate@1.5.11-angularjs-1.5.29
    • @neverendingsupport/angularjs-aria@1.5.11-angularjs-1.5.29
    • @neverendingsupport/angularjs-cookies@1.5.11-angularjs-1.5.29
    • @neverendingsupport/angularjs-i18n@1.5.11-angularjs-1.5.29
    • @neverendingsupport/angularjs-loader@1.5.11-angularjs-1.5.29
    • @neverendingsupport/angularjs-message-format@1.5.11-angularjs-1.5.29
    • @neverendingsupport/angularjs-messages@1.5.11-angularjs-1.5.29
    • @neverendingsupport/angularjs-mocks@1.5.11-angularjs-1.5.29
    • @neverendingsupport/angularjs-parse-ext@1.5.11-angularjs-1.5.29
    • @neverendingsupport/angularjs-resource@1.5.11-angularjs-1.5.29
    • @neverendingsupport/angularjs-route@1.5.11-angularjs-1.5.29
    • @neverendingsupport/angularjs-sanitize@1.5.11-angularjs-1.5.29
    • @neverendingsupport/angularjs-touch@1.5.11-angularjs-1.5.29

Security & Compatibility Fixes

  • $sceDelegate:
    • Always apply resource URL matchers to entire URL.
      • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-11998).

1.5.28 (NES/XLTS) - November 6, 2025

Notes

  • This release also includes some package metadata and documentation updates.
  • Full package name(s) and version(s):
    • @neverendingsupport/angularjs@1.5.11-angularjs-1.5.28
    • @neverendingsupport/angularjs-animate@1.5.11-angularjs-1.5.28
    • @neverendingsupport/angularjs-aria@1.5.11-angularjs-1.5.28
    • @neverendingsupport/angularjs-cookies@1.5.11-angularjs-1.5.28
    • @neverendingsupport/angularjs-i18n@1.5.11-angularjs-1.5.28
    • @neverendingsupport/angularjs-loader@1.5.11-angularjs-1.5.28
    • @neverendingsupport/angularjs-message-format@1.5.11-angularjs-1.5.28
    • @neverendingsupport/angularjs-messages@1.5.11-angularjs-1.5.28
    • @neverendingsupport/angularjs-mocks@1.5.11-angularjs-1.5.28
    • @neverendingsupport/angularjs-parse-ext@1.5.11-angularjs-1.5.28
    • @neverendingsupport/angularjs-resource@1.5.11-angularjs-1.5.28
    • @neverendingsupport/angularjs-route@1.5.11-angularjs-1.5.28
    • @neverendingsupport/angularjs-sanitize@1.5.11-angularjs-1.5.28
    • @neverendingsupport/angularjs-touch@1.5.11-angularjs-1.5.28

Security & Compatibility Fixes

  • angular-loader:
    • Ensure necessary globals are available at runtime.

1.5.27 (NES/XLTS) - September 19, 2025

Notes

  • This release contains no functional changes from NES v1.5.26.
  • This release implements a new package naming scheme for the AngularJS packages. More information about the change can be found in the NES Decoupled Namespace Specification.
  • Full package name(s) and version(s):
    • @neverendingsupport/angularjs@1.5.11-angularjs-1.5.27
    • @neverendingsupport/angularjs-animate@1.5.11-angularjs-1.5.27
    • @neverendingsupport/angularjs-aria@1.5.11-angularjs-1.5.27
    • @neverendingsupport/angularjs-cookies@1.5.11-angularjs-1.5.27
    • @neverendingsupport/angularjs-i18n@1.5.11-angularjs-1.5.27
    • @neverendingsupport/angularjs-loader@1.5.11-angularjs-1.5.27
    • @neverendingsupport/angularjs-message-format@1.5.11-angularjs-1.5.27
    • @neverendingsupport/angularjs-messages@1.5.11-angularjs-1.5.27
    • @neverendingsupport/angularjs-mocks@1.5.11-angularjs-1.5.27
    • @neverendingsupport/angularjs-parse-ext@1.5.11-angularjs-1.5.27
    • @neverendingsupport/angularjs-resource@1.5.11-angularjs-1.5.27
    • @neverendingsupport/angularjs-route@1.5.11-angularjs-1.5.27
    • @neverendingsupport/angularjs-sanitize@1.5.11-angularjs-1.5.27
    • @neverendingsupport/angularjs-touch@1.5.11-angularjs-1.5.27

