AngularJS 1.8.x-1.9.x
Release Notes
1.9.11 (NES/XLTS) - September 19, 2025
Notes
- This release implements a new package naming scheme for the AngularJS packages. You can read more about the change in the NES Decoupled Namespace Specification.
- This release contains no functional changes from v1.9.10.
- The new full name and version for each package:
@neverendingsupport/angularjs@1.8.3-angularjs-1.9.11
@neverendingsupport/angularjs-animate@1.8.3-angularjs-1.9.11
@neverendingsupport/angularjs-aria@1.8.3-angularjs-1.9.11
@neverendingsupport/angularjs-cookies@1.8.3-angularjs-1.9.11
@neverendingsupport/angularjs-i18n@1.8.3-angularjs-1.9.11
@neverendingsupport/angularjs-loader@1.8.3-angularjs-1.9.11
@neverendingsupport/angularjs-message-format@1.8.3-angularjs-1.9.11
@neverendingsupport/angularjs-messages@1.8.3-angularjs-1.9.11
@neverendingsupport/angularjs-mocks@1.8.3-angularjs-1.9.11
@neverendingsupport/angularjs-parse-ext@1.8.3-angularjs-1.9.11
@neverendingsupport/angularjs-resource@1.8.3-angularjs-1.9.11
@neverendingsupport/angularjs-route@1.8.3-angularjs-1.9.11
@neverendingsupport/angularjs-sanitize@1.8.3-angularjs-1.9.11
@neverendingsupport/angularjs-touch@1.8.3-angularjs-1.9.11
1.9.10 (NES/XLTS) - May 28, 2025
Bug Fixes
- $compile:
- improve performance of
srcset
attribute sanitization - improve performance of comment-based directive collection
- improve performance of
- $injector: improve performance of implicit dependency annotation
- ngMocks: improve performance of trailing slash removal in
$httpBackend
- linky: prevent ReDoS when searching for URLs in text
- This fixes a Medium Severity ReDoS vulnerability (CVE-2025-4690)
Note
Although some of the bug fixes in this release are not for exploitable vulnerabilities, we are making the changes out of an abundance of caution and to proactively avoid incorrect flagging in SAST scans.
1.9.9 (NES/XLTS) - March 19, 2025
Bug Fixes
- $sanitize: sanitize image sources on
<image>
SVG elements- This fixes a Medium Severity Content Spoofing vulnerability (CVE-2025-2336)
1.9.8 (NES/XLTS) - February 18, 2025
Bug Fixes
- $compile: always sanitize image sources on
<image>
SVG element- This fixes a Medium Severity Content Spoofing vulnerability (CVE-2025-0716)
1.9.7 (NES/XLTS) - July 18, 2024
Bug Fixes
- *: preserve license file headers in minified files
- *: use correct names and versions in
bower.json
files
New Features
- jqLite: add opt-in mode for compatibility with jQuery v4 via
angular.jqLite_jQueryLt4CompatibilityEnabled()
- See Compatibility with jQuery v4 for more information.
1.9.6 (NES/XLTS) - May 21, 2024
Bug Fixes
- $compile: always sanitize image sources on
<source>
element- This fixes a Medium Severity Content Spoofing vulnerability (CVE-2024-8373)
- srcset: prevent bypassing image source sanitization with
(ng(Attr/Prop))Srcset
- This fixes a Medium Severity Content Spoofing vulnerability (CVE-2024-8372)
1.9.5 (NES) - February 4, 2024
Notes
- Fixed deployment script that resulted in v1.9.4 incorrectly registering as v1.9.5-local+sha.6756ba9 in various places (code headers, angular global object, etc)
1.9.4 (NES) - October 22, 2023
Notes
- Repackaging XLTS for AngularJS as AngularJS NES
- XLTS merged with HeroDevs in September 2023 and continues to support AngularJS under Never-Ending Support (NES)
- AngularJS NES v1.9.4 is functionally equivalent to XLTS for AngularJS v1.9.3
1.9.3 (XLTS) - August 18, 2023
Bug Fixes
- $compile: fix a vulnerable performance issue in ng-srcset parsing
- This fixes a High Severity ReDoS vulnerability (CVE-2024-21490)
- route: suppress warning from CodeQL regarding escaping backslash characters
1.9.2 (XLTS) - July 12, 2023
Bug Fixes
- ngAnimate: make animation duration calculation compatible with CSS Animations Level 2
- browserTrigger: fix focus triggering in IE with jQuery >=3.7.0
- bootstrap: no longer trigger RegExp warning in CodeQL scans
1.9.1 (XLTS) - April 4, 2023
Bug Fixes
- $compile: fix mergeConsecutiveTextNodes logic for jQuery v4 preview
- $resource: improve performance when stripping trailing slashes
- This fixes a Medium Severity ReDoS vulnerability (CVE-2023-26117)
- Angular:
- collect jQuery nodes between two elements correctly for jQuery v4 preview
- improve performance of regular expression used in angular.copy
- This fixes a Medium Severity ReDoS vulnerability (CVE-2023-26116)
- input: make URL_REGEXP less ambiguous
- This fixes a Medium Severity ReDoS vulnerability (CVE-2023-26118)
New Features
- jqLite: add opt-in mode for compatibility with jQuery v4 via
angular.jqLite_jQueryLt4CompatibilityEnabled()
- See Compatibility with jQuery v4 for more information.
1.9.0 (XLTS) - May 25, 2022
Bug Fixes
- textarea: avoid interpolating when going back/forward on IE
- This fixes a Medium Severity XSS vulnerability (CVE-2022-25869)
New Features
- Angular: implement angular.version.vendor
- This now holds the value "XLTS.dev" for ease of determining if a supported version of AngularJS is running in a given app
Breaking Changes
- textarea: Avoid interpolating when going back/forward on IE.
Previously, the HTML contents of<textarea>
elements were interpolated on all browsers. Due to security considerations, the HTML contents of<textarea>
elements are no longer interpolated on Internet Explorer. If you want to set the<textarea>
element's value by evaluating an AngularJS expression, you can use ng-bind or ng-prop-value. For example:<!-- Before: --> <textarea>{{ 1 + 2 }}</textarea> <!-- After: --> <textarea ng-bind="1 + 2"></textarea> <!-- ...or... --> <textarea ng-prop-value="1 + 2"></textarea>
1.8.8 (XLTS) - April 11, 2022
Bug Fixes
- $filter: fix ReDoS issue in currencyFilter
- This fixes a Medium Severity ReDoS vulnerability (CVE-2022-25844)
- ngMocks: use a more performant regex in stripQueryAndHash
1.8.7 (XLTS) - September 21, 2021
New Features
- jqLite: print console warnings for vulnerable HTML input
- This is related to a previous fix for Medium Severity and High Severity vulnerabilities associated with CVE-2020-7676 in 1.8.0
- ngCompileExtPreAssignBindings:
- introduce the ngCompileExtPreAssignBindings module. Learn more here.
- add types for the ngCompileExtPreAssignBindings module
1.8.6 (XLTS) - August 21, 2021
This release fixes the URLs for a number of console error messages and makes improvements to the docs.
Bug Fixes
- docs: linting cleanup of the web worker used for search
- $sce: fix docs URL in iequirks error
- $interpolate: fix docs URL in noconcat error
- jqlite: nosel error points to an invalid URL
- multiple: update error references to use code.angularjs.xlts.dev
1.8.5 (XLTS) - May 29, 2021
Bug Fixes
- ix 68 npm security audit warnings, mostly with the build tooling
- fix 20 GitHub Dependabot security alerts