@angular/core 20.3.18 → 20.3.20

package/schematics/bundles/{project_tsconfig_paths-MdN5DRlX.cjs → project_tsconfig_paths-D2eb40pS.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 /**
- * @license Angular v20.3.18
+ * @license Angular v20.3.20
  * (c) 2010-2025 Google LLC. https://angular.io/
  * License: MIT
  */
@@ -29656,8 +29656,9 @@ class HtmlAstToIvyAst {
                 // Note that validation is skipped and property mapping is disabled
                 // due to the fact that we need to make sure a given prop is not an
                 // input of a directive and directive matching happens at runtime.
+                const isAttrOn = prop.name.toLowerCase().startsWith('attr.on');
                 const bep = this.bindingParser.createBoundElementProperty(elementName, prop, 
-                /* skipValidation */ true, 
+                /* skipValidation */ !isAttrOn, 
                 /* mapPropertyName */ false);
                 bound.push(BoundAttribute.fromBoundElementProperty(bep, i18n));
             }
@@ -30553,8 +30554,30 @@ function verifyHostBindings(bindings, sourceSpan) {
     const bindingParser = makeBindingParser();
     bindingParser.createDirectiveHostEventAsts(bindings.listeners, sourceSpan);
     bindingParser.createBoundHostProperties(bindings.properties, sourceSpan);
+    validateNoEventBindings(bindings, bindingParser, sourceSpan);
     return bindingParser.errors;
 }
+/**
+ * Validates that there are no event attribute bindings in the host bindings.
+ * @param bindings - Map of host bindings for the component.
+ * @param bindingParser - Binding parser used to create the binding expression.
+ * @param sourceSpan - Source span where the host bindings were defined.
+ */
+function validateNoEventBindings(bindings, bindingParser, sourceSpan) {
+    for (const prop in bindings.properties) {
+        const isAttr = prop.startsWith('attr.');
+        const boundName = isAttr ? prop.slice(5) : prop;
+        if (boundName.toLowerCase().startsWith('on')) {
+            const errorType = isAttr ? 'attribute' : 'property';
+            const suggestion = `(${boundName.slice(2)})=...`;
+            let msg = `Binding to event ${errorType} '${boundName}' is disallowed for security reasons, please use ${suggestion}`;
+            if (!isAttr) {
+                msg += `\nIf '${prop}' is a directive input, make sure the directive is imported by the current module.`;
+            }
+            bindingParser.errors.push(new ParseError(sourceSpan, msg));
+        }
+    }
+}
 function compileStyles(styles, selector, hostSelector) {
     const shadowCss = new ShadowCss();
     return styles.map((style) => {
@@ -32196,11 +32219,6 @@ function createR3ComponentDeferMetadata(boundTarget, deferBlockDependencies) {
 function extractHostBindings$1(propMetadata, sourceSpan, host) {
     // First parse the declarations from the metadata.
     const bindings = parseHostBindings(host || {});
-    // After that check host bindings for errors
-    const errors = verifyHostBindings(bindings, sourceSpan);
-    if (errors.length) {
-        throw new Error(errors.map((error) => error.msg).join('\n'));
-    }
     // Next, loop over the properties of the object, looking for @HostBinding and @HostListener.
     for (const field in propMetadata) {
         if (propMetadata.hasOwnProperty(field)) {
@@ -32217,6 +32235,11 @@ function extractHostBindings$1(propMetadata, sourceSpan, host) {
             });
         }
     }
+    // After that check host bindings for errors
+    const errors = verifyHostBindings(bindings, sourceSpan);
+    if (errors.length) {
+        throw new Error(errors.map((error) => error.msg).join('\n'));
+    }
     return bindings;
 }
 function isHostBinding(value) {
@@ -32831,7 +32854,7 @@ function isAttrNode(ast) {
  * @description
  * Entry point for all public APIs of the compiler package.
  */
-const VERSION = new Version('20.3.18');
+const VERSION = new Version('20.3.20');
 