1.5.26 (NES/XLTS) - May 28, 2025

Notes

Security & Compatibility Fixes

  • $compile:
    • Improve performance of srcset attribute sanitization.
    • Improve performance of comment-based directive collection.
  • $injector:
    • Improve performance of implicit dependency annotation.
  • linky:
    • Prevent ReDoS when searching for URLs in text.
      • This fixes a medium-severity Regular expression Denial of Service (ReDoS) vulnerability (CVE-2025-4690).

1.5.25 (NES/XLTS) - March 19, 2025

Security & Compatibility Fixes

  • $sanitize:
    • Sanitize image sources on <image> SVG elements.
      • This fixes a medium-severity Content Spoofing vulnerability (CVE-2025-2336).

1.5.24 (NES/XLTS) - February 18, 2025

Security & Compatibility Fixes

  • $compile:
    • Always sanitize image sources on <image> SVG element.
      • This fixes a medium-severity Content Spoofing vulnerability (CVE-2025-0716).

Breaking Changes

$compile
  • Always sanitize image sources on <image> SVG element:
    In the unlikely case that an app relied on trusted $sce.RESOURCE_URL values, via $sceDelegateProvider.resourceUrlWhitelist() or $sce.trustAs($sce.RESOURCE_URL, ...) or $sce.trustAsResourceUrl(), for the purpose of binding to the xlink:href property of <image> SVG elements and if the values do not pass the regular image URL sanitization, the affected SVG images will not be rendered.
    To fix this, you need to ensure that the values used for binding to the xlink:href attributes of <image> SVG elements are considered safe image URLs, via $compileProvider.imgSrcSanitizationWhitelist().
    Before:
    angular
    .module('myApp')
    .config(['$sceDelegateProvider', $sceDelegateProvider => {
      $sceDelegateProvider.resourceUrlWhitelist([
        // ...other resource URLs...

        // Allow resource URLs from `https://my.domain.com/images/`
        // for the purpose of using with `image[xlink:href]`.
        /https:\/\/my\.domain\.com\/images\/.*/,
      ]);
    }]);
// ...or...
angular
    .module('myApp')
    .run(['$rootScope', '$sce', ($rootScope, $sce) => {
      // Trust a specific URL as a resource URL for the purpose
      // of using in templates with `image[xlink:href]`.
      $rootScope.trustedImageUrl = $sce.trustAsResourceUrl(
          'https://my.domain.com/images/some-image.png');
    }]);

    After:
    angular
    .module('myApp')
    .config([
      '$compileProvider', '$sceDelegateProvider',
      ($compileProvider, $sceDelegateProvider) => {
        $sceDelegateProvider.resourceUrlWhitelist([
          // ...other resource URLs...
        ]);

        $compileProvider.imgSrcSanitizationWhitelist(
          // Allow image URLs from `https://my.domain.com/images/`
          // for the purpose of using with `<img>` or `<image>`.
          /^https:\/\/my\.domain\.com\/images\//,

          // ...or...

          // Trust specific URLs as image URLs for the purpose
          // of using in templates with `<img>` or `<image>`.
          /^https:\/\/my\.domain\.com\/images\/(?:some-image\.png|other-image\.jpg)$/,
        );
      },
    ]);

1.5.23 (NES/XLTS) - July 18, 2024

Notes

  • This release contains some metadata fixes and improvements:
    • Preserve license file headers in minified files.
    • Use correct names and versions in bower.json files.

Security & Compatibility Fixes

  • jqLite:
    • Add opt-in mode for compatibility with jQuery v4 via angular.jqLite_jQueryLt4CompatibilityEnabled().

