@brickhouse-tech/angular-lts 1.8.4-0 → 1.9.0-pre.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +81 -109
- package/index.js +2 -1
- package/package.json +6 -32
- package/angular.js +0 -36600
- package/angular.min.js +0 -352
- package/angular.min.js.map +0 -8
package/README.md
CHANGED
|
@@ -1,109 +1,81 @@
|
|
|
1
|
-
AngularJS
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
**
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
to load the app, which components or controllers to use for each element, etc. We specify "what"
|
|
83
|
-
gets loaded, but not "how". This declarative approach greatly simplifies app development in a sort
|
|
84
|
-
of WYSIWYG way. Rather than spending time on how the program flows and orchestrating the various
|
|
85
|
-
moving parts, we simply define what we want and AngularJS will take care of the dependencies.
|
|
86
|
-
|
|
87
|
-
#### Data Handling made simple
|
|
88
|
-
Data and Data Models in AngularJS are plain JavaScript objects and one can add and change properties
|
|
89
|
-
directly on it and loop over objects and arrays at will.
|
|
90
|
-
|
|
91
|
-
#### Two-way Data Binding
|
|
92
|
-
One of AngularJS's strongest features. Two-way Data Binding means that if something changes in the
|
|
93
|
-
Model, the change gets reflected in the View instantaneously, and the same happens the other way
|
|
94
|
-
around. This is also referred to as Reactive Programming, i.e. suppose `a = b + c` is being
|
|
95
|
-
programmed and after this, if the value of `b` and/or `c` is changed then the value of `a` will be
|
|
96
|
-
automatically updated to reflect the change. AngularJS uses its "scopes" as a glue between the Model
|
|
97
|
-
and View and makes these updates in one available for the other.
|
|
98
|
-
|
|
99
|
-
#### Less Written Code and Easily Maintainable Code
|
|
100
|
-
Everything in AngularJS is created to enable the programmer to end up writing less code that is
|
|
101
|
-
easily maintainable and readable by any other new person on the team. Believe it or not, one can
|
|
102
|
-
write a complete working two-way data binded application in less than 10 lines of code. Try and see
|
|
103
|
-
for yourself!
|
|
104
|
-
|
|
105
|
-
#### Testing Ready
|
|
106
|
-
AngularJS has Dependency Injection, i.e. it takes care of providing all the necessary dependencies
|
|
107
|
-
to its controllers and services whenever required. This helps in making the AngularJS code ready for
|
|
108
|
-
unit testing by making use of mock dependencies created and injected. This makes AngularJS more
|
|
109
|
-
modular and easily testable thus in turn helping a team create more robust applications.
|
|
1
|
+
AngularJS LTS — Community Security Patches
|
|
2
|
+
===========================================
|
|
3
|
+
|
|
4
|
+
> **This is a community-maintained fork of AngularJS 1.x** providing security patches for known CVEs.
|
|
5
|
+
> The original AngularJS project reached End-of-Life in January 2022 and no longer receives updates.
|
|
6
|
+
|
|
7
|
+
## Why This Fork?
|
|
8
|
+
|
|
9
|
+
AngularJS still has **~2 million monthly npm downloads**. Thousands of enterprise applications depend on it.
|
|
10
|
+
The only alternative for security patches was expensive commercial support ($15K–$50K+/year).
|
|
11
|
+
This fork provides **free, open-source security patches** as a drop-in replacement.
|
|
12
|
+
|
|
13
|
+
## What's Included
|
|
14
|
+
|
|
15
|
+
- ✅ **8 CVE/vulnerability fixes** (2 HIGH, 6 MEDIUM) — see table below
|
|
16
|
+
- ✅ **Drop-in replacement** — same API, same behavior, just patched
|
|
17
|
+
- ✅ **CI via GitHub Actions** — tested on Node 20
|
|
18
|
+
- ✅ **OIDC npm publishing** with provenance
|
|
19
|
+
- ✅ **MIT licensed** — same as upstream
|
|
20
|
+
|
|
21
|
+
## Security Patches
|
|
22
|
+
|
|
23
|
+
| CVE / Snyk ID | Severity | Type | Status |
|
|
24
|
+
|---|---|---|---|
|
|
25
|
+
| SNYK-JS-ANGULAR-6091113 | **HIGH** | ReDoS in `ng-srcset` directive | ✅ Fixed |
|
|
26
|
+
| CVE-2022-25844 | **HIGH** | ReDoS in `angular.copy` | ✅ Fixed |
|
|
27
|
+
| SNYK-JS-ANGULAR-9919773 | Medium | SVG `<image>` href sanitization bypass | ✅ Fixed |
|
|
28
|
+
| SNYK-JS-ANGULAR-7924843 | Medium | `srcset` allowlist bypass | ✅ Fixed |
|
|
29
|
+
| SNYK-JS-ANGULAR-7924842 | Medium | `<source>` srcset not sanitized | ✅ Fixed |
|
|
30
|
+
| SNYK-JS-ANGULAR-3373046 / CVE-2020-7212 | Medium | ReDoS in URL input validation | ✅ Fixed |
|
|
31
|
+
| SNYK-JS-ANGULAR-3373045 | Medium | ReDoS in `$resource` service | ✅ Fixed |
|
|
32
|
+
| CVE-2020-7676 | Medium | Prototype pollution via `merge`/`copy` | ✅ Fixed |
|
|
33
|
+
| SNYK-JS-ANGULAR-2949781 | Medium | XSS via `<textarea>` (IE-specific) | 🔄 Planned |
|
|
34
|
+
| SNYK-JS-ANGULAR-2772735 | Medium | ReDoS in locale number formatting | 🔄 Planned |
|
|
35
|
+
| CVE-2022-25869 | Medium | `$sanitize` bypass via `<style>` (IE/Edge) | 🔄 Planned |
|
|
36
|
+
|
|
37
|
+
## Installation
|
|
38
|
+
|
|
39
|
+
```bash
|
|
40
|
+
npm install @brickhouse-tech/angular-lts
|
|
41
|
+
```
|
|
42
|
+
|
|
43
|
+
Drop-in replacement for `angular@1.8.3`. Same API, same behavior.