 //////////////////////////////////////
 // THIS FILE HAS GLOBAL SIDE EFFECT //
@@ -33893,7 +33916,7 @@ class NodeJSPathManipulation {
 // G3-ESM-MARKER: G3 uses CommonJS, but externally everything in ESM.
 // CommonJS/ESM interop for determining the current file name and containing dir.
 const isCommonJS = typeof __filename !== 'undefined';
-const currentFileUrl = isCommonJS ? null : (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('project_tsconfig_paths-MdN5DRlX.cjs', document.baseURI).href));
+const currentFileUrl = isCommonJS ? null : (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('project_tsconfig_paths-D2eb40pS.cjs', document.baseURI).href));
 // Note, when this code loads in the browser, `url` may be an empty `{}` due to the Closure shims.
 const currentFileName = isCommonJS
     ? __filename
@@ -43366,6 +43389,13 @@ class RegistryDomSchemaChecker {
         }
     }
     checkTemplateElementProperty(id, tagName, name, span, schemas, hostIsStandalone) {
+        const report = REGISTRY$1.validateProperty(name);
+        if (report.error) {
+            const mapping = this.resolver.getTemplateSourceMapping(id);
+            const diag = makeTemplateDiagnostic(id, mapping, span, ts.DiagnosticCategory.Error, ngErrorCode(exports.ErrorCode.SCHEMA_INVALID_ATTRIBUTE), report.msg);
+            this._diagnostics.push(diag);
+            return;
+        }
         if (!REGISTRY$1.hasProperty(tagName, name, schemas)) {
             const mapping = this.resolver.getTemplateSourceMapping(id);
             const decorator = hostIsStandalone ? '@Component' : '@NgModule';
@@ -43389,6 +43419,13 @@ class RegistryDomSchemaChecker {
         }
     }
     checkHostElementProperty(id, element, name, span, schemas) {
+        const report = REGISTRY$1.validateProperty(name);
+        if (report.error) {
+            const mapping = this.resolver.getHostBindingsMapping(id);
+            const diag = makeTemplateDiagnostic(id, mapping, span, ts.DiagnosticCategory.Error, ngErrorCode(exports.ErrorCode.SCHEMA_INVALID_ATTRIBUTE), report.msg);
+            this._diagnostics.push(diag);
+            return;
+        }
         for (const tagName of element.tagNames) {
             if (REGISTRY$1.hasProperty(tagName, name, schemas)) {
                 continue;

package/schematics/bundles/property_name-BBwFuqMe.cjs

@@ -1,6 +1,6 @@
 'use strict';
 /**
- * @license Angular v20.3.18
+ * @license Angular v20.3.20
  * (c) 2010-2025 Google LLC. https://angular.io/
  * License: MIT
  */

package/schematics/bundles/route-lazy-loading.cjs

@@ -1,6 +1,6 @@
 'use strict';
 /**
- * @license Angular v20.3.18
+ * @license Angular v20.3.20
  * (c) 2010-2025 Google LLC. https://angular.io/
  * License: MIT
  */
@@ -9,8 +9,8 @@
 var schematics = require('@angular-devkit/schematics');
 var fs = require('fs');
 var p = require('path');
-var compiler_host = require('./compiler_host-Ber_JSyo.cjs');
-var project_tsconfig_paths = require('./project_tsconfig_paths-MdN5DRlX.cjs');
+var compiler_host = require('./compiler_host-AFZotBLM.cjs');
+var project_tsconfig_paths = require('./project_tsconfig_paths-D2eb40pS.cjs');
 var ts = require('typescript');
 var property_name = require('./property_name-BBwFuqMe.cjs');
 require('os');

package/schematics/bundles/router-current-navigation.cjs

@@ -1,6 +1,6 @@
 'use strict';
 /**
- * @license Angular v20.3.18
+ * @license Angular v20.3.20
  * (c) 2010-2025 Google LLC. https://angular.io/
  * License: MIT
  */
@@ -8,11 +8,11 @@
 
 var ts = require('typescript');
 require('os');
-require('./project_tsconfig_paths-MdN5DRlX.cjs');
-require('./index-DUHSh_FI.cjs');
+require('./project_tsconfig_paths-D2eb40pS.cjs');
+require('./index-kR-YjYku.cjs');
 require('path');
 require('node:path');
-var project_paths = require('./project_paths-D9GYMpqK.cjs');
+var project_paths = require('./project_paths-Bq_k0pof.cjs');
 var imports = require('./imports-CIX-JgAN.cjs');
 var symbol = require('./symbol-VPWguRxr.cjs');
 require('@angular-devkit/core');