1.5.22 (NES/XLTS) - May 21, 2024

Security & Compatibility Fixes

  • $compile:
    • Always sanitize image sources on <source> element.
      • This fixes a medium-severity Content Spoofing vulnerability (CVE-2024-8373).
  • srcset:
    • Prevent bypassing image source sanitization with (ng(Attr))Srcset.
      • This fixes a medium-severity Content Spoofing vulnerability (CVE-2024-8372).

1.5.21 (NES) - February 6, 2024

Notes

  • Repackaging XLTS for AngularJS as AngularJS NES
    • XLTS merged with HeroDevs in September 2023 and continues to support AngularJS under Never-Ending Support (NES).
  • AngularJS NES v1.5.21 is functionally equivalent to XLTS for AngularJS v1.5.19.

1.5.19 (XLTS) - August 18, 2023

Security & Compatibility Fixes

  • $compile:
    • Fix a possible ReDoS in ng-srcset parsing.
      • This fixes a high-severity Regular expression Denial of Service (ReDoS) vulnerability (CVE-2024-21490).
  • route:
    • Suppress warning from CodeQL regarding escaping backslash characters.

1.5.18 (XLTS) - August 4, 2023

Security & Compatibility Fixes

  • ngAnimate:
  • browserTrigger:
    • Fix focus triggering in IE with jQuery >=3.7.0.
  • bootstrap:
    • No longer trigger RegExp warning in CodeQL scans.

1.5.17 (XLTS) - February 7, 2023

Security & Compatibility Fixes

  • $resource:
    • Avoid DoS in stripping trailing slashes.
      • This fixes a medium-severity Regular expression Denial of Service (ReDoS) vulnerability (CVE-2023-26117).
  • Angular:
    • Collect jQuery nodes between two elements correctly for jQuery v4 preview.
    • Make a regex used in angular.copy DoS-safe.
      • This fixes a medium-severity Regular expression Denial of Service (ReDoS) vulnerability (CVE-2023-26116).
  • input:
    • Make URL_REGEXP less ambiguous.
      • This fixes a medium-severity Regular expression Denial of Service (ReDoS) vulnerability (CVE-2023-26118).

1.5.16 (XLTS) - June 8, 2022

Security & Compatibility Fixes

  • textarea:
    • Avoid interpolating when going back/forward on IE.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2022-25869).
  • input:
    • Prevent browsers from autofilling hidden inputs.
      • Autofilling with previous values (which will then be $interpolated) could lead to XSS or errors.

New Features

  • Angular:
    • Implement angular.version.vendor.
      • This now holds the value "XLTS.dev" for ease of determining if a supported version of AngularJS is running in a given app.

Breaking Changes

textarea
  • Avoid interpolating when going back/forward on IE:
    Previously, the HTML contents of <textarea> elements were interpolated on all browsers. Due to security considerations, the HTML contents of <textarea> elements are no longer interpolated on Internet Explorer.
    If you want to set the <textarea> element's value by evaluating an AngularJS expression, you can use ng-bind. For example:
    <!-- Before: -->
<textarea>{{ 1 + 2 }}</textarea>

<!-- After: -->
<textarea ng-bind="1 + 2"></textarea>

1.5.15 (XLTS) - February 7, 2022

Notes

  • With this release, we have completed the process of back-porting all the security fixes from AngularJS 1.8.2 to XLTS for AngularJS 1.5.x.

Security & Compatibility Fixes

  • $http:
    • All JSONP requests now require a trusted resource URL.
    • A JSONP callback must be specified by jsonpCallbackParam config.
    • Fix a potential DoS RegExp issue.

Breaking Changes

$http
  • All JSONP requests now require a trusted resource URL:
    All JSONP requests now require the URL to be trusted as resource URLs. There are two approaches to trust a URL:
    Whitelisting with the $sceDelegateProvider.resourceUrlWhitelist() method.
    You configure this list in a module configuration block:
    appModule.config(['$sceDelegateProvider', function($sceDelegateProvider) {
  $sceDelegateProvider.resourceUrlWhitelist([
    // Allow same origin resource loads.
    'self',
    // Allow JSONP calls that match this pattern
    'https://some.dataserver.com/**.jsonp?**'
  ]);
}]);

    Explicitly trusting the URL via the $sce.trustAsResourceUrl(url) method
    You can pass a trusted object instead of a string as a URL to the $http service:
    var promise = $http.jsonp($sce.trustAsResourceUrl(url));
  • A JSONP callback must be specified by jsonpCallbackParam config:
    You can no longer use the JSON_CALLBACK placeholder in your JSONP requests. Instead you must provide the name of the query parameter that will pass the callback via the jsonpCallbackParam property of the config object, or app-wide via the $http.defaults.jsonpCallbackParam property, which is "callback" by default.
    Before this change:
    $http.jsonp('trusted/url?callback=JSON_CALLBACK');
$http.jsonp('other/trusted/url', {params: {cb: 'JSON_CALLBACK'}});

    After this change:
    $http.jsonp('trusted/url');
$http.jsonp('other/trusted/url', {jsonpCallbackParam: 'cb'});

1.5.14 (XLTS) - December 3, 2021

Security & Compatibility Fixes

  • $sanitize:
    • Do not trigger CSP alert/report in Firefox and Chrome.
    • Sanitize xml:base attributes.
    • Use appropriate inert document strategy for Firefox and Safari.
    • Prevent clobbered elements from freezing the browser.
  • Angular:
    • Avoid catastrophic backtracking in XHTML_TAG_REGEXP.
  • jqLite:
    • Define jqLite.htmlPrefilter inline.
  • angular.merge:
    • Do not merge __proto__ property.
      • This fixes a high-severity Prototype Pollution vulnerability (CVE-2019-10768).

1.5.13 (XLTS) - August 20, 2021

Security & Compatibility Fixes

  • jqLite:
    • Prevent possible XSS due to regex-based HTML replacement.
      • This fixes a high-severity Cross Site Scripting (XSS) vulnerability (SNYK-JS-ANGULAR-572020).
      • This fixes a medium-severity Cross Site Scripting (XSS) vulnerability (CVE-2020-7676).
      • This fix was cherry-picked from the v1.8.x branch.
  • docs:
    • Remove extra . in error link URLs.

New Features

  • jqLite:
    • Print warnings for problematic HTML input.

Breaking Changes

jqLite
  • Prevent possible XSS due to regex-based HTML replacement:
    See https://jquery.com/upgrade-guide/3.5/.
    This applies a similar change to jqLite. Using self-closing tags in HTML is no longer supported.

1.5.12 (XLTS) - August 1, 2021

Notes

  • This is the first XLTS for AngularJS 1.5.x release! 🚀
  • As such, there have been updates to the License and the Security Policy. New security issues should be sent to security@xlts.dev.

Security & Compatibility Fixes

  • sanitizeUri:
    • Sanitize URIs that contain IDEOGRAPHIC SPACE chars.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (npm:angular:20171018).
      • This fix was cherry-picked from the v1.7.x branch.
  • jqlite:
    • nosel error points to an invalid URL.
  • $interpolate:
    • Fix docs URL in noconcat error.
  • $sce:
    • Fix docs URL in iequirks error.
  • misc:
    • Update error reference links to use code.angularjs.xlts.dev.
    • Fix 28 security warnings in build, test, and release tooling.
  • browserTrigger:
    • Support CompositionEvent.
  • grunt-utils:
    • Insert the core CSS styles without using innerHTML.
  • Angular:
    • Add workaround for Safari / Webdriver problem.
    • Do not auto bootstrap if the src exists but is empty.
    • Do not auto bootstrap if the currentScript has been clobbered.
    • Do not auto bootstrap if the script source is bad and inside SVG.
  • minErr:
    • Update URL to HTTPS.
  • docs:
    • Linting cleanup of the web worker used for search.
    • Fix @media breakpoints for small/extra small devices.
  • ngScenario:
    • Completely remove the Angular Scenario runner.

Breaking Changes

ngScenario
  • Completely remove the Angular Scenario runner:
    The angular scenario runner end-to-end test framework has been removed from the project and will no longer be available on npm starting with 1.5.12. It was deprecated and removed from the documentation in 2014. Applications that still use it should migrate to Protractor or another e2e testing framework.