|
|
44
|
+
|
|
45
|
+
## Migration from `angular`
|
|
46
|
+
|
|
47
|
+
```diff
|
|
48
|
+
- "angular": "1.8.3"
|
|
49
|
+
+ "@brickhouse-tech/angular-lts": "^1.8.4"
|
|
50
|
+
```
|
|
51
|
+
|
|
52
|
+
No code changes required.
|
|
53
|
+
|
|
54
|
+
## Sponsorship
|
|
55
|
+
|
|
56
|
+
This project is maintained by [Brickhouse Tech](https://github.com/brickhouse-tech).
|
|
57
|
+
If your organization depends on AngularJS, consider sponsoring to ensure continued maintenance.
|
|
58
|
+
|
|
59
|
+
[](https://github.com/sponsors/brickhouse-tech)
|
|
60
|
+
|
|
61
|
+
| Tier | Price | Benefits |
|
|
62
|
+
|------|-------|----------|
|
|
63
|
+
| Community | Free | Open source patches, npm package |
|
|
64
|
+
| Supporter | $50/mo | Logo on README, priority issues |
|
|
65
|
+
| Professional | $500/mo | 48h SLA, private Slack, migration guidance |
|
|
66
|
+
| Enterprise | $5,000/mo | 4h SLA, custom patches, compliance docs |
|
|
67
|
+
|
|
68
|
+
## Versioning
|
|
69
|
+
|
|
70
|
+
This fork follows the upstream `1.8.x` line. Security patches are published as `1.8.4+` releases.
|
|
71
|
+
Prerelease versions use the format `1.8.4-N`.
|
|
72
|
+
|
|
73
|
+
## License
|
|
74
|
+
|
|
75
|
+
MIT — same as the original AngularJS project. See [LICENSE](LICENSE).
|
|
76
|
+
|
|
77
|
+
## Links
|
|
78
|
+
|
|
79
|
+
- **npm**: [@brickhouse-tech/angular-lts](https://www.npmjs.com/package/@brickhouse-tech/angular-lts)
|
|
80
|
+
- **Original project**: [angular/angular.js](https://github.com/angular/angular.js) (archived)
|
|
81
|
+
- **HeroDevs NES** (commercial alternative): [herodevs.com](https://www.herodevs.com/support/angularjs-nes)
|
package/index.js
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@brickhouse-tech/angular-lts",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.9.0-pre.0",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"branchVersion": "^1.8.0",
|
|
6
6
|
"branchPattern": "1.8.*",
|
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
"url": "https://github.com/brickhouse-tech/angular.js.git"
|
|
11
11
|
},
|
|
12
12
|
"engines": {
|
|
13
|
-
"node": ">=
|
|
13
|
+
"node": ">=20"
|
|
14
14
|
},
|
|
15
15
|
"main": "index.js",
|
|
16
16
|
"files": [
|
|
@@ -24,9 +24,10 @@
|
|
|
24
24
|
"README.md"
|
|
25
25
|
],
|
|
26
26
|
"scripts": {
|
|
27
|
-
"build": "
|
|
27
|
+
"build": "npx grunt package && cp build/angular.js build/angular.min.js build/angular.min.js.map . 2>/dev/null || true",
|
|
28
28
|
"prepublishOnly": "echo 'Run npm run build first if dist files are missing'",
|
|
29
|
-
"
|
|
29
|
+
"lint": "npx grunt eslint",
|
|
30
|
+
"test": "npx grunt test:promises-aplus",
|
|
30
31
|
"test-i18n": "jasmine-node i18n/spec",
|
|
31
32
|
"test-i18n-ucd": "jasmine-node i18n/ucd/spec"
|
|
32
33
|
},
|
|
@@ -34,20 +35,13 @@
|
|
|
34
35
|