package/schematics/bundles/self-closing-tags-migration.cjs

@@ -1,6 +1,6 @@
 'use strict';
 /**
- * @license Angular v20.3.18
+ * @license Angular v20.3.20
  * (c) 2010-2025 Google LLC. https://angular.io/
  * License: MIT
  */
@@ -8,11 +8,11 @@
 
 var ts = require('typescript');
 require('os');
-var project_tsconfig_paths = require('./project_tsconfig_paths-MdN5DRlX.cjs');
-require('./index-DUHSh_FI.cjs');
+var project_tsconfig_paths = require('./project_tsconfig_paths-D2eb40pS.cjs');
+require('./index-kR-YjYku.cjs');
 require('path');
 require('node:path');
-var project_paths = require('./project_paths-D9GYMpqK.cjs');
+var project_paths = require('./project_paths-Bq_k0pof.cjs');
 var ng_decorators = require('./ng_decorators-B5HCqr20.cjs');
 var property_name = require('./property_name-BBwFuqMe.cjs');
 require('@angular-devkit/core');

package/schematics/bundles/signal-input-migration.cjs

@@ -1,23 +1,23 @@
 'use strict';
 /**
- * @license Angular v20.3.18
+ * @license Angular v20.3.20
  * (c) 2010-2025 Google LLC. https://angular.io/
  * License: MIT
  */
 'use strict';
 
-var migrate_ts_type_references = require('./migrate_ts_type_references-DLcyIMjy.cjs');
+var migrate_ts_type_references = require('./migrate_ts_type_references-BgYfSnnL.cjs');
 var ts = require('typescript');
 require('os');
-var project_tsconfig_paths = require('./project_tsconfig_paths-MdN5DRlX.cjs');
-var index$1 = require('./index-DUHSh_FI.cjs');
+var project_tsconfig_paths = require('./project_tsconfig_paths-D2eb40pS.cjs');
+var index$1 = require('./index-kR-YjYku.cjs');
 require('path');
 require('node:path');
-var project_paths = require('./project_paths-D9GYMpqK.cjs');
-var index = require('./index-B8IUVpRW.cjs');
+var project_paths = require('./project_paths-Bq_k0pof.cjs');
+var index = require('./index-CD4aCRVu.cjs');
 var assert$1 = require('assert');
 var assert = require('node:assert');
-var apply_import_manager = require('./apply_import_manager-CTzEuFJw.cjs');
+var apply_import_manager = require('./apply_import_manager-Clb1Y0Nb.cjs');
 require('@angular-devkit/core');
 require('node:path/posix');
 require('./leading_space-D9nQ8UQC.cjs');

package/schematics/bundles/signal-queries-migration.cjs

@@ -1,23 +1,23 @@
 'use strict';
 /**
- * @license Angular v20.3.18
+ * @license Angular v20.3.20
  * (c) 2010-2025 Google LLC. https://angular.io/
  * License: MIT
  */
 'use strict';
 
-var project_tsconfig_paths = require('./project_tsconfig_paths-MdN5DRlX.cjs');
+var project_tsconfig_paths = require('./project_tsconfig_paths-D2eb40pS.cjs');
 var ts = require('typescript');
 require('os');
-var index$1 = require('./index-DUHSh_FI.cjs');
+var index$1 = require('./index-kR-YjYku.cjs');
 require('path');
 require('node:path');
-var project_paths = require('./project_paths-D9GYMpqK.cjs');
-var apply_import_manager = require('./apply_import_manager-CTzEuFJw.cjs');
-var migrate_ts_type_references = require('./migrate_ts_type_references-DLcyIMjy.cjs');
+var project_paths = require('./project_paths-Bq_k0pof.cjs');
+var apply_import_manager = require('./apply_import_manager-Clb1Y0Nb.cjs');
+var migrate_ts_type_references = require('./migrate_ts_type_references-BgYfSnnL.cjs');
 var assert = require('assert');
 require('node:assert');
-var index = require('./index-B8IUVpRW.cjs');
+var index = require('./index-CD4aCRVu.cjs');
 require('@angular-devkit/core');
 require('node:path/posix');
 require('fs');