"angular-benchpress": "0.x.x",
|
|
35
36
|
"benchmark": "1.x.x",
|
|
36
37
|
"bootstrap": "3.1.1",
|
|
37
|
-
"browserstacktunnel-wrapper": "2.0.4",
|
|
38
38
|
"canonical-path": "0.0.2",
|
|
39
|
-
"changez": "^2.1.1",
|
|
40
|
-
"changez-angular": "^2.1.2",
|
|
41
39
|
"cheerio": "^0.17.0",
|
|
42
|
-
"commitizen": "^4.2.4",
|
|
43
|
-
"commitplease": "^2.7.10",
|
|
44
40
|
"cross-spawn": "^4.0.0",
|
|
45
|
-
"cz-conventional-changelog": "1.1.4",
|
|
46
41
|
"dgeni": "^0.4.9",
|
|
47
42
|
"dgeni-packages": "^0.26.5",
|
|
48
43
|
"eslint-plugin-promise": "^3.6.0",
|
|
49
44
|
"event-stream": "~3.1.0",
|
|
50
|
-
"firebase-tools": "^9.3.0",
|
|
51
45
|
"glob": "^6.0.1",
|
|
52
46
|
"google-code-prettify": "1.0.1",
|
|
53
47
|
"grunt": "^1.4.1",
|
|
@@ -76,15 +70,10 @@
|
|
|
76
70
|
"jquery-2.1": "npm:jquery@2.1.4",
|
|
77
71
|
"jquery-2.2": "npm:jquery@2.2.4",
|
|
78
72
|
"karma": "4.4.1",
|
|
79
|
-
"karma-browserstack-launcher": "1.5.1",
|
|
80
73
|
"karma-chrome-launcher": "3.1.0",
|
|
81
|
-
"karma-edge-launcher": "0.4.2",
|
|
82
74
|
"karma-firefox-launcher": "1.2.0",
|
|
83
|
-
"karma-ie-launcher": "1.0.0",
|
|
84
75
|
"karma-jasmine": "^1.1.2",
|
|
85
76
|
"karma-junit-reporter": "2.0.1",
|
|
86
|
-
"karma-safari-launcher": "1.0.0",
|
|
87
|
-
"karma-sauce-launcher": "2.0.2",
|
|
88
77
|
"karma-script-launcher": "1.0.0",
|
|
89
78
|
"karma-spec-reporter": "0.0.32",
|
|
90
79
|
"load-grunt-tasks": "^3.5.0",
|
|
@@ -96,14 +85,11 @@
|
|
|
96
85
|
"npm-run": "^4.1.0",
|
|
97
86
|
"open-sans-fontface": "^1.4.0",
|
|
98
87
|
"promises-aplus-tests": "~2.1.0",
|
|
99
|
-
"protractor": "^7.0.0",
|
|
100
88
|
"q": "~1.0.0",
|
|
101
89
|
"q-io": "^1.10.9",
|
|
102
90
|
"qq": "^0.3.5",
|
|
103
91
|
"rewire": "~2.1.0",
|
|
104
|
-
"sauce-connect": "https://saucelabs.com/downloads/sc-4.6.2-linux.tar.gz",
|
|
105
92
|
"sax": "^1.1.1",
|
|
106
|
-
"selenium-webdriver": "^4.0.0-alpha.1",
|
|
107
93
|
"semver": "^5.4.1",
|
|
108
94
|
"serve-favicon": "^2.3.0",
|
|
109
95
|
"serve-index": "^1.8.0",
|
|
@@ -113,20 +99,8 @@
|
|
|
113
99
|
"stringmap": "^0.2.2"
|
|
114
100
|
},
|
|
115
101
|
"dependencies": {},
|
|
116
|
-
"
|
|
117
|
-
"//1": "`natives@1.1.0` does not work with Node.js 10.x on Windows 10",
|
|
118
|
-
"//2": "(E.g. see https://github.com/gulpjs/gulp/issues/2162 and https://github.com/nodejs/node/issues/25132.)",
|
|
102
|
+
"overrides": {
|
|
119
103
|
"natives": "1.1.6",
|
|
120
|
-
"//3": "`graceful-fs` needs to be pinned to support gulp 3, on Node v12+",
|
|
121
104
|
"graceful-fs": "^4.2.3"
|
|
122
|
-
},
|
|
123
|
-
"commitplease": {
|
|
124
|
-
"style": "angular",
|
|
125
|
-
"nohook": true
|
|
126
|
-
},
|
|
127
|
-
"config": {
|
|
128
|
-
"commitizen": {
|
|
129
|
-
"path": "node_modules/cz-conventional-changelog"
|
|
130
|
-
}
|
|
131
105
|
}
|
|
132
106
|
}
|