package/schematics/bundles/signals.cjs

@@ -1,6 +1,6 @@
 'use strict';
 /**
- * @license Angular v20.3.18
+ * @license Angular v20.3.20
  * (c) 2010-2025 Google LLC. https://angular.io/
  * License: MIT
  */
@@ -10,7 +10,7 @@ var schematics = require('@angular-devkit/schematics');
 var signalQueriesMigration = require('./signal-queries-migration.cjs');
 var signalInputMigration = require('./signal-input-migration.cjs');
 var outputMigration = require('./output-migration.cjs');
-require('./project_tsconfig_paths-MdN5DRlX.cjs');
+require('./project_tsconfig_paths-D2eb40pS.cjs');
 require('typescript');
 require('os');
 require('fs');
@@ -18,14 +18,14 @@ require('module');
 require('path');
 require('url');
 require('@angular-devkit/core');
-require('./index-DUHSh_FI.cjs');
+require('./index-kR-YjYku.cjs');
 require('node:path');
-require('./project_paths-D9GYMpqK.cjs');
+require('./project_paths-Bq_k0pof.cjs');
 require('node:path/posix');
-require('./apply_import_manager-CTzEuFJw.cjs');
-require('./migrate_ts_type_references-DLcyIMjy.cjs');
+require('./apply_import_manager-Clb1Y0Nb.cjs');
+require('./migrate_ts_type_references-BgYfSnnL.cjs');
 require('assert');
-require('./index-B8IUVpRW.cjs');
+require('./index-CD4aCRVu.cjs');
 require('./leading_space-D9nQ8UQC.cjs');
 require('node:assert');
 

package/schematics/bundles/standalone-migration.cjs

@@ -1,18 +1,18 @@
 'use strict';
 /**
- * @license Angular v20.3.18
+ * @license Angular v20.3.20
  * (c) 2010-2025 Google LLC. https://angular.io/
  * License: MIT
  */
 'use strict';
 
 var schematics = require('@angular-devkit/schematics');
-var index = require('./index-DUHSh_FI.cjs');
+var index = require('./index-kR-YjYku.cjs');
 var fs = require('fs');
 var p = require('path');
 var ts = require('typescript');
-var compiler_host = require('./compiler_host-Ber_JSyo.cjs');
-var project_tsconfig_paths = require('./project_tsconfig_paths-MdN5DRlX.cjs');
+var compiler_host = require('./compiler_host-AFZotBLM.cjs');
+var project_tsconfig_paths = require('./project_tsconfig_paths-D2eb40pS.cjs');
 var ng_decorators = require('./ng_decorators-B5HCqr20.cjs');
 var nodes = require('./nodes-B16H9JUd.cjs');
 var symbol = require('./symbol-VPWguRxr.cjs');

package/schematics/bundles/symbol-VPWguRxr.cjs

@@ -1,6 +1,6 @@
 'use strict';
 /**
- * @license Angular v20.3.18
+ * @license Angular v20.3.20
  * (c) 2010-2025 Google LLC. https://angular.io/
  * License: MIT
  */

package/schematics/bundles/test-bed-get.cjs

@@ -1,6 +1,6 @@
 'use strict';
 /**
- * @license Angular v20.3.18
+ * @license Angular v20.3.20
  * (c) 2010-2025 Google LLC. https://angular.io/
  * License: MIT
  */
@@ -8,11 +8,11 @@
 
 var ts = require('typescript');
 require('os');
-require('./project_tsconfig_paths-MdN5DRlX.cjs');
-require('./index-DUHSh_FI.cjs');
+require('./project_tsconfig_paths-D2eb40pS.cjs');
+require('./index-kR-YjYku.cjs');
 require('path');
 require('node:path');
-var project_paths = require('./project_paths-D9GYMpqK.cjs');
+var project_paths = require('./project_paths-Bq_k0pof.cjs');
 var imports = require('./imports-CIX-JgAN.cjs');
 var symbol = require('./symbol-VPWguRxr.cjs');
 require('@angular-devkit/core');

package/testing/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * @license Angular v20.3.18
+ * @license Angular v20.3.20
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */

package/weak_ref.d.d.ts

@@ -1,5 +1,5 @@
 /**
- * @license Angular v20.3.18
+ * @license Angular v20.3.20
  * (c) 2010-2025 Google LLC. https://angular.dev/
  * License: MIT
